GeezerVison

Copy link

Copy Markdown

Contributor

Eusgor force-pushed the main branch from 0c1bffe to dec48cc Compare June 29, 2026 06:34

RafaelGSS reviewed Jun 29, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

mcollina approved these changes Jun 29, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pimterry requested changes Jul 1, 2026

View reviewed changes

  if (session_->is_receiving()) {
    if (is_stream_cancel(code) || available_outbound_length_ > 0) {
      session_->AddPendingRstStream(id_);
      return;
    }
    FlushRstStream();
    return;
  }

Eusgor force-pushed the main branch from 0de9ea2 to 22aa3b6 Compare July 13, 2026 09:00

@@            Coverage Diff             @@
##             main   #64166      +/-   ##
==========================================
- Coverage   92.01%   90.24%   -1.77%     
==========================================
  Files         379      739     +360     
  Lines      166972   241720   +74748     
  Branches    25554    45561   +20007     
==========================================
+ Hits       153639   218150   +64511     
- Misses      13041    15112    +2071     
- Partials      292     8458    +8166     

Eusgor force-pushed the main branch 2 times, most recently from 62ef872 to d1de20f Compare July 13, 2026 14:34

Eusgor requested a review from pimterry July 13, 2026 16:47

mcollina approved these changes Jul 13, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pimterry approved these changes Jul 14, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Eusgor force-pushed the main branch from d1de20f to 5579c49 Compare July 15, 2026 04:04

pimterry approved these changes Jul 15, 2026

View reviewed changes

Mark the session as receiving around nghttp2_session_mem_recv() and
defer RST_STREAM handling while receive is in progress. This prevents
closing a stream while nghttp2 still processes it and avoids
heap-use-after-free in nghttp2_session_mem_recv2().

Fixes: #64113
Signed-off-by: Evgeniy Gorbanev <[email protected]>
PR-URL: #64166
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

Mark the session as receiving around nghttp2_session_mem_recv() and
defer RST_STREAM handling while receive is in progress. This prevents
closing a stream while nghttp2 still processes it and avoids
heap-use-after-free in nghttp2_session_mem_recv2().

Fixes: nodejs#64113
Signed-off-by: Evgeniy Gorbanev <[email protected]>
PR-URL: nodejs#64166
Backport-PR-URL: nodejs#65264
Reviewed-By: Antoine du Hamel <[email protected]>

Mark the session as receiving around nghttp2_session_mem_recv() and
defer RST_STREAM handling while receive is in progress. This prevents
closing a stream while nghttp2 still processes it and avoids
heap-use-after-free in nghttp2_session_mem_recv2().

Fixes: #64113
Signed-off-by: Evgeniy Gorbanev <[email protected]>
PR-URL: #64166
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Signed-off-by: Juan José Arboleda <[email protected]>

Mark the session as receiving around nghttp2_session_mem_recv() and
defer RST_STREAM handling while receive is in progress. This prevents
closing a stream while nghttp2 still processes it and avoids
heap-use-after-free in nghttp2_session_mem_recv2().

Fixes: #64113
Signed-off-by: Evgeniy Gorbanev <[email protected]>
PR-URL: #64166
Backport-PR-URL: #65264
Reviewed-By: Antoine du Hamel <[email protected]>

Mark the session as receiving around nghttp2_session_mem_recv() and
defer RST_STREAM handling while receive is in progress. This prevents
closing a stream while nghttp2 still processes it and avoids
heap-use-after-free in nghttp2_session_mem_recv2().

Fixes: #64113
Signed-off-by: Evgeniy Gorbanev <[email protected]>
PR-URL: #64166
Backport-PR-URL: #65264
Reviewed-By: Antoine du Hamel <[email protected]>

Mark the session as receiving around nghttp2_session_mem_recv() and
defer RST_STREAM handling while receive is in progress. This prevents
closing a stream while nghttp2 still processes it and avoids
heap-use-after-free in nghttp2_session_mem_recv2().

Fixes: #64113
Signed-off-by: Evgeniy Gorbanev <[email protected]>
PR-URL: #64166
Backport-PR-URL: #65264
Reviewed-By: Antoine du Hamel <[email protected]>

When session.destroy() runs from a 'stream' handler, MakeCallback drains
nextTick while nghttp2 is still inside mem_recv. Close is deferred for
that window (see nodejs#64166), so later HEADERS in the same buffer created
C++ streams without a JS wrapper or onread, and DATA delivery aborted
with Assertion failed: onread->IsFunction().

