src: fix ObjectWrap destruction #475

addaleax · 2019-04-29T00:43:11Z

src: call `napi_remove_wrap()` in `ObjectWrap` dtor

Currently, when the ObjectWrap constructor runs, it calls
napi_wrap(), adding a finalize callback to the freshly created
JS object.

However, if the ObjectWrap instance is prematurely deleted,
for example because a subclass constructor throws – which seems
like a reasonable scenario – that finalize callback was not removed,
possibly leading to a use-after-free crash.

This commit adds a call napi_remove_wrap() from the ObjectWrap
destructor, and a test for that scenario.

Fixes: node-ffi-napi/weak-napi#16

(As you can see, there is a fixup commit attached. I’m not strictly sure
whether it’s necessary, but just from looking at the code, it seems that
calling napi_get_reference_value() from the finalize callback is invalid;
that seems like a bug in itself, but one that needs to be addressed in
nodejs/node.) See nodejs/node#27470

src: make ObjectWrap dtor virtual

Otherwise, subclasses of ObjectWrap would not be deleted
correctly by the delete instance; line in FinalizeCallback().

(This is also just the right thing to do for classes from which
subclasses are supposed to be created.)

digitalinfinity · 2019-04-29T08:10:01Z

napi-inl.h

+inline ObjectWrap<T>::~ObjectWrap() {
+  if (!IsEmpty()) {
+    Object object = Value();
+    if (!object.IsEmpty())


This code could probably benefit from a comment

@digitalinfinity Yup, added a comment!

- Removed NodeJS v10.x.x support Waiting for nodejs/node-addon-api#475 to implement the provided solution and to bump a new version of the module `node-addon-api`

addaleax · 2019-05-03T16:17:17Z

Looks like this may cause issues in Node.js versions that don’t have nodejs/node#24494 … I’ll try and see if there’s some way to detect/work around that.

mhdawson

LGTM assuming we get it passing on all LTS versions.

mhdawson · 2019-05-17T20:35:08Z

Added do not land label so that we don't land until @addaleax figures out the issues mentioned.

Veetaha · 2019-08-28T21:13:53Z

Hey guys, funny enough I encountered the issue anticipated right here. When I throw Napi::Error in ObjectWrap<Subclass> I experience double free (when the next instance is created right at the same address where the previous one was, but threw an error), munmup() errors and segmentation fault.
When will this be fixed? What workarounds do you propose?
I also noticed that even when ObjectWrap<Sublcass> construction finishes successfully it is not guaranteed that the destructor of a created instance will be called before the end of the program.
Any comments on this behavior?

Veetaha · 2019-08-28T21:27:07Z

napi-inl.h

  NAPI_THROW_IF_FAILED_VOID(env, status);

-  Reference<Object>* instanceRef = instance;
+  Reference<Object>* instanceRef = this;
  *instanceRef = Reference<Object>(env, ref);


These two statements though work, as intended but seem to be a little bit misleading. Having a fast peek over the code you could think that we re-move-assign the whole *this object.
I suggest making an explicit call to parent move-assignment operator, namely:

Reference::operator=({env, ref});

It is more laconic and clear from my point of view.

Veetaha · 2019-08-28T21:35:52Z

napi-inl.h

@@ -3329,7 +3337,7 @@ inline napi_value ObjectWrap<T>::InstanceSetterCallbackWrapper(

 template <typename T>
 inline void ObjectWrap<T>::FinalizeCallback(napi_env /*env*/, void* data, void* /*hint*/) {
-  T* instance = reinterpret_cast<T*>(data);
+  ObjectWrap<T>* instance = static_cast<ObjectWrap<T>*>(data);


I propose using the auto keyword here in order to decrease verbosity. Or you could simply rename argument data to instance and do it in one statement:

inline void ObjectWrap<T>::FinalizeCallback(napi_env /*env*/, void * instance, void * /*hint*/) { delete static_cast<ObjectWrap<T>*>(instance); }

Any of two options are alright from my viewpoint, though it may just be a matter of style.

davedoesdev · 2019-10-10T06:27:20Z

Also seeing this issue (double call to FinalizeCallback due to exception in subclass constructor), and this PR fixed the SEGV.

