node-gtk 4.1.0 → 4.1.1

package/binding.gyp

@@ -36,6 +36,7 @@
                 "src/gobject.cc",
                 "src/loop.cc",
                 "src/param_spec.cc",
+                "src/toggle_queue.cc",
                 "src/type.cc",
                 "src/util.cc",
                 "src/value.cc",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-gtk",
-  "version": "4.1.0",
+  "version": "4.1.1",
   "description": "GNOME Gtk+ bindings for NodeJS",
   "main": "lib/index.js",
   "exports": {

package/src/callback.cc

@@ -23,6 +23,9 @@ namespace GNodeJS {
 
 static guint callbackLevel = 0;
 static GSList* notifiedCallbacks = NULL;
+/* DestroyNotify can fire on any thread (e.g. a GTask freeing its callback
+ * data on a pool thread); the list must not race the JS thread's AsyncFree. */
+static GMutex notifiedCallbacksLock;
 
 static Local<Object> GetSelfInstance(GIArgument **args) {
     return WrapperFromGObject((GObject *)args[0]->v_pointer).As<Object>();
@@ -66,26 +69,27 @@ Callback::~Callback() {
  * we can't free the resources here. They'll be freed in Callback::AsyncFree.
  */
 void Callback::DestroyNotify (void* user_data) {
+    g_mutex_lock (&notifiedCallbacksLock);
     notifiedCallbacks = g_slist_prepend (notifiedCallbacks, user_data);
+    g_mutex_unlock (&notifiedCallbacksLock);
 }
 
 /**
  * Frees the callbacks that have been destroy-notified
  */
 void Callback::AsyncFree () {
-    if (notifiedCallbacks == NULL || callbackLevel > 0)
+    if (callbackLevel > 0)
         return;
 
-    GSList* current = notifiedCallbacks;
+    g_mutex_lock (&notifiedCallbacksLock);
+    GSList* list = notifiedCallbacks;
+    notifiedCallbacks = NULL;
+    g_mutex_unlock (&notifiedCallbacksLock);
 
-    while (current != NULL) {
-        Callback* callback = static_cast<Callback*>(current->data);
-        delete callback;
+    for (GSList* current = list; current != NULL; current = current->next)
+        delete static_cast<Callback*>(current->data);
 
-        current = current->next;
-    }
-
-    notifiedCallbacks = NULL;
+    g_slist_free (list);
 }
 
 /**

package/src/gi.cc

@@ -32,6 +32,8 @@ namespace GNodeJS {
 
     Nan::Persistent<Object> moduleCache(Nan::New<Object>());
 
+    GThread *js_thread = NULL;
+
     Local<Object> GetModuleCache() {
         return Nan::New<Object>(GNodeJS::moduleCache);
     }
@@ -526,6 +528,8 @@ NAN_METHOD(CallVFunc) {
 }
 
 void InitModule(Local<Object> exports, Local<Value> module, void *priv) {
+    GNodeJS::js_thread = g_thread_self();
+
     GNodeJS::AsyncCallEnvironment::Initialize();
 
     Nan::Export(exports, "Bootstrap",            Bootstrap);

package/src/gi.h

@@ -24,6 +24,12 @@ namespace GNodeJS {
 
 extern Nan::Persistent<Object> moduleCache;
 
+/*
+ * The thread running V8/libuv (recorded at module init). V8 objects — global
+ * handles in particular — may only be touched from this thread.
+ */
+extern GThread *js_thread;
+
 Local<Object> GetModuleCache();
 
 /*

package/src/gobject.cc

@@ -11,6 +11,7 @@
 #include "gi.h"
 #include "gobject.h"
 #include "macros.h"
+#include "toggle_queue.h"
 #include "util.h"
 #include "value.h"
 
@@ -133,10 +134,28 @@ struct GObjectWrapper {
     bool collected = false;
 };
 
-static void ToggleNotify(gpointer user_data, GObject *gobject, gboolean toggle_down) {
+/* Reconcile the wrapper's persistent with the state the object's current
+ * refcount calls for. Main thread only — called inline by ToggleNotify on the
+ * JS thread, and by toggleQueue's drain for deferred off-thread notifications.
+ *
+ * Weak when the toggle ref is the only reference left: we are the last
+ * holder, so the wrapper may be collected. The two-pass weak callback's first
+ * pass runs *during* GC (before any JS/GTK code resumes) and only flips a
+ * flag, so WrapperFromGObject can tell a reclaimed wrapper from a live one
+ * and never marshals a dead handle to JS. All GObject teardown happens in the
+ * second pass — a first-pass callback may not call into GObject.
+ *
+ * Strong otherwise: something other than us holds the object, so the wrapper
+ * must stay alive until that ref is dropped again. Reviving is essential —
+ * without it a wrapper that went weak once (e.g. a freshly constructed object
+ * at refcount 1) would never become strong again when GTK takes ownership,
+ * and GC could then collect a wrapper whose GObject is still in use (notably
+ * a subclassed widget owned by GTK, losing its overridden vfuncs and instance
+ * state). */
+void SynchronizeToggleState(GObject *gobject) {
     void *data = g_object_get_qdata (gobject, GNodeJS::object_quark());
-
-    g_assert (data != NULL);
+    if (data == NULL)
+        return;
 
     auto *wrapper = (GObjectWrapper *) data;
 
@@ -146,34 +165,37 @@ static void ToggleNotify(gpointer user_data, GObject *gobject, gboolean toggle