GeezerVison

Copy link

Copy Markdown

@@            Coverage Diff             @@
##             main   #64644      +/-   ##
==========================================
- Coverage   92.01%   90.14%   -1.87%     
==========================================
  Files         381      741     +360     
  Lines      170167   242137   +71970     
  Branches    26075    45568   +19493     
==========================================
+ Hits       156585   218286   +61701     
- Misses      13291    15368    +2077     
- Partials      291     8483    +8192     

haggholm force-pushed the fix/net-unref-timer-parent-chain branch from 6b91d30 to ae8a326 Compare July 21, 2026 16:44

pimterry reviewed Jul 21, 2026

View reviewed changes

haggholm force-pushed the fix/net-unref-timer-parent-chain branch from ae8a326 to 0fff075 Compare July 21, 2026 21:06

pimterry approved these changes Jul 21, 2026

View reviewed changes

mcollina approved these changes Jul 22, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Ethan-Arrowood approved these changes Jul 23, 2026

View reviewed changes

lpinca approved these changes Jul 24, 2026

View reviewed changes

- Loading data for nodejs/node/pull/64644
✔  Done loading data for nodejs/node/pull/64644
----------------------------------- PR info ------------------------------------
Title      net: handle undefined parent in _unrefTimer and _destroy (#64644)
Author     Petter <[email protected]> (@haggholm, first-time contributor)
Branch     haggholm:fix/net-unref-timer-parent-chain -> nodejs:main
Labels     net, author ready, needs-ci, commit-queue
Commits    1
 - net: handle undefined parent in _unrefTimer and _destroy
Committers 1
 - Petter Häggholm <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/64644
Fixes: https://github.com/nodejs/node/issues/64490
Refs: https://github.com/nodejs/node/pull/64491
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/64644
Fixes: https://github.com/nodejs/node/issues/64490
Refs: https://github.com/nodejs/node/pull/64491
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Tue, 21 Jul 2026 05:41:51 GMT
   ✔  Approvals: 4
   ✔  - Tim Perry (@pimterry): https://github.com/nodejs/node/pull/64644#pullrequestreview-4749162536
   ✔  - Matteo Collina (@mcollina) (TSC): https://github.com/nodejs/node/pull/64644#pullrequestreview-4752502041
   ✔  - Ethan Arrowood (@Ethan-Arrowood): https://github.com/nodejs/node/pull/64644#pullrequestreview-4760962100
   ✔  - Luigi Pinca (@lpinca): https://github.com/nodejs/node/pull/64644#pullrequestreview-4776083636
   ✘  GitHub CI is still running
   ℹ  Last Full PR CI on 2026-08-21T15:39:32Z: https://ci.nodejs.org/job/node-test-pull-request/76161/
- Querying data for job/node-test-pull-request/76161/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
   ⚠  PR author is a new contributor: @haggholm([email protected])
   ⚠  - commit 0fff075b3468 is authored by [email protected]
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu

The fix and approach are from #64491 by Shivay-98; this reopens it to
get it landed, since the original stalled awaiting requested changes.

`Socket.prototype._unrefTimer` and `Socket.prototype._destroy` both walk
the `_parent` chain with a strict `!== null` check. During connection
teardown a socket's `_parent` can be left `undefined` (for example a TLS
socket layered over another stream), so the loop steps onto `undefined`
and reads a property off it, throwing a TypeError:

    Cannot read properties of undefined (reading 'Symbol(timeout)')

from an uncaught I/O callback and crashing the process.

Using a nullish (`!= null`) check terminates the walk on both `null` and
`undefined`.

[[email protected]: apply the same fix to the identical loop in
`_destroy`, which the original regression test already exercised via
`destroy()`; add direct unit coverage for both paths.]

Fixes: #64490
Refs: #64491

Signed-off-by: Petter Häggholm <[email protected]>
PR-URL: #64644
Fixes: #64490
Refs: #64491
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

The fix and approach are from #64491 by Shivay-98; this reopens it to
get it landed, since the original stalled awaiting requested changes.

`Socket.prototype._unrefTimer` and `Socket.prototype._destroy` both walk
the `_parent` chain with a strict `!== null` check. During connection
teardown a socket's `_parent` can be left `undefined` (for example a TLS
socket layered over another stream), so the loop steps onto `undefined`
and reads a property off it, throwing a TypeError:

    Cannot read properties of undefined (reading 'Symbol(timeout)')

from an uncaught I/O callback and crashing the process.

