Author

Dan Lapid <dan.lapid@gmail.com> 2026-02-11 00:19:12 +0000

Parents

4948a20

Tree

d7ea4c1

Fix crash when destroying Wrappables after isolate shutdown

When objects like WebSockets are stored in a HibernationManager, they
can outlive their V8 isolate. Previously, when such objects were later
destroyed, maybeDeferDestruction() would call v8::Locker::IsLocked()
on a dangling isolate pointer, causing a segfault:

  v8::Locker::IsLocked(isolate)  // isolate is dangling!

The root cause is that detachWrapper() clears the wrapper-related state
(wrapper, cppgcShim, strongWrapper) but leaves the isolate pointer
intact. This is correct for normal GC where wrappers may be recreated,
but during isolate shutdown the pointer becomes dangling.

The fix clears the isolate pointer in clearWrappers() after detaching
each wrapper. This ensures that any code that later tries to use the
isolate (maybeDeferDestruction, removeStrongRef, GcVisitor) will see
isolate == nullptr and correctly skip V8 operations.

We clear the pointer in clearWrappers() rather than in detachWrapper()
because detachWrapper() is also called during normal GC (when the
isolate is still alive), and we need to preserve the isolate pointer
in that case for potential wrapper recreation.