Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Android: data race on ArgConverter's process-wide long-conversion cache when workers start or stop concurrently

Ouverte
  • Quelque chose ne va pas ?
#93 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
48/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
android, cpp
Domaine
backend, mobile

Piste de recherche

Read NativeScript/ffi/jni/napi/conversion/ArgConverter.{h,cpp} and NativeScript/ffi/jni/jsi/conversion/ArgConverter.{h,cpp}, focusing on GetTypeLongCache() and the disposal paths onDisposeEnv() and onDisposeRuntime(). Reproduce the reported race with the worker stress test on an API 36 arm64 emulator using HWASan; the issue describes enabling it in platforms/android/test-app/runtime/CMakeLists.txt. Done means concurrent runtime creation and disposal no longer corrupts either cache.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

bug

Summary

ArgConverter::s_type_long_operations_cache is a single, process-wide robin_hood::unordered_map. Each runtime finds, inserts and erases its own entry from its own thread, and nothing synchronizes those accesses:

  • find / insert: GetTypeLongCache(), on the first long conversion in that runtime.
  • erase: onDisposeEnv() / onDisposeRuntime(), when the runtime is disposed.

When several workers start or stop at once, one thread can rehash the table while another is reading or writing it. That is a data race on the map, and in practice a heap use-after-free.

Affects both binding layers:

  • NativeScript/ffi/jni/napi/conversion/ArgConverter.{h,cpp}: the map is keyed by napi_env.
  • NativeScript/ffi/jni/jsi/conversion/ArgConverter.{h,cpp}: the map is keyed by rt.identity().

How it was found

A worker stress test, run while testing #91 and #92 on an API 36 arm64 emulator. HWASan was enabled locally by uncommenting the -fsanitize=hwaddress lines in platforms/android/test-app/runtime/CMakeLists.txt; it is off by default. The test:

  • 12 workers at a time are created and terminated after 20–300 ms;
  • each worker churns Java objects and forces JS and Java GC;
  • the main runtime forces GC every 25 ms.

HWASan reported a memory error inside ArgConverter::GetTypeLongCache, in both the napi and jsi trees. On the old code (without #91), the crash happened in 1 of 3 napi runs and 1 of 2 jsi runs. It is independent of the GC-delivery race that #91 fixes.

Expected

Each runtime's cache is reachable only by that runtime, and creating or disposing one runtime can't corrupt another's entry. Possible fixes:

  • make the cache per-runtime state, reached the way MetadataNode's per-runtime cache is;
  • or guard the map with a mutex. This is cheap: a lookup happens once per long conversion, and the pointer could be cached after that.

Environment

  • Branch: android-react-native at 64c7fed0
  • Emulator: Android API 36, arm64, debug build of platforms/android/test-app with HWASan enabled locally
  • Engine: V8
Langage dominant
C++
Étoiles
27
Forks
4
Merge moyen
16 h 48 min
PR mergées (30 j)
4

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de NativeScript/runtimes

Toutes les issues de NativeScript/runtimes

Issues similaires

Plus d'issues C++

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.