Using a nullish (`!= null`) check terminates the walk on both `null` and
`undefined`.

[[email protected]: apply the same fix to the identical loop in
`_destroy`, which the original regression test already exercised via
`destroy()`; add direct unit coverage for both paths.]

Fixes: #64490
Refs: #64491

Signed-off-by: Petter Häggholm <[email protected]>
PR-URL: #64644
Fixes: #64490
Refs: #64491
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

The fix and approach are from #64491 by Shivay-98; this reopens it to
get it landed, since the original stalled awaiting requested changes.

`Socket.prototype._unrefTimer` and `Socket.prototype._destroy` both walk
the `_parent` chain with a strict `!== null` check. During connection
teardown a socket's `_parent` can be left `undefined` (for example a TLS
socket layered over another stream), so the loop steps onto `undefined`
and reads a property off it, throwing a TypeError:

    Cannot read properties of undefined (reading 'Symbol(timeout)')

from an uncaught I/O callback and crashing the process.

Using a nullish (`!= null`) check terminates the walk on both `null` and
`undefined`.

[[email protected]: apply the same fix to the identical loop in
`_destroy`, which the original regression test already exercised via
`destroy()`; add direct unit coverage for both paths.]

Fixes: #64490
Refs: #64491

Signed-off-by: Petter Häggholm <[email protected]>
PR-URL: #64644
Fixes: #64490
Refs: #64491
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

The fix and approach are from #64491 by Shivay-98; this reopens it to
get it landed, since the original stalled awaiting requested changes.

`Socket.prototype._unrefTimer` and `Socket.prototype._destroy` both walk
the `_parent` chain with a strict `!== null` check. During connection
teardown a socket's `_parent` can be left `undefined` (for example a TLS
socket layered over another stream), so the loop steps onto `undefined`
and reads a property off it, throwing a TypeError:

    Cannot read properties of undefined (reading 'Symbol(timeout)')

from an uncaught I/O callback and crashing the process.

Using a nullish (`!= null`) check terminates the walk on both `null` and
`undefined`.

[[email protected]: apply the same fix to the identical loop in
`_destroy`, which the original regression test already exercised via
`destroy()`; add direct unit coverage for both paths.]

Fixes: #64490
Refs: #64491

Signed-off-by: Petter Häggholm <[email protected]>
PR-URL: #64644
Fixes: #64490
Refs: #64491
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

The fix and approach are from #64491 by Shivay-98; this reopens it to
get it landed, since the original stalled awaiting requested changes.

`Socket.prototype._unrefTimer` and `Socket.prototype._destroy` both walk
the `_parent` chain with a strict `!== null` check. During connection
teardown a socket's `_parent` can be left `undefined` (for example a TLS
socket layered over another stream), so the loop steps onto `undefined`
and reads a property off it, throwing a TypeError:

    Cannot read properties of undefined (reading 'Symbol(timeout)')

from an uncaught I/O callback and crashing the process.

Using a nullish (`!= null`) check terminates the walk on both `null` and
`undefined`.

[[email protected]: apply the same fix to the identical loop in
`_destroy`, which the original regression test already exercised via
`destroy()`; add direct unit coverage for both paths.]

Fixes: #64490
Refs: #64491

Signed-off-by: Petter Häggholm <[email protected]>
PR-URL: #64644
Fixes: #64490
Refs: #64491
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

The fix and approach are from #64491 by Shivay-98; this reopens it to
get it landed, since the original stalled awaiting requested changes.

`Socket.prototype._unrefTimer` and `Socket.prototype._destroy` both walk
the `_parent` chain with a strict `!== null` check. During connection
teardown a socket's `_parent` can be left `undefined` (for example a TLS
socket layered over another stream), so the loop steps onto `undefined`
and reads a property off it, throwing a TypeError:

    Cannot read properties of undefined (reading 'Symbol(timeout)')

from an uncaught I/O callback and crashing the process.

Using a nullish (`!= null`) check terminates the walk on both `null` and
`undefined`.

[[email protected]: apply the same fix to the identical loop in
`_destroy`, which the original regression test already exercised via
`destroy()`; add direct unit coverage for both paths.]

Fixes: #64490
Refs: #64491

Signed-off-by: Petter Häggholm <[email protected]>
PR-URL: #64644
Fixes: #64490
Refs: #64491
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>