René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Race condition in the inspector calls WriteRaw() on nullptr","articleBody":"* **Version**: v12.18.3\r\n* **Platform**: Linux 4.19.127 x86_64\r\n* **Subsystem**: inspector\r\n\r\nNOTE: Unable to reproduce this in v14.8.0.\r\n\r\n### What steps will reproduce the bug?\r\n\r\nA race condition causing the process to abort can be triggered by running `test-inspector-wait-for-connection.js` in a loop.\r\n\r\nTo make things easier, first apply this patch:\r\n```diff\r\ndiff --git a/src/inspector_socket.cc b/src/inspector_socket.cc\r\nindex a7019281af..b9d7f85507 100644\r\n--- a/src/inspector_socket.cc\r\n+++ b/src/inspector_socket.cc\r\n@@ -609,6 +609,7 @@ ProtocolHandler::ProtocolHandler(InspectorSocket* inspector,\r\n \r\n int ProtocolHandler::WriteRaw(const std::vector\u003cchar\u003e\u0026 buffer,\r\n                               uv_write_cb write_cb) {\r\n+  CHECK_NOT_NULL(tcp_);\r\n   return tcp_-\u003eWriteRaw(buffer, write_cb);\r\n }\r\n ```\r\n\r\nFortunately this can be reproduced with a debug build. So I use the following to reproduce it:\r\n```sh\r\nfor i in $(seq 1 1000)\r\n  do echo -ne \"$i\\r\"\r\n  ./out/Debug/node test/parallel/test-inspector-wait-for-connection.js \u003e /dev/null\r\n  if [[ $? -ne 0 ]] || [[ -f \"./core\" ]]; then\r\n    break\r\n  fi\r\ndone\r\n```\r\n\r\n### How often does it reproduce? Is there a required condition?\r\n\r\nUsually triggers the abort within running the test every 100 times.\r\n\r\n### Additional information\r\n\r\nThe specific issue is that `ProtocolHandler::WriteRaw()` attempts a write to `tcp_` when `tcp_ == 0x0`.\r\n\r\nAdditional debug information from `lldb`:\r\n```cpp\r\n(lldb) bt\r\n* thread #1, name = 'node', stop reason = signal SIGABRT\r\n    ...\r\n    frame #3: node`node::Assert(info=0x0000000002c5d938) at node_errors.cc:253:3\r\n    frame #4: node`node::inspector::ProtocolHandler::WriteRaw(this=0x00007f9c680011b0, buffer=size=1, write_cb=(node`node::inspector::(anonymous namespace)::WriteRequest::Cleanup(uv_write_s*, int) at inspector_socket.cc:123))(uv_write_s*, int)) at inspector_socket.cc:612:3\r\n    frame #5: node`node::inspector::(anonymous namespace)::WsHandler::Write(this=0x00007f9c680011b0, data=\u003cunavailable\u003e) at inspector_socket.cc:351:5\r\n    frame #6: node`node::inspector::InspectorSocket::Write(this=0x00007f9c68001740, data=\"{\\\"method\\\":\\\"Runtime.executionContextDestroyed\\\",\\\"params\\\":{\\\"executionContextId\\\":1}}\", len=80) at inspector_socket.cc:769:22\r\n    frame #7: node`node::inspector::SocketSession::Send(this=0x00007f9c680015f0, message=\") at inspector_socket_server.cc:495:15\r\n    frame #8: node`node::inspector::InspectorSocketServer::Send(this=0x00007f9c84a7e9f8, session_id=1, message=\") at inspector_socket_server.cc:481:14\r\n    ...\r\n\r\n(lldb) f 4\r\nframe #4: 0x0000000000ff2017 node`node::inspector::ProtocolHandler::WriteRaw(this=0x00007f9c680011b0, buffer=size=1, write_cb=(node`node::inspector::(anonymous namespace)::WriteRequest::Cleanup(uv_write_s*, int) at inspector_socket.cc:123))(uv_write_s*, int)) at inspector_socket.cc:612:3\r\n   609 \r\n   610  int ProtocolHandler::WriteRaw(const std::vector\u003cchar\u003e\u0026 buffer,\r\n   611                                uv_write_cb write_cb) {\r\n-\u003e 612    CHECK_NOT_NULL(tcp_);\r\n   613    return tcp_-\u003eWriteRaw(buffer, write_cb);\r\n   614  }\r\n   615\r\n\r\n(lldb) fr v\r\n(node::inspector::(anonymous namespace)::WsHandler *) this = 0x00007f9c680011b0\r\n(const std::vector\u003cchar, std::allocator\u003cchar\u003e \u003e \u0026) buffer = size=1: {\r\n  std::_Vector_base\u003cchar, std::allocator\u003cchar\u003e \u003e = {\r\n    _M_impl = (_M_start = \"\\x81P{\\\"method\\\":\\\"Runtime.executionContextDestroyed\\\",\\\"params\\\":{\\\"executionContextId\\\":1}}\", _M_finish = \"\", _M_end_of_storage = \"\")\r\n  }\r\n}\r\n(uv_write_cb) write_cb = 0x0000000000ff4790 (node`node::inspector::(anonymous namespace)::WriteRequest::Cleanup(uv_write_s*, int) at inspector_socket.cc:123)\r\n\r\n\r\n(lldb) p tcp_\r\n(node::inspector::TcpHolder::Pointer) $0 = nullptr {\r\n  pointer = 0x0000000000000000\r\n}\r\n```\r\n","author":{"url":"https://github.com/trevnorris","@type":"Person","name":"trevnorris"},"datePublished":"2020-08-18T19:25:39.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/34833/node/issues/34833"}