Code from nodejs/node-addon-api#475

Fix crashes when the ctor of an ObjectWrap subclass throws. See nodejs#475

See nodejs/node-addon-api#475

gabrielschulhof · 2020-01-10T00:11:52Z

We addressed the portion whereby an exception in the ObjectWrap<T> constructor throws an error in #600.

gabrielschulhof · 2020-01-10T00:19:21Z

@addaleax since we dropped support for v8.x, I believe this PR can go ahead. It may actually be a more generic solution than #600.

addaleax · 2020-01-10T05:50:05Z

@gabrielschulhof I’ll look into rebasing this 👍

addaleax · 2020-01-14T22:53:12Z

@gabrielschulhof I’ve rebased this, but I don’t quite understand #600 and the added complexity there – the destructor should undo what the constructor did in case that there’s an exception, and I don’t really see why that’s enough.

This also doesn’t pass tests yet.

gabrielschulhof · 2020-01-15T00:48:44Z

@addaleax I think you're right.

gabrielschulhof · 2020-01-15T00:49:15Z

Sorry, wrong button 😳

gabrielschulhof · 2020-01-15T01:18:35Z

@addaleax

diff --git a/napi-inl.h b/napi-inl.h
index fde0a66..2855e80 100644
--- a/napi-inl.h
+++ b/napi-inl.h
@@ -2702,37 +2702,6 @@ inline Object FunctionReference::New(const std::vector<napi_value>& args) const
 // CallbackInfo class
 ////////////////////////////////////////////////////////////////////////////////
 
-class ObjectWrapConstructionContext {
- public:
-  ObjectWrapConstructionContext(CallbackInfo* info) {
-    info->_objectWrapConstructionContext = this;
-  }
-
-  static inline void SetObjectWrapped(const CallbackInfo& info) {
-    if (info._objectWrapConstructionContext == nullptr) {
-      Napi::Error::Fatal("ObjectWrapConstructionContext::SetObjectWrapped",
-                         "_objectWrapConstructionContext is NULL");
-    }
-    info._objectWrapConstructionContext->_objectWrapped = true;
-  }
-
-  inline void Cleanup(const CallbackInfo& info) {
-    if (_objectWrapped) {
-      napi_status status = napi_remove_wrap(info.Env(), info.This(), nullptr);
-
-      // There's already a pending exception if we are at this point, so we have
-      // no choice but to fatally fail here.
-      NAPI_FATAL_IF_FAILED(status,
-                           "ObjectWrapConstructionContext::Cleanup",
-                           "Failed to remove wrap from unsuccessfully "
-                           "constructed ObjectWrap instance");
-    }
-  }
-
- private:
-  bool _objectWrapped = false;
-};
-
 inline CallbackInfo::CallbackInfo(napi_env env, napi_callback_info info)
     : _env(env), _info(info), _this(nullptr), _dynamicArgs(nullptr), _data(nullptr) {
   _argc = _staticArgCount;
@@ -3140,7 +3109,6 @@ inline ObjectWrap<T>::ObjectWrap(const Napi::CallbackInfo& callbackInfo) {
   status = napi_wrap(env, wrapper, this, FinalizeCallback, nullptr, &ref);
   NAPI_THROW_IF_FAILED_VOID(env, status);
 
