Skip to content

Commit

Permalink
ref(profiling) use cleanup instead of destructor (#13661)
Browse files Browse the repository at this point in the history
I think what is happening is that by the time our close handler is
called, the handler had already been deleted, which causes a use after
free error. I also updated the code to check for is_closing which is
what that underlying libuv method actually asserts on.

Fixes #13661
  • Loading branch information
JonasBa authored Sep 16, 2024
1 parent 8d2e189 commit ee0b5b5
Showing 1 changed file with 16 additions and 15 deletions.
31 changes: 16 additions & 15 deletions packages/profiling-node/bindings/cpu_profiler.cc
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ enum class ProfileStatus {

class MeasurementsTicker {
private:
uv_timer_t timer;
uv_timer_t *timer;
uint64_t period_ms;
std::unordered_map<std::string,
const std::function<bool(uint64_t, v8::HeapStatistics &)>>
Expand All @@ -87,9 +87,10 @@ class MeasurementsTicker {
public:
MeasurementsTicker(uv_loop_t *loop)
: period_ms(100), isolate(v8::Isolate::GetCurrent()) {
uv_timer_init(loop, &timer);
uv_handle_set_data(reinterpret_cast<uv_handle_t *>(&timer), this);
uv_unref(reinterpret_cast<uv_handle_t *>(&timer));
timer = new uv_timer_t;
uv_timer_init(loop, timer);
uv_handle_set_data((uv_handle_t *)timer, this);
uv_ref((uv_handle_t *)timer);
}

static void ticker(uv_timer_t *);
Expand All @@ -112,13 +113,13 @@ class MeasurementsTicker {
size_t listener_count();

~MeasurementsTicker() {
uv_timer_stop(&timer);
uv_handle_t *handle = (uv_handle_t *)timer;

auto handle = reinterpret_cast<uv_handle_t *>(&timer);
uv_timer_stop(timer);
uv_unref(handle);

// Calling uv_close on an inactive handle will cause a segfault.
if (uv_is_active(handle)) {
uv_close(handle, nullptr);
if (!uv_is_closing(handle)) {
uv_close(handle, [](uv_handle_t *handle) { delete handle; });
}
}
};
Expand All @@ -143,8 +144,8 @@ void MeasurementsTicker::add_heap_listener(
heap_listeners.emplace(profile_id, cb);

if (listener_count() == 1) {
uv_timer_set_repeat(&timer, period_ms);
uv_timer_start(&timer, ticker, 0, period_ms);
uv_timer_set_repeat(timer, period_ms);
uv_timer_start(timer, ticker, 0, period_ms);
}
}

Expand All @@ -154,7 +155,7 @@ void MeasurementsTicker::remove_heap_listener(
heap_listeners.erase(profile_id);

if (listener_count() == 0) {
uv_timer_stop(&timer);
uv_timer_stop(timer);
}
};

Expand Down Expand Up @@ -223,8 +224,8 @@ void MeasurementsTicker::add_cpu_listener(
cpu_listeners.emplace(profile_id, cb);

if (listener_count() == 1) {
uv_timer_set_repeat(&timer, period_ms);
uv_timer_start(&timer, ticker, 0, period_ms);
uv_timer_set_repeat(timer, period_ms);
uv_timer_start(timer, ticker, 0, period_ms);
}
}

Expand All @@ -233,7 +234,7 @@ void MeasurementsTicker::remove_cpu_listener(
cpu_listeners.erase(profile_id);

if (listener_count() == 0) {
uv_timer_stop(&timer);
uv_timer_stop(timer);
}
};

Expand Down

0 comments on commit ee0b5b5

Please sign in to comment.