René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"24.19.0: `node::ObjectWrap` cleanup hooks backported without the cleanup hook registry, aborts on every 24.x runtime","articleBody":"### Version\n\nv24.19.0 (also affects `v24.x-staging`)\n\n### Platform\n\n```text\nReproduced on: Darwin 25.5.0 arm64 (official darwin-arm64 tarballs)\nOriginally hit on: Linux x86_64, Debian 13 container\n```\n\n### Subsystem\n\nsrc, addons\n\n### What steps will reproduce the bug?\n\nThis is the 24.x counterpart of #65262, but with an important difference: on the 24.x line\nthe crash does **not** need a header/runtime version mismatch. Headers and runtime both at\n24.19.0 abort deterministically.\n\n`addon.cc` (same minimal reproducer as #65262):\n\n```c++\n#include \u003cnode.h>\n#include \u003cnode_object_wrap.h>\n\nusing namespace v8;\n\nclass Thing : public node::ObjectWrap {\n public:\n  static void New(const FunctionCallbackInfo\u003cValue>& args) {\n    (new Thing())->Wrap(args.This());\n  }\n};\n\nvoid Init(Local\u003cObject> exports) {\n  Isolate* isolate = Isolate::GetCurrent();\n  Local\u003cContext> context = isolate->GetCurrentContext();\n  Local\u003cFunctionTemplate> tpl = FunctionTemplate::New(isolate, Thing::New);\n  tpl->InstanceTemplate()->SetInternalFieldCount(1);\n  exports->Set(context,\n               String::NewFromUtf8(isolate, \"Thing\").ToLocalChecked(),\n               tpl->GetFunction(context).ToLocalChecked()).Check();\n}\n\nNODE_MODULE(NODE_GYP_MODULE_NAME, Init)\n```\n\n`index.js`:\n\n```javascript\nconst { Thing } = require(process.argv[2]);\n\nlet junk = [];\nfor (let i = 0; i \u003c 300000; i++) {\n  new Thing();                          // wrapped object, immediately unreachable\n  junk.push({ a: i });                  // keep allocation rate high so V8 collects on its own\n  if (junk.length > 1000) junk = [];\n}\nconsole.log('survived');\n```\n\nBuild against each header set and run each binary on each runtime:\n\n```sh\nfor V in 24.18.1 24.19.0; do\n  curl -sfLO \"https://nodejs.org/dist/v$V/node-v$V-darwin-arm64.tar.gz\"\n  tar -xzf \"node-v$V-darwin-arm64.tar.gz\"\n  clang++ -std=c++20 -fPIC -shared -Wl,-undefined,dynamic_lookup \\\n    -I\"node-v$V-darwin-arm64/include/node\" \\\n    -DNODE_GYP_MODULE_NAME=addon -o \"addon-hdr-$V.node\" addon.cc\ndone\n\nfor HV in 24.18.1 24.19.0; do\n  for RV in 24.18.1 24.19.0; do\n    ./node-v$RV-darwin-arm64/bin/node index.js \"./addon-hdr-$HV.node\"\n    echo \"hdr $HV / rt $RV -> rc=$?\"\n  done\ndone\n```\n\n### How often does it reproduce? Is there a required condition?\n\nDeterministic, 5/5 runs for both crashing combinations.\n\n| hdr \\ rt | 24.18.1 | 24.19.0 |\n|----------|---------|---------|\n| 24.18.1  | ok      | ok      |\n| 24.19.0  | crash   | crash   |\n\nCompare with the 26.x matrix in #65262, where headers 26.4.0 on runtime 26.4.0 is fine.\nAs in that issue, an explicit `global.gc()` does not trigger it; the collection has to be\nallocation driven.\n\n### What is the expected behavior? Why is that the expected behavior?\n\nAn addon that uses `node::ObjectWrap` and is built against 24.19.0 headers should keep\nworking on a 24.19.0 runtime. Today there is no 24.x runtime it works on.\n\n### What do you see instead?