Visitar URL original
fix: isolate/runtime lifetime — worker startup race, teardown use-after-free, and leaks by edusperoni · Pull Request #2006 · NativeScript/android · GitHub
Skip to content

fix: isolate/runtime lifetime — worker startup race, teardown use-after-free, and leaks #2006

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
edusperoni merged 4 commits into from
Aug 14, 2026
Merged

fix: isolate/runtime lifetime — worker startup race, teardown use-after-free, and leaks #2006

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7699369
fix: own isolate-bound state per runtime instead of in shared maps
edusperoni Aug 14, 2026
6c294e4
fix: release isolate-bound state while the isolate is still alive
edusperoni Aug 14, 2026
d87221d
fix: don't reset constant handles the constructor never allocated
edusperoni Aug 14, 2026
e7b3d14
fix: free the constructor caches' persistents in ~MetadataNodeCache
edusperoni Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix: don't reset constant handles the constructor never allocated 
PerIsolateV8Constants declares 20 Persistent<String>* members but the
constructor allocates 19: DEBUG_NAME_PERSISTENT is never assigned. Its
destructor reset that member unconditionally, so it would have faulted on an
uninitialized pointer the first time it ran -- which nothing ever did, because
the object was leaked rather than deleted. Deleting it exposed the fault
immediately: every worker teardown segfaulted in ~PerIsolateV8Constants.

Default-initialize every member so the destructor is safe regardless of which
ones the constructor populates; ResetAndDelete already skips nulls.
  • Loading branch information
@edusperoni
edusperoni committed Aug 14, 2026
commit d87221d41b05f0247a562d7ba2a75dbb63abb9f1
45 changes: 24 additions & 21 deletions test-app/runtime/src/main/cpp/V8StringConstants.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,10 @@ class V8StringConstants {
~PerIsolateV8Constants() {
// Persistent's traits do not reset in the destructor, so each
// handle is reset explicitly (requires a live isolate) and then
// freed. Generated from the member list -- keep the two in step.
// freed. Every member is default-initialized because not all of
// them are allocated by the constructor -- DEBUG_NAME_PERSISTENT
// never is, and the previous version of this destructor reset it
// unconditionally, which would have faulted had it ever run.
ResetAndDelete(CLASS_IMPLEMENTATION_OBJECT_PERSISTENT);
ResetAndDelete(DEBUG_NAME_PERSISTENT);
ResetAndDelete(DISCARDED_ERROR_PERSISTENT);
Expand Down Expand Up @@ -182,26 +185,26 @@ class V8StringConstants {
}
}

v8::Persistent<v8::String>* CLASS_IMPLEMENTATION_OBJECT_PERSISTENT;
v8::Persistent<v8::String>* DEBUG_NAME_PERSISTENT;
v8::Persistent<v8::String>* EXTEND_PERSISTENT;
v8::Persistent<v8::String>* NULL_OBJECT_PERSISTENT;
v8::Persistent<v8::String>* NULL_NODE_NAME_PERSISTENT;
v8::Persistent<v8::String>* IS_PROTOTYPE_IMPLEMENTATION_OBJECT_PERSISTENT;
v8::Persistent<v8::String>* NATIVE_EXCEPTION_PERSISTENT;
v8::Persistent<v8::String>* STACK_PERSISTENT;
v8::Persistent<v8::String>* STACK_TRACE_PERSISTENT;
v8::Persistent<v8::String>* LONG_NUMBER_PERSISTENT;
v8::Persistent<v8::String>* PROTOTYPE_PERSISTENT;
v8::Persistent<v8::String>* SUPER_PERSISTENT;
v8::Persistent<v8::String>* TARGET_PERSISTENT;
v8::Persistent<v8::String>* TO_STRING_PERSISTENT;
v8::Persistent<v8::String>* JAVA_LONG_PERSISTENT;
v8::Persistent<v8::String>* VALUE_OF_PERSISTENT;
v8::Persistent<v8::String>* VALUE_PERSISTENT;
v8::Persistent<v8::String>* UNCAUGHT_ERROR_PERSISTENT;
v8::Persistent<v8::String>* DISCARDED_ERROR_PERSISTENT;
v8::Persistent<v8::String>* IMPLEMENTATION_OBJECT_PERSISTENT;
v8::Persistent<v8::String>* CLASS_IMPLEMENTATION_OBJECT_PERSISTENT = nullptr;
v8::Persistent<v8::String>* DEBUG_NAME_PERSISTENT = nullptr;
v8::Persistent<v8::String>* EXTEND_PERSISTENT = nullptr;
v8::Persistent<v8::String>* NULL_OBJECT_PERSISTENT = nullptr;
v8::Persistent<v8::String>* NULL_NODE_NAME_PERSISTENT = nullptr;
v8::Persistent<v8::String>* IS_PROTOTYPE_IMPLEMENTATION_OBJECT_PERSISTENT = nullptr;
v8::Persistent<v8::String>* NATIVE_EXCEPTION_PERSISTENT = nullptr;
v8::Persistent<v8::String>* STACK_PERSISTENT = nullptr;
v8::Persistent<v8::String>* STACK_TRACE_PERSISTENT = nullptr;
v8::Persistent<v8::String>* LONG_NUMBER_PERSISTENT = nullptr;
v8::Persistent<v8::String>* PROTOTYPE_PERSISTENT = nullptr;
v8::Persistent<v8::String>* SUPER_PERSISTENT = nullptr;
v8::Persistent<v8::String>* TARGET_PERSISTENT = nullptr;
v8::Persistent<v8::String>* TO_STRING_PERSISTENT = nullptr;
v8::Persistent<v8::String>* JAVA_LONG_PERSISTENT = nullptr;
v8::Persistent<v8::String>* VALUE_OF_PERSISTENT = nullptr;
v8::Persistent<v8::String>* VALUE_PERSISTENT = nullptr;
v8::Persistent<v8::String>* UNCAUGHT_ERROR_PERSISTENT = nullptr;
v8::Persistent<v8::String>* DISCARDED_ERROR_PERSISTENT = nullptr;
v8::Persistent<v8::String>* IMPLEMENTATION_OBJECT_PERSISTENT = nullptr;
};

private:
Expand Down