vm: fix race condition in watchdog cleanup

Previous code was calling uv_loop_delete() directly on a running loop,
which led to race condition aborts/segfaults within libuv.  This change
changes the watchdog thread to call uv_run() with UV_RUN_ONCE so that
the call exits after either the timer times out or uv_async_send() is
called from the main thread in Watchdog::Destroy().  The timer/async
handles are then closed and uv_run() with UV_RUN_DEFAULT is called so
that libuv has a chance to cleanup before the thread exits.  The main
thread meanwhile calls uv_thread_join() and then uv_loop_delete() to
complete the cleanup.

1 files changed, 23 insertions, 13 deletions

diff --git a/src/node_watchdog.cc b/src/node_watchdog.cc
index a8ec719348..0922a2b482 100644
--- a/src/node_watchdog.cc
+++ b/src/node_watchdog.cc
@@ -20,6 +20,7 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 #include "node_watchdog.h"
+#include <assert.h>
 
 namespace node {
 
@@ -27,24 +28,23 @@ using v8::V8;
 
 
 Watchdog::Watchdog(uint64_t ms)
-  : timer_started_(false)
-  , thread_created_(false)
+  : thread_created_(false)
   , destroyed_(false) {
 
   loop_ = uv_loop_new();
   if (!loop_)
     return;
 
-  int rc = uv_timer_init(loop_, &timer_);
-  if (rc) {
-    return;
-  }
+  int rc = uv_async_init(loop_, &async_, &Watchdog::Async);
+  assert(rc == 0);
+
+  rc = uv_timer_init(loop_, &timer_);
+  assert(rc == 0);
 
   rc = uv_timer_start(&timer_, &Watchdog::Timer, ms, 0);
   if (rc) {
     return;
   }
-  timer_started_ = true;
 
   rc = uv_thread_create(&thread_, &Watchdog::Run, this);
   if (rc) {
@@ -69,28 +69,38 @@ void Watchdog::Destroy() {
     return;
   }
 
-  if (timer_started_) {
-    uv_timer_stop(&timer_);
+  if (thread_created_) {
+    uv_async_send(&async_);
+    uv_thread_join(&thread_);
   }
 
   if (loop_) {
     uv_loop_delete(loop_);
   }
 
-  if (thread_created_) {
-    uv_thread_join(&thread_);
-  }
-
   destroyed_ = true;
 }
 
 
 void Watchdog::Run(void* arg) {
   Watchdog* wd = static_cast<Watchdog*>(arg);
+
+  // UV_RUN_ONCE so async_ or timer_ wakeup exits uv_run() call.
+  uv_run(wd->loop_, UV_RUN_ONCE);
+
+  // Loop ref count reaches zero when both handles are closed.
+  uv_close(reinterpret_cast<uv_handle_t*>(&wd->async_), NULL);
+  uv_close(reinterpret_cast<uv_handle_t*>(&wd->timer_), NULL);
+
+  // UV_RUN_DEFAULT so that libuv has a chance to clean up.
   uv_run(wd->loop_, UV_RUN_DEFAULT);
 }
 
 
+void Watchdog::Async(uv_async_t* async, int status) {
+}
+
+
 void Watchdog::Timer(uv_timer_t* timer, int status) {
   V8::TerminateExecution();
 }