\n\n```\n#  node[52504]: void node::RemoveEnvironmentCleanupHook(Isolate *, CleanupHook, void *) at ../src/api/hooks.cc:142\n#  Assertion failed: (env) != nullptr\n\n1: node::Assert(node::AssertionInfo const&) [node]\n2: node::RemoveEnvironmentCleanupHook(v8::Isolate*, void (*)(void*), void*) (.cold.1) [node]\n4: node::ObjectWrap::RemoveCleanupHook() [addon-hdr-24.19.0.node]\n5: node::ObjectWrap::~ObjectWrap() [addon-hdr-24.19.0.node]\n```\n\n### Additional information\n\nThe cause looks like a partial backport. 24.19.0 picked up `src: add cleanup hooks to\nnode::ObjectWrap` (#63642), which adds `AddCleanupHook()` to the constructor and\n`RemoveCleanupHook()` to the destructor of the header only `node::ObjectWrap` class. It did\n**not** pick up `1723773d4133fc71215a9cbb7e2b9a2a11fc3688` (`src: keep global list of\naddon-provided cleanup hooks`), which is what makes hook removal survive without a live\n`Environment` and which is why the 26.x matrix in #65262 has a working diagonal.\n\n```console\n$ curl -s https://raw.githubusercontent.com/nodejs/node/v24.19.0/src/node_object_wrap.h | grep -c 'RemoveCleanupHook()'\n2\n$ curl -s https://raw.githubusercontent.com/nodejs/node/v24.19.0/src/api/hooks.cc | grep -c CleanupHookThunk\n0\n$ curl -s https://raw.githubusercontent.com/nodejs/node/v26.4.0/src/api/hooks.cc | grep -c CleanupHookThunk\n6\n```\n\n`v24.x-staging` is currently in the same state, and v24.19.0 is the newest v24 tag, so\nevery published 24.x runtime is affected once an addon is compiled with 24.19.0 headers.\n\nBecause `node_object_wrap.h` is header only, this reaches users who never changed a\ndependency: rebuilding a container image after 2026-08-03 is enough, since the new\ndestructor code gets compiled into the addon. It hits NAN style addons in particular,\nbecause they commonly do `using namespace node;` and inherit from `node::ObjectWrap`.\n\nReal world example that led me here: a long running service in a Docker image, no\ndependency version changed, only the Node base image moved 24.18.0 -> 24.19.0. The process\nstarted aborting during periodic SFTP transfers, when the garbage collector reclaimed one\nof `ssh2`'s native cipher objects:\n\n```\n#  node[7]: void node::RemoveEnvironmentCleanupHook(v8::Isolate*, CleanupHook, void*) at ../../src/api/hooks.cc:142\n#  Assertion failed: (env) != nullptr\n\n1: node::Assert(node::AssertionInfo const&) [node]\n2: node::RemoveEnvironmentCleanupHook(v8::Isolate*, void (*)(void*), void*) [node]\n3: AESGCMDecipher::~AESGCMDecipher() [\u003capp>/node_modules/ssh2/lib/protocol/crypto/build/Release/sshcrypto.node]\n```\n\nDownstream reports of the same assertion with other NAN style addons (`better-sqlite3`,\n`node-pty`) after the same base image move: nexu-io/open-design#6462.\n\nPossible ways out, in order of preference from a user point of view:\n\n1. Backport `1723773d` to `v24.x-staging` so `RemoveEnvironmentCleanupHook` no longer needs\n   a live `Environment`.\n2. Or revert #63642 on the 24.x line until 1 is done.\n\nRefs: #63642 #65262 #65195\n","author":{"url":"https://github.com/roy-trgscreen","@type":"Person","name":"roy-trgscreen"},"datePublished":"2026-08-20T21:26:03Z","url":"https://github.com/nodejs/node/issues/65446"}