Commit dee250f
http2: safer Http2Session destructor
It's hypothetically (and with certain V8 flags) possible for the session
to be garbage collected before all the streams are. In that case, trying
to remove the stream from the session will lead to a segfault due to
attempting to access no longer valid memory. Fix this by unsetting the
session on any streams still around when destroying.
PR-URL: #21194
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ujjwal Sharma <usharma1998@gmail.com>1 parent 688bdfe commit dee250f
1 file changed
Lines changed: 8 additions & 7 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -499,8 +499,8 @@ Http2Session::Http2Session(Environment* env, | |||
| 499 | 499 | Http2Session::~Http2Session() { | |
| 500 | 500 | CHECK_EQ(flags_ & SESSION_STATE_HAS_SCOPE, 0); | |
| 501 | 501 | Debug(this, "freeing nghttp2 session"); | |
| 502 | - for (const auto& iter : streams_) | ||
| 503 | - iter.second->session_ = nullptr; | ||
| 502 | + for (const auto& stream : streams_) | ||
| 503 | + stream.second->session_ = nullptr; | ||
| 504 | 504 | nghttp2_session_del(session_); | |
| 505 | 505 | } | |
| 506 | 506 | ||
@@ -1710,11 +1710,11 @@ Http2Stream::Http2Stream( | |||
| 1710 | 1710 | ||
| 1711 | 1711 | ||
| 1712 | 1712 | Http2Stream::~Http2Stream() { | |
| 1713 | + if (session_ == nullptr) | ||
| 1714 | + return; | ||
| 1713 | 1715 | Debug(this, "tearing down stream"); | |
| 1714 | - if (session_ != nullptr) { | ||
| 1715 | - session_->RemoveStream(this); | ||
| 1716 | - session_ = nullptr; | ||
| 1717 | - } | ||
| 1716 | + session_->RemoveStream(this); | ||
| 1717 | + session_ = nullptr; | ||
| 1718 | 1718 | } | |
| 1719 | 1719 | ||
| 1720 | 1720 | std::string Http2Stream::diagnostic_name() const { | |
@@ -1789,7 +1789,8 @@ void Http2Stream::Destroy() { | |||
| 1789 | 1789 | // We can destroy the stream now if there are no writes for it | |
| 1790 | 1790 | // already on the socket. Otherwise, we'll wait for the garbage collector | |
| 1791 | 1791 | // to take care of cleaning up. | |
| 1792 | - if (!stream->session()->HasWritesOnSocketForStream(stream)) | ||
| 1792 | + if (stream->session() == nullptr || | ||
| 1793 | + !stream->session()->HasWritesOnSocketForStream(stream)) | ||
| 1793 | 1794 | delete stream; | |
| 1794 | 1795 | }, this, this->object()); | |
| 1795 | 1796 | ||
0 commit comments