-  ObjectWrapConstructionContext::SetObjectWrapped(callbackInfo);
   Reference<Object>* instanceRef = this;
   *instanceRef = Reference<Object>(env, ref);
 }
@@ -3726,23 +3694,15 @@ inline napi_value ObjectWrap<T>::ConstructorCallbackWrapper(
 
   napi_value wrapper = details::WrapCallback([&] {
     CallbackInfo callbackInfo(env, info);
-    ObjectWrapConstructionContext constructionContext(&callbackInfo);
 #ifdef NAPI_CPP_EXCEPTIONS
-    try {
-      new T(callbackInfo);
-    } catch (const Error& e) {
-      // Re-throw the error after removing the failed wrap.
-      constructionContext.Cleanup(callbackInfo);
-      throw e;
-    }
+    new T(callbackInfo);
 #else
     T* instance = new T(callbackInfo);
     if (callbackInfo.Env().IsExceptionPending()) {
       // We need to clear the exception so that removing the wrap might work.
       Error e = callbackInfo.Env().GetAndClearPendingException();
-      constructionContext.Cleanup(callbackInfo);
-      e.ThrowAsJavaScriptException();
       delete instance;
+      e.ThrowAsJavaScriptException();
     }
 # endif  // NAPI_CPP_EXCEPTIONS
     return callbackInfo.This();

this makes the tests pass by basically reverting most of #600, but with one important caveat: The last + in the above diff moves the re-throwing of the exception in the non-C++-exception case to after deleting the instance, otherwise napi_remove_wrap() will encounter a pending exception and fail. Since an exception is already pending, node-addon-api will handle that failure as fatal.

Please feel free to use the diff!

addaleax · 2020-01-16T20:35:16Z

@gabrielschulhof Thanks, done! PTAL

gabrielschulhof

LGTM

gabrielschulhof · 2020-01-16T21:23:45Z

CI:

Version	Job	Status
v14.x	https://ci.nodejs.org/job/node-test-node-addon-api-new/1637/	🛑
v12.x	https://ci.nodejs.org/job/node-test-node-addon-api-new/1638/	🛑
v10.x	https://ci.nodejs.org/job/node-test-node-addon-api-new/1639/	🛑

gabrielschulhof · 2020-01-16T21:32:12Z

@addaleax I think you need to rebase so that #649 might apply and fix the BigInt tests.

Currently, when the `ObjectWrap` constructor runs, it calls `napi_wrap()`, adding a finalize callback to the freshly created JS object. However, if the `ObjectWrap` instance is prematurely deleted, for example because a subclass constructor throws – which seems like a reasonable scenario – that finalize callback was not removed, possibly leading to a use-after-free crash. This commit adds a call `napi_remove_wrap()` from the `ObjectWrap` destructor, and a test for that scenario. This also changes the code to use the correct pointer type in `FinalizeCallback`, which may not match the incorretct one in cases of multiple inheritance. Fixes: node-ffi-napi/weak-napi#16 Co-authored-by: Gabriel Schulhof <gabriel.schulhof@intel.com>

addaleax · 2020-01-16T21:37:31Z

@gabrielschulhof Thanks, done!

gabrielschulhof · 2020-01-16T21:41:06Z

CI:

Version	Job	Status
v14.x	https://ci.nodejs.org/job/node-test-node-addon-api-new/1640/	✓
v12.x	https://ci.nodejs.org/job/node-test-node-addon-api-new/1641/	✓
v10.x	https://ci.nodejs.org/job/node-test-node-addon-api-new/1642/	✓

Currently, when the `ObjectWrap` constructor runs, it calls `napi_wrap()`, adding a finalize callback to the freshly created JS object. However, if the `ObjectWrap` instance is prematurely deleted, for example because a subclass constructor throws – which seems like a reasonable scenario – that finalize callback was not removed, possibly leading to a use-after-free crash. This commit adds a call `napi_remove_wrap()` from the `ObjectWrap` destructor, and a test for that scenario. This also changes the code to use the correct pointer type in `FinalizeCallback`, which may not match the incorretct one in cases of multiple inheritance. Fixes: node-ffi-napi/weak-napi#16 PR-URL: #475 Reviewed-By: Hitesh Kanwathirtha <digitalinfinity@gmail.com> Reviewed-By: Gabriel Schulhof <gabriel.schulhof@intel.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Co-authored-by: Gabriel Schulhof <gabriel.schulhof@intel.com>

gabrielschulhof · 2020-01-17T18:18:04Z

Landed in 4e88506.

