Skip to content

Retain job realms and trace module lifetimes - #1751

Open
undy-aeon wants to merge 2 commits into
quickjs-ng:masterfrom
tzfm:fix-job-module-lifetimes
Open

undy-aeon wants to merge 2 commits into
quickjs-ng:masterfrom
tzfm:fix-job-module-lifetimes

Conversation

@undy-aeon

Copy link
Copy Markdown

Queued jobs keep their arguments alive, but currently do not retain their realm. If the last external context reference is released while a job is pending, executing that job can access a freed context. Top-level-await state can likewise keep a module reachable after its context's loaded-module list is destroyed, causing a use-after-free during runtime teardown.

This ports and adapts bellard/quickjs@458c34d:

  • retain a job's realm until execution or runtime teardown
  • make module definitions GC-traced objects so asynchronous module state can outlive its context safely
  • add regressions for a queued job after external context release and for repeated dynamic imports through a pending top-level-await dependency

This is the focused lifetime item still listed in #1166.

Validation:

  • ASan and warnings-as-errors build and API tests
  • ASan GC-stress API tests
  • UBSan and warnings-as-errors build and API tests
  • make ctest cxxtest with both NaN-boxing modes
  • test262 configuration: 0/117 errors, 9 excluded

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant