http2: fix onread assert when destroying session from stream handler - #65116
Closed
sankalpsthakur wants to merge 3 commits into
Closed
sankalpsthakur wants to merge 3 commits into
sankalpsthakur wants to merge 3 commits into
Conversation
Collaborator
|
Review requested:
|
Collaborator
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #65116 +/- ##
==========================================
- Coverage 89.99% 89.98% -0.02%
==========================================
Files 757 757
Lines 257739 257750 +11
Branches 48881 48879 -2
==========================================
- Hits 231961 231943 -18
- Misses 16861 16899 +38
+ Partials 8917 8908 -9
🚀 New features to boost your workflow:
|
pimterry
requested changes
Aug 31, 2026
pimterry
left a comment
Member
There was a problem hiding this comment.
Thanks @sankalpsthakur!
Mostly looks good. The 3 fixes seem to all separately solve the same issue redundantly, is that right? I think for the first two that's OK and they're independently valuable (with minor tweaks) but we should drop the 3rd chunk to avoid missing major issues in future.
There's also a failing lint here, you can fix this locally with make format-cpp.
Member
|
@pimterry ptal |
sankalpsthakur
force-pushed
the
fix/64850-http2-onread-assert
branch
from
September 2, 2026 17:23
ae6f128 to
9cd30dd
Compare
When session.destroy() runs from a 'stream' handler, MakeCallback drains nextTick while nghttp2 is still inside mem_recv. Close is deferred for that window (see nodejs#64166), so later HEADERS in the same buffer created C++ streams without a JS wrapper or onread, and DATA delivery aborted with Assertion failed: onread->IsFunction(). - Reject new streams while the session is closing - Destroy the C++ handle if on_headers runs after JS destroy - Drop DATA when onread is not installed (defensive) Fixes: nodejs#64850 Signed-off-by: Sankalp Thakur <[email protected]>
sankalpsthakur
force-pushed
the
fix/64850-http2-onread-assert
branch
from
September 2, 2026 17:27
9cd30dd to
eaa9b7a
Compare
pimterry
approved these changes
Sep 2, 2026
pimterry
left a comment
Member
There was a problem hiding this comment.
LGTM, thanks for working through those fixes @sankalpsthakur!
Collaborator
Collaborator
Contributor
Author
|
The child checks are green, but Jenkins #76961 still reports failure. The console requires authentication. Could someone share the failing stage or test? |
mcollina
pushed a commit
that referenced
this pull request
Sep 14, 2026
When session.destroy() runs from a 'stream' handler, MakeCallback drains nextTick while nghttp2 is still inside mem_recv. Close is deferred for that window (see #64166), so later HEADERS in the same buffer created C++ streams without a JS wrapper or onread, and DATA delivery aborted with Assertion failed: onread->IsFunction(). - Reject new streams while the session is closing - Destroy the C++ handle if on_headers runs after JS destroy - Drop DATA when onread is not installed (defensive) Fixes: #64850 Signed-off-by: Sankalp Thakur <[email protected]> PR-URL: #65116 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Tim Perry <[email protected]>
Member
|
Landed in 0e32ee2 |
aduh95
pushed a commit
that referenced
this pull request
Sep 16, 2026
When session.destroy() runs from a 'stream' handler, MakeCallback drains nextTick while nghttp2 is still inside mem_recv. Close is deferred for that window (see #64166), so later HEADERS in the same buffer created C++ streams without a JS wrapper or onread, and DATA delivery aborted with Assertion failed: onread->IsFunction(). - Reject new streams while the session is closing - Destroy the C++ handle if on_headers runs after JS destroy - Drop DATA when onread is not installed (defensive) Fixes: #64850 Signed-off-by: Sankalp Thakur <[email protected]> PR-URL: #65116 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Tim Perry <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When
session.destroy()runs from a stream handler, deferred session closure can allow later HEADERS in the same receive buffer to create C++ streams without a JavaScript wrapper. Subsequent DATA delivery can then hit theonread->IsFunction()assertion.This change rejects new streams while the session is closing and destroys a C++ stream handle if its headers reach JavaScript after the session was destroyed.
The regression test is
test/parallel/test-http2-session-destroy-stream-handler.js, which repeatedly destroys a session while handling concurrent POSTs.Fixes #64850.
AI disclosure
AI coding tools, including Grok and Codex, assisted with the code and description.