Currently, when the `ObjectWrap` constructor runs, it calls `napi_wrap()`, adding a finalize callback to the freshly created JS object. However, if the `ObjectWrap` instance is prematurely deleted, for example because a subclass constructor throws – which seems like a reasonable scenario – that finalize callback was not removed, possibly leading to a use-after-free crash. This commit adds a call `napi_remove_wrap()` from the `ObjectWrap` destructor, and a test for that scenario. This also changes the code to use the correct pointer type in `FinalizeCallback`, which may not match the incorretct one in cases of multiple inheritance. Fixes: node-ffi-napi/weak-napi#16 PR-URL: nodejs#475 Reviewed-By: Hitesh Kanwathirtha <digitalinfinity@gmail.com> Reviewed-By: Gabriel Schulhof <gabriel.schulhof@intel.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Co-authored-by: Gabriel Schulhof <gabriel.schulhof@intel.com>

Currently, when the `ObjectWrap` constructor runs, it calls `napi_wrap()`, adding a finalize callback to the freshly created JS object. However, if the `ObjectWrap` instance is prematurely deleted, for example because a subclass constructor throws – which seems like a reasonable scenario – that finalize callback was not removed, possibly leading to a use-after-free crash. This commit adds a call `napi_remove_wrap()` from the `ObjectWrap` destructor, and a test for that scenario. This also changes the code to use the correct pointer type in `FinalizeCallback`, which may not match the incorretct one in cases of multiple inheritance. Fixes: node-ffi-napi/weak-napi#16 PR-URL: nodejs/node-addon-api#475 Reviewed-By: Hitesh Kanwathirtha <digitalinfinity@gmail.com> Reviewed-By: Gabriel Schulhof <gabriel.schulhof@intel.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Co-authored-by: Gabriel Schulhof <gabriel.schulhof@intel.com>

addaleax mentioned this pull request Apr 29, 2019

Segfault in node 12 node-ffi-napi/weak-napi#16

Closed

addaleax force-pushed the add-napi_remove_wrap branch from 4c7f8ba to f4bfde2 Compare April 29, 2019 00:52

digitalinfinity approved these changes Apr 29, 2019

View reviewed changes

digitalinfinity reviewed Apr 29, 2019

View reviewed changes

VoltanaDMG added a commit to oss-dmg/weak that referenced this pull request Apr 30, 2019

[<](Fallback) .travis.yml

cb81e71

- Removed NodeJS v10.x.x support Waiting for nodejs/node-addon-api#475 to implement the provided solution and to bump a new version of the module `node-addon-api`

gabrielschulhof approved these changes May 6, 2019

View reviewed changes

mhdawson approved these changes May 9, 2019

View reviewed changes

mhdawson added the do not land label May 17, 2019

splitice mentioned this pull request Jun 5, 2019

Ecosystem Modules that will break in Node 12 nodejs/node#25060

Closed

Veetaha reviewed Aug 28, 2019

View reviewed changes

davedoesdev mentioned this pull request Oct 10, 2019

updated dependencies as of 9.10.19 davedoesdev/shared-memory-disruptor#1

Closed

tniessen approved these changes Oct 10, 2019

View reviewed changes

davedoesdev mentioned this pull request Oct 10, 2019

Tests fail due to double free bug in node-addon-api davedoesdev/shared-memory-disruptor#4

Closed

davedoesdev added a commit to davedoesdev/shared-memory-disruptor that referenced this pull request Oct 12, 2019

Work around ObjectWrap destruction bug

5f75991

Code from nodejs/node-addon-api#475

fprenoveau added a commit to fprenoveau/node-addon-api that referenced this pull request Oct 22, 2019

Merge branch 'add-napi_remove_wrap' of github.com:addaleax/node-api

f73d84a

Fix crashes when the ctor of an ObjectWrap subclass throws. See nodejs#475

fritzm added a commit to fritzm/node-cgal that referenced this pull request Dec 11, 2019

Fix crashes after throw from ctor of Napi::ObjectWrap subclasses

029ad07

See nodejs/node-addon-api#475

fritzm mentioned this pull request Dec 11, 2019

Fix crashes after throw from ctor of Napi::ObjectWrap subclasses fritzm/node-cgal#12

