src: move req_wrap_queue to base class of ReqWrap

Introduce a second base class for `ReqWrap` that does not
depend on a template parameter and move the `req_wrap_queue_`
field to it.

This addresses undefined behaviour that occurs when casting
to `ReqWrap<uv_req_t>` in the `ReqWrap` constructor.

Refs: https://github.com/nodejs/node/issues/26131

PR-URL: https://github.com/nodejs/node/pull/26148
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

1 files changed, 19 insertions, 5 deletions

diff --git a/src/req_wrap.h b/src/req_wrap.h
index 8f8d0cf288..890eb6cb61 100644
--- a/src/req_wrap.h
+++ b/src/req_wrap.h
@@ -10,8 +10,24 @@
 
 namespace node {
 
+class ReqWrapBase {
+ public:
+  explicit inline ReqWrapBase(Environment* env);
+
+  virtual ~ReqWrapBase() {}
+
+  virtual void Cancel() = 0;
+  virtual AsyncWrap* GetAsyncWrap() = 0;
+
+ private:
+  friend int GenDebugSymbols();
+  friend class Environment;
+
+  ListNode<ReqWrapBase> req_wrap_queue_;
+};
+
 template <typename T>
-class ReqWrap : public AsyncWrap {
+class ReqWrap : public AsyncWrap, public ReqWrapBase {
  public:
   inline ReqWrap(Environment* env,
                  v8::Local<v8::Object> object,
@@ -23,7 +39,8 @@ class ReqWrap : public AsyncWrap {
   // Call this after a request has finished, if re-using this object is planned.
   inline void Reset();
   T* req() { return &req_; }
-  inline void Cancel();
+  inline void Cancel() final;
+  inline AsyncWrap* GetAsyncWrap() override;
 
   static ReqWrap* from_req(T* req);
 
@@ -31,13 +48,10 @@ class ReqWrap : public AsyncWrap {
   inline int Dispatch(LibuvFunction fn, Args... args);
 
  private:
-  friend class Environment;
   friend int GenDebugSymbols();
   template <typename ReqT, typename U>
   friend struct MakeLibuvRequestCallback;
 
-  ListNode<ReqWrap> req_wrap_queue_;
-
   typedef void (*callback_t)();
   callback_t original_callback_ = nullptr;