-
Notifications
You must be signed in to change notification settings - Fork 29.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
test: fix flaky async-hooks/test-zlib.zlib-binding.deflate #21077
Conversation
CI: https://ci.nodejs.org/job/node-test-commit/18918/ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
😅 I love that this is the fix.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hah, unbelievable. What a debug story this was.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Might want to fast-track this? Feel free to 👍 this comment if you think so |
For posterity, do you mind adding a more detailed explanation to this? Including what you used to debug? |
Previously, the typed arrays used in this test would not automatically be kept alive by the native handle when it’s using them, so the V8 garbage collector could collect them while they are still in use by the zlib module, leading to memory corruption. Fixes: nodejs#20907
b3a173e
to
5897b6c
Compare
@hashseed Thanks for the reminder :) I’ve updated the PR description/commit message a bit, let me know how that sounds to you |
@addaleax I'm super happy with the commit message on my end for sure but if you don't mind explaining how you finally found it / got it to fail with valgrind, I think that would be really great? Just for the closure for all of us who observed... 😄 |
Tbh I don't actually see why this test fails. I can only guess that the zlib binding somehow doesn't keep the backing store of the incoming buffer around, but does the correct thing if the argument is a TypedArray? That sounds like a bug in zlib to me though. |
@hashseed It doesn’t keep the backing store around either way, and relies on the JS side of things to do that (but this test didn’t do that before). It doesn’t really treat I assume the intention for that original behaviour here was not having to track more |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for all the work that went into this!
(We have something similar to this fix in fs.write
, this pattern just looks like a footgun to me...can we do something about this? Refactor how the bindings write stuff?)
@apapirovski I don’t really know either! It just Worked™ once when running it with valgrind and redirecting output to a file, it contained a pretty good indication of this use-after-free behaviour… |
Oh I see. So the issue is that Can we expect users to know about this detail or can we expect actual uses of this API to always use the write result, so we would not run into this issue in the wild? |
This tests internals, our (This test is specifically for the async hooks in relation to the binding hence using it directly.) |
Sole CI failure is a known-flaky being worked on. Re-run: https://ci.nodejs.org/job/node-test-commit-linux-containered/4864/ |
Containered re-run again: https://ci.nodejs.org/job/node-test-commit-linux-containered/4870/ |
Landed in 2efe4c2 |
Previously, the typed arrays used in this test would not automatically be kept alive by the native handle when it’s using them, so the V8 garbage collector could collect them while they are still in use by the zlib module, leading to memory corruption. Fixes: #20907 PR-URL: #21077 Reviewed-By: Anatoli Papirovski <apapirovski@mac.com> Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Yang Guo <yangguo@chromium.org> Reviewed-By: James M Snell <jasnell@gmail.com>
Previously, the typed arrays used in this test would not automatically be kept alive by the native handle when it’s using them, so the V8 garbage collector could collect them while they are still in use by the zlib module, leading to memory corruption. Fixes: #20907 PR-URL: #21077 Reviewed-By: Anatoli Papirovski <apapirovski@mac.com> Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Yang Guo <yangguo@chromium.org> Reviewed-By: James M Snell <jasnell@gmail.com>
Previously, the typed arrays used in this test would not
automatically be kept alive by the native handle when
it’s using them, so the V8 garbage collector could collect
them while they are still in use by the zlib module,
leading to memory corruption.
Fixes: #20907
Fyi @apapirovski @joyeecheung @Trott @Fishrock123 @BridgeAR @mcollina ;)
Checklist
make -j4 test
(UNIX), orvcbuild test
(Windows) passes