René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"`ObjectWrap` cleanup hooks break pre-built addons on Node.js 26.0.0-26.3.1 runtimes","articleBody":"### Version\n\nNode.js headers 26.4.0 or newer\nNode.js runtime 26.0.0 up to and including 26.3.1\n\n### Platform\n\n```text\nNot platform specific, but used:\nLinux 7.0.0-28-generic #28~24.04.1-Ubuntu x86_64 x86_64 x86_64 GNU/Linux\n```\n\n### Subsystem\n\nsrc, addons\n\n### What steps will reproduce the bug?\n\nThe crash depends on header and runtime version. So you will need headers from e.g. Node.js 26.4.0 and two runtimes (e.g. 26.2.0 and 26.4.0)\n\n1. Sample that just uses `ObjectWrap`\naddon.cc:\n```c++\n#include \u003cnode.h>\n#include \u003cnode_object_wrap.h>\n\nusing namespace v8;\n\nclass Thing : public node::ObjectWrap {\n public:\n  static void New(const FunctionCallbackInfo\u003cValue>& args) {\n    (new Thing())->Wrap(args.This());\n  }\n};\n\nvoid Init(Local\u003cObject> exports) {\n  Isolate* isolate = Isolate::GetCurrent();\n  Local\u003cContext> context = isolate->GetCurrentContext();\n  Local\u003cFunctionTemplate> tpl = FunctionTemplate::New(isolate, Thing::New);\n  tpl->InstanceTemplate()->SetInternalFieldCount(1);\n  exports->Set(context,\n               String::NewFromUtf8(isolate, \"Thing\").ToLocalChecked(),\n               tpl->GetFunction(context).ToLocalChecked()).Check();\n}\n\nNODE_MODULE(NODE_GYP_MODULE_NAME, Init)\n``` \n\nindex.js:\n```javascript\nconst { Thing } = require('./addon.node');\n\nlet junk = [];\nfor (let i = 0; i \u003c 300000; i++) {\n  new Thing();                          // wrapped object, immediately unreachable\n  junk.push({ a: i });                  // keep allocation rate high so V8 collects on its own\n  if (junk.length > 1000) junk = [];\n}\nconsole.log('survived');\n``` \n\n2. Compile against 26.4.0 (or newer if you want)\n```sh\ng++ -std=c++20 -fPIC -shared \\\n    -I\u003c/path/to/node-v26.4.0-linux-x64/include/node> \\\n    -DNODE_GYP_MODULE_NAME=addon \\\n    -o addon.node addon.cc\n```\n\n3. Run same binary against two different Node.js versions\n```sh\n# this one will run fine\n\u003cpath/to/node_26.4> index.js\n\n# this one will crash\n\u003cpath/to/node_26.2> index.js\n```\n\n### How often does it reproduce? Is there a required condition?\n\n\nDeterministically with 5/5 runs. \nSee this table for when it crashes:\n| hdr \\ rt |  26.0.0 | 26.3.1 | 26.4.0 | 26.7.0 |\n|----------|---------|--------|--------|--------|\n| 26.0.0   | ok      | ok     | ok     | ok     |\n| 26.3.1   | ok      | ok     | ok     | ok     |\n| 26.4.0   | crash   | crash  | ok     | ok     |\n| 26.7.0   | crash   | crash  | ok     | ok     |\n\nI.e. it crashes with headers >= 26.4.0 when runtime \u003c= 26.3.1.\n\nA explicit trigger of the gc via `global.gc()` will not cause the failure, it has to be an allocation-driven one.\n\n### What is the expected behavior? Why is that the expected behavior?\n\nA pre-built addon that is built against headers of one 26.x release should keep working on another 26.x runtime\n\n### What do you see instead?\n\n```\n  #  node[278507]: void node::RemoveEnvironmentCleanupHook(Isolate *, CleanupHook, void *) at ../src/api/hooks.cc:130\n  #  Assertion failed: (env) != nullptr\n\n----- Native stack trace -----\n\n 1: 0x813228 node::Assert(node::AssertionInfo const&) [node]\n 2: 0x891b90 node::RemoveEnvironmentCleanupHook(v8::Isolate*, void (*)(void*), void*) [node]\n 3: 0x73f036ca4045 node::ObjectWrap::RemoveCleanupHook() [/home/user/reproducer/addon.node]\n 4: 0x73f036ca393a node::ObjectWrap::~ObjectWrap() [/home/user/reproducer/addon.node]\n 5: 0x73f036ca41ec Thing::~Thing() [/home/user/reproducer/addon.node]\n 6: 0x73f036ca420c Thing::~Thing() [/home/user/reproducer/addon.node]\n 7: 0x73f036ca3fdd node::ObjectWrap::WeakCallback(v8::WeakCallbackInfo\u003cnode::ObjectWrap> const&) [/home/user/reproducer/addon.node]\n 8: 0xe18a09  [node]\n 9: 0xeb3f61  [node]\n10: 0xec4582  [node]\n11: 0xec425f  [node]\n12: 0x194cdf7  [node]\n13: 0xeb0372  [node]\n14: 0xea3914  [node]\n15: 0xea373c  [node]\n16: 0xea30cf  [node]\n17: 0xe7f25d  [node]\n18: 0x133d781  [node]\n19: 0x73f02763ea76 \nAborted (core dumped)\n``` \n\n### Additional information\n\nThe causing code change in 26.4.0 is the `RemoveCleanupHook();` line added to destructor in commit 7ac3fe1992e189502c9153adbd34a6e38643e208. The call interacts with the improvement of the `RemoveEnvironmentCleanupHook` function in 1723773d4133fc71215a9cbb7e2b9a2a11fc3688.\n\nWhen the destructor is called due to headers being 26.4.0 or newer, but the runtime being \u003c= 26.3.1, then it can trigger the `CHECK_NOT_NULL(env);` of the `RemoveEnvironmentCleanupHook` function. \n\nRefs: #63642 #63985 ","author":{"url":"https://github.com/dyalevog","@type":"Person","name":"dyalevog"},"datePublished":"2026-08-13T11:45:44Z","url":"https://github.com/nodejs/node/issues/65262"}