Author

Logan Gatlin <lgatlin@cloudflare.com> 2026-02-27 16:56:47 +0000

Parents

877d38a

Tree

f10e8e1

Fix use-after-free: clear WASM shutdown signals before V8 isolate disposal

Each WasmShutdownSignal entry holds a shared_ptr<v8::BackingStore> via
kj::Array::attach(). In Worker::Isolate, member destruction order destroys
the V8 isolate (api) before limitEnforcer (which owns the AtomicList).
The BackingStore destructor lives in libv8.so and may access V8 internal
state, so dropping these shared_ptrs after V8 disposal is a use-after-free.

Fix: explicitly clear the AtomicList in ~Isolate() while V8 is still alive.