mirror of
https://github.com/nodejs/node.git
synced 2026-11-09 15:11:11 -05:00
`NewIsolate()` creates every isolate from the snapshot blob the first isolate in the process used, because V8 shares the read-only heap between isolates, and did so by keeping a pointer to the first `CreateParams`. When that blob came from an `EmbedderSnapshotData` the embedder had since released, e.g. a second `CommonEnvironmentSetup::CreateFromSnapshot()` after the first setup and its snapshot were destroyed, V8 deserialized freed memory. Record the first blob and external references under a mutex instead of copying the caller's `CreateParams`, and make `~SnapshotData()` leave that one blob allocated, since its owner can go away before the last isolate is created. Nothing is copied and `node` itself is unaffected. embedtest grows an `--embedder-run-twice` switch so the sequence can be tested. Refs: https://github.com/nodejs/node/pull/45885 Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com> PR-URL: https://github.com/nodejs/node/pull/65779 Refs: https://github.com/nodejs/node/pull/32984 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>