Commit 7eb0818
committed
Fix race condition segfault in JSSEngineReferenceImpl cleanup
The finalizer thread was experiencing segfaults during PR.Shutdown()
calls due to a race condition where multiple threads could execute
cleanup operations simultaneously on the same object.
Root cause:
- cleanup(), closeInbound(), closeOutbound(), and tryCleanup()
methods were not synchronized
- Multiple threads could simultaneously check and modify the boolean
flags (closed_fd, is_inbound_closed, is_outbound_closed)
- One thread could close/free ssl_fd while another thread was still
using it in PR.Shutdown(), causing SIGSEGV in NSS memcpy
Changes:
- Add synchronized modifier to closeInbound(), closeOutbound(),
cleanup(), and tryCleanup() methods
- The synchronized keyword provides both mutual exclusion (only one
thread can execute these methods at a time) and memory visibility
(changes to fields are visible to other threads)
This prevents concurrent cleanup operations from corrupting the native
PRFileDesc pointer and eliminates the segfault during finalization.
Assisted-by: Claude Sonnet 4.51 parent c527e37 commit 7eb0818
1 file changed
Lines changed: 4 additions & 4 deletions
Lines changed: 4 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
736 | 736 | | |
737 | 737 | | |
738 | 738 | | |
739 | | - | |
| 739 | + | |
740 | 740 | | |
741 | 741 | | |
742 | 742 | | |
| |||
750 | 750 | | |
751 | 751 | | |
752 | 752 | | |
753 | | - | |
| 753 | + | |
754 | 754 | | |
755 | 755 | | |
756 | 756 | | |
| |||
1675 | 1675 | | |
1676 | 1676 | | |
1677 | 1677 | | |
1678 | | - | |
| 1678 | + | |
1679 | 1679 | | |
1680 | 1680 | | |
1681 | 1681 | | |
| |||
1688 | 1688 | | |
1689 | 1689 | | |
1690 | 1690 | | |
1691 | | - | |
| 1691 | + | |
1692 | 1692 | | |
1693 | 1693 | | |
1694 | 1694 | | |
| |||
0 commit comments