- Reject new streams while the session is closing
- Destroy the C++ handle if on_headers runs after JS destroy
- Drop DATA when onread is not installed (defensive)

Fixes: nodejs#64850
Signed-off-by: Sankalp Thakur <[email protected]>

Node.js 24 does not include the later stream lifecycle changes that the
original fix relies on. Preserve its reset ordering, avoid JavaScript
callbacks after a deferred session close, and let destroyed streams
finish without requesting trailers.

Signed-off-by: Matteo Collina <[email protected]>
Refs: nodejs#64166

Node.js 24 does not include the later stream lifecycle changes that the
original fix relies on. Preserve its reset ordering, avoid JavaScript
callbacks after a deferred session close, and let destroyed streams
finish without requesting trailers.

Signed-off-by: Matteo Collina <[email protected]>
Refs: nodejs#64166

Node.js 24 does not include the later stream lifecycle changes that the
original fix relies on. Preserve its reset ordering, avoid JavaScript
callbacks after a deferred session close, and let destroyed streams
finish without requesting trailers.

Signed-off-by: Matteo Collina <[email protected]>
Refs: #64166
PR-URL: #65093
Reviewed-By: Antoine du Hamel <[email protected]>

Node.js 24 does not include the later stream lifecycle changes that the
original fix relies on. Preserve its reset ordering, avoid JavaScript
callbacks after a deferred session close, and let destroyed streams
finish without requesting trailers.

Signed-off-by: Matteo Collina <[email protected]>
Refs: #64166
PR-URL: #65093
Reviewed-By: Antoine du Hamel <[email protected]>

When session.destroy() runs from a 'stream' handler, MakeCallback drains
nextTick while nghttp2 is still inside mem_recv. Close is deferred for
that window (see #64166), so later HEADERS in the same buffer created
C++ streams without a JS wrapper or onread, and DATA delivery aborted
with Assertion failed: onread->IsFunction().

- Reject new streams while the session is closing
- Destroy the C++ handle if on_headers runs after JS destroy
- Drop DATA when onread is not installed (defensive)

Fixes: #64850
Signed-off-by: Sankalp Thakur <[email protected]>
PR-URL: #65116
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

When session.destroy() runs from a 'stream' handler, MakeCallback drains
nextTick while nghttp2 is still inside mem_recv. Close is deferred for
that window (see #64166), so later HEADERS in the same buffer created
C++ streams without a JS wrapper or onread, and DATA delivery aborted
with Assertion failed: onread->IsFunction().

- Reject new streams while the session is closing
- Destroy the C++ handle if on_headers runs after JS destroy
- Drop DATA when onread is not installed (defensive)

Fixes: #64850
Signed-off-by: Sankalp Thakur <[email protected]>
PR-URL: #65116
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

When session.destroy() runs from a 'stream' handler, MakeCallback drains
nextTick while nghttp2 is still inside mem_recv. Close is deferred for
that window (see #64166), so later HEADERS in the same buffer created
C++ streams without a JS wrapper or onread, and DATA delivery aborted
with Assertion failed: onread->IsFunction().

- Reject new streams while the session is closing
- Destroy the C++ handle if on_headers runs after JS destroy
- Drop DATA when onread is not installed (defensive)

Fixes: #64850
Signed-off-by: Sankalp Thakur <[email protected]>
PR-URL: #65116
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

When session.destroy() runs from a 'stream' handler, MakeCallback drains
nextTick while nghttp2 is still inside mem_recv. Close is deferred for
that window (see #64166), so later HEADERS in the same buffer created
C++ streams without a JS wrapper or onread, and DATA delivery aborted
with Assertion failed: onread->IsFunction().

- Reject new streams while the session is closing
- Destroy the C++ handle if on_headers runs after JS destroy
- Drop DATA when onread is not installed (defensive)

Fixes: #64850
Signed-off-by: Sankalp Thakur <[email protected]>
PR-URL: #65116
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

When session.destroy() runs from a 'stream' handler, MakeCallback drains
nextTick while nghttp2 is still inside mem_recv. Close is deferred for
that window (see nodejs#64166), so later HEADERS in the same buffer created
C++ streams without a JS wrapper or onread, and DATA delivery aborted
with Assertion failed: onread->IsFunction().

- Reject new streams while the session is closing
- Destroy the C++ handle if on_headers runs after JS destroy
- Drop DATA when onread is not installed (defensive)

Fixes: nodejs#64850
Assisted-by: pi
Signed-off-by: Sankalp Thakur <[email protected]>
PR-URL: nodejs#65116
Backport-PR-URL: nodejs#66515
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tim Perry <[email protected]>