src: move req_wrap_queue to base class of ReqWrap

Introduce a second base class for `ReqWrap` that does not
depend on a template parameter and move the `req_wrap_queue_`
field to it.

This addresses undefined behaviour that occurs when casting
to `ReqWrap<uv_req_t>` in the `ReqWrap` constructor.

Refs: https://github.com/nodejs/node/issues/26131

PR-URL: https://github.com/nodejs/node/pull/26148
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

1 files changed, 11 insertions, 6 deletions

diff --git a/src/req_wrap-inl.h b/src/req_wrap-inl.h
index 4f9da1c4f3..5fb9654148 100644
--- a/src/req_wrap-inl.h
+++ b/src/req_wrap-inl.h
@@ -11,16 +11,16 @@
 
 namespace node {
 
+ReqWrapBase::ReqWrapBase(Environment* env) {
+  env->req_wrap_queue()->PushBack(this);
+}
+
 template <typename T>
 ReqWrap<T>::ReqWrap(Environment* env,
                     v8::Local<v8::Object> object,
                     AsyncWrap::ProviderType provider)
-    : AsyncWrap(env, object, provider) {
-
-  // FIXME(bnoordhuis) The fact that a reinterpret_cast is needed is
-  // arguably a good indicator that there should be more than one queue.
-  env->req_wrap_queue()->PushBack(reinterpret_cast<ReqWrap<uv_req_t>*>(this));
-
+    : AsyncWrap(env, object, provider),
+      ReqWrapBase(env) {
   Reset();
 }
 
@@ -51,6 +51,11 @@ void ReqWrap<T>::Cancel() {
     uv_cancel(reinterpret_cast<uv_req_t*>(&req_));
 }
 
+template <typename T>
+AsyncWrap* ReqWrap<T>::GetAsyncWrap() {
+  return this;
+}
+
 // Below is dark template magic designed to invoke libuv functions that
 // initialize uv_req_t instances in a unified fashion, to allow easier
 // tracking of active/inactive requests.