Merged

addaleax mentioned this pull request Jan 14, 2020

objectwrap: gracefully handle constructor exceptions #600

Closed

addaleax force-pushed the add-napi_remove_wrap branch from 0fd142b to c243f71 Compare January 14, 2020 22:52

gabrielschulhof closed this Jan 15, 2020

gabrielschulhof reopened this Jan 15, 2020

addaleax force-pushed the add-napi_remove_wrap branch from c243f71 to 10a2698 Compare January 16, 2020 20:35

gabrielschulhof approved these changes Jan 16, 2020

View reviewed changes

addaleax force-pushed the add-napi_remove_wrap branch from 10a2698 to 257393d Compare January 16, 2020 21:37

gabrielschulhof closed this Jan 17, 2020

addaleax deleted the add-napi_remove_wrap branch April 22, 2020 18:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

src: fix ObjectWrap destruction #475

src: fix ObjectWrap destruction #475

addaleax commented Apr 29, 2019 •

edited

Loading

digitalinfinity Apr 29, 2019

addaleax Apr 29, 2019

addaleax commented May 3, 2019

mhdawson left a comment

mhdawson commented May 17, 2019

Veetaha commented Aug 28, 2019

Veetaha Aug 28, 2019

Veetaha Aug 28, 2019

davedoesdev commented Oct 10, 2019 •

edited

Loading

gabrielschulhof commented Jan 10, 2020

gabrielschulhof commented Jan 10, 2020

addaleax commented Jan 10, 2020

addaleax commented Jan 14, 2020

gabrielschulhof commented Jan 15, 2020

gabrielschulhof commented Jan 15, 2020

gabrielschulhof commented Jan 15, 2020

addaleax commented Jan 16, 2020

gabrielschulhof left a comment

gabrielschulhof commented Jan 16, 2020 •

edited

Loading

gabrielschulhof commented Jan 16, 2020

addaleax commented Jan 16, 2020

gabrielschulhof commented Jan 16, 2020 •

edited

Loading

gabrielschulhof commented Jan 17, 2020

src: fix ObjectWrap destruction #475

src: fix ObjectWrap destruction #475

Conversation

addaleax commented Apr 29, 2019 • edited Loading

src: call napi_remove_wrap() in ObjectWrap dtor

src: make ObjectWrap dtor virtual

digitalinfinity Apr 29, 2019

Choose a reason for hiding this comment

addaleax Apr 29, 2019

Choose a reason for hiding this comment

addaleax commented May 3, 2019

mhdawson left a comment

Choose a reason for hiding this comment

mhdawson commented May 17, 2019

Veetaha commented Aug 28, 2019

Veetaha Aug 28, 2019

Choose a reason for hiding this comment

Veetaha Aug 28, 2019

Choose a reason for hiding this comment

davedoesdev commented Oct 10, 2019 • edited Loading

gabrielschulhof commented Jan 10, 2020

gabrielschulhof commented Jan 10, 2020

addaleax commented Jan 10, 2020

addaleax commented Jan 14, 2020

gabrielschulhof commented Jan 15, 2020

gabrielschulhof commented Jan 15, 2020

gabrielschulhof commented Jan 15, 2020

addaleax commented Jan 16, 2020

gabrielschulhof left a comment

Choose a reason for hiding this comment

gabrielschulhof commented Jan 16, 2020 • edited Loading

gabrielschulhof commented Jan 16, 2020

addaleax commented Jan 16, 2020

gabrielschulhof commented Jan 16, 2020 • edited Loading

gabrielschulhof commented Jan 17, 2020

addaleax commented Apr 29, 2019 •

edited

Loading

src: call `napi_remove_wrap()` in `ObjectWrap` dtor

davedoesdev commented Oct 10, 2019 •

edited

Loading

gabrielschulhof commented Jan 16, 2020 •

edited

Loading

gabrielschulhof commented Jan 16, 2020 •

edited

Loading