Author

Joe Lee <jlee@cloudflare.com> 2025-04-24 15:26:00 -0500

Parents

2483e0b

Tree

87d1e29

SharedMemoryCache: Capture reference to cache in fallback lambda

It looks like Use::getWithFallback() can return a promise that captures an
InProgress reference, and may exercise that reference on destruction.  However,
it looks like the actual ownership of the InProgress object is inside the
SharedCache object, which is kept alive by the Use reference inside
MemoryCache.

Since there doesn't seem to be an explicit reference between the promise and
the SharedCache object, they can presumably be garbage collected in any order.
If the MemoryCache is destroyed while there are still unresolved fallbacks,
it's possible that fallback promises could be destroyed later, and attempt to
run their destruction logic against the memory of freed InProgress objects.

This commit adds a reference to the MemoryCache object to a promise lambda,
which may help ensure that the promises are not destroyed before the InProgress
objects they may be depending on.

Possibly addresses a use-after-free.