worker: fix crash when SharedArrayBuffer outlives creating thread

Keep a reference to the `ArrayBuffer::Allocator` alive for at least
as long as a `SharedArrayBuffer` allocated by it lives.

Refs: https://github.com/nodejs/node/pull/28788
Fixes: https://github.com/nodejs/node/issues/28777
Fixes: https://github.com/nodejs/node/issues/28773

PR-URL: https://github.com/nodejs/node/pull/29190
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

1 files changed, 8 insertions, 5 deletions

diff --git a/src/node_worker.cc b/src/node_worker.cc
index 8f97f5c351..11e44a9275 100644
--- a/src/node_worker.cc
+++ b/src/node_worker.cc
@@ -59,6 +59,7 @@ Worker::Worker(Environment* env,
       per_isolate_opts_(per_isolate_opts),
       exec_argv_(exec_argv),
       platform_(env->isolate_data()->platform()),
+      array_buffer_allocator_(ArrayBufferAllocator::Create()),
       start_profiler_idle_notifier_(env->profiler_idle_notifier_started()),
       thread_id_(Environment::AllocateThreadId()),
       env_vars_(env->env_vars()) {
@@ -102,17 +103,20 @@ bool Worker::is_stopped() const {
   return stopped_;
 }
 
+std::shared_ptr<ArrayBufferAllocator> Worker::array_buffer_allocator() {
+  return array_buffer_allocator_;
+}
+
 // This class contains data that is only relevant to the child thread itself,
 // and only while it is running.
 // (Eventually, the Environment instance should probably also be moved here.)
 class WorkerThreadData {
  public:
   explicit WorkerThreadData(Worker* w)
-    : w_(w),
-      array_buffer_allocator_(ArrayBufferAllocator::Create()) {
+    : w_(w) {
     CHECK_EQ(uv_loop_init(&loop_), 0);
 
-    Isolate* isolate = NewIsolate(array_buffer_allocator_.get(), &loop_);
+    Isolate* isolate = NewIsolate(w->array_buffer_allocator_.get(), &loop_);
     CHECK_NOT_NULL(isolate);
 
     {
@@ -124,7 +128,7 @@ class WorkerThreadData {
       isolate_data_.reset(CreateIsolateData(isolate,
                                             &loop_,
                                             w_->platform_,
-                                            array_buffer_allocator_.get()));
+                                            w->array_buffer_allocator_.get()));
       CHECK(isolate_data_);
       if (w_->per_isolate_opts_)
         isolate_data_->set_options(std::move(w_->per_isolate_opts_));
@@ -166,7 +170,6 @@ class WorkerThreadData {
  private:
   Worker* const w_;
   uv_loop_t loop_;
-  std::unique_ptr<ArrayBufferAllocator> array_buffer_allocator_;
   DeleteFnPtr<IsolateData, FreeIsolateData> isolate_data_;
 
   friend class Worker;