bellard / quickjs

Public repository of the QuickJS Javascript Engine.
https://bellard.org/quickjs
Other
8.55k stars 895 forks source link

Fix SIGSEGV cause by WeakMap mem leak #350

Open kasonyang opened 2 months ago

kasonyang commented 2 months ago

Values in WeakMap may leaks and causes SIGSEGV error.

Reproduction example:

import * as std from 'std';
const weak1 = new WeakMap();
const weak2 = new WeakMap();
function createCyclicKey() {
    const parent = {};
    const child = {parent};
    parent.child = child;
    return child;
}
function testWeakMap() {
    const cyclicKey = createCyclicKey();
    const valueOfCyclicKey = {};
    weak1.set(cyclicKey, valueOfCyclicKey);
    weak2.set(valueOfCyclicKey, 1);
}
testWeakMap();
// Force to free cyclicKey.
std.gc();
// Here will cause sigsegv because [cyclicKey] and [valueOfCyclicKey] in [weak1] was free,
// but weak2's map record was not removed, and it's key refers [valueOfCyclicKey] which is free.
weak2.get({});
console.log("end");