GeezerVison

Environment::RunCleanup() closes task_queues_async_ in ClosePerEnvHandles() and only afterwards clears task_queues_async_initialized_ in CleanupHandles(). In between, another thread can still call uv_async_send() on the closing handle through SetImmediateThreadsafe() or RequestInterrupt(). On Windows that aborts:

Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c, line 94

The sender I hit is an external Buffer's backing store being freed on a V8 sweeper thread while the process exits:

ArrayBufferSweeper::SweepingJob::SweepYoung → BackingStore::~BackingStore → node::Buffer::CallbackInfo::OnBackingStoreFree → Environment::SetImmediateThreadsafe → uv_async_send(&task_queues_async_)

(stack from lldb on macOS with v24.22.2, where libuv lets the call through.)

This change clears the flag, under the mutex the senders hold, before the handle is closed. Callbacks queued after that are still run, since RunCleanup() loops until the thread-safe queues are empty.

Reproduction

An addon with one function that returns an external Buffer, a script that makes 20000 of them and runs out of work, run 100 times. Processes that died with the assertion, GitHub-hosted windows-latest, 2026-11-11:

// One export, `make(size)`: an external Buffer of that many bytes over malloc'd memory, freed by its finalizer.
#include <node_api.h>
#include <stdint.h>
#include <stdlib.h>

static void release(napi_env env, void* data, void* hint) {
  (void)env;
  (void)hint;
  free(data);
}

static napi_value make(napi_env env, napi_callback_info info) {
  size_t argc = 1;
  napi_value arg;
  uint32_t size = 16;
  napi_get_cb_info(env, info, &argc, &arg, NULL, NULL);
  if (argc == 1) napi_get_value_uint32(env, arg, &size);
  void* data = calloc(1, size);
  napi_value buffer;
  if (data == NULL || napi_create_external_buffer(env, size, data, release, NULL, &buffer) != napi_ok) {
    free(data);
    napi_throw_error(env, NULL, "no external buffer");
    return NULL;
  }
  return buffer;
}

NAPI_MODULE_INIT() {
  napi_value fn;
  napi_create_function(env, "make", NAPI_AUTO_LENGTH, make, NULL, &fn);
  napi_set_named_property(env, exports, "make", fn);
  return exports;
}

// Makes COUNT external Buffers of SIZE bytes, drops each, starts a collection of KIND (minor, major, or none to start
// none) and runs out of work, so the process ends while V8 may still be freeing them:
// node child.js ADDON [COUNT] [SIZE] [KIND]
const [addon, count = '20000', size = '16', kind = 'minor'] = process.argv.slice(2);
const { make } = require(addon);
for (let i = 0; i < Number(count); i++) make(Number(size));
if (kind !== 'none') {
  require('node:v8').setFlagsFromString('--expose-gc');
  require('node:vm').runInNewContext('gc')({ type: kind });
}

The new test, test/addons/buffer-free-callback/test-exit.js, does the same with the existing buffer-free-callback binding. It can only fail on Windows, and not on every run, so it spawns 20 children.

Verification

main at 50ce73f built on a GitHub-hosted windows-2025 runner (vcbuild.bat clang-cl), as it is and with this patch, then the reproduction above run 200 times each way against both builds (2026-11-11). Processes that died with the assertion:

On the patched build test/addons/buffer-free-callback/test-exit.js passed 10 runs out of 10. I did not run that test file against the unpatched build; the first row above is the same workload, so 20 children should fail it about 98% of the time there. I have not run the rest of the test suite on Windows.

Related

#56645 and #64322 report the same assertion. #61999 fixed it for the platform's task queues and is in v24.22.2, which still aborts through this path.

AI disclosure

An AI coding assistant was used to track down the race, write the patch and the test, and draft this description. The counts above are from CI runs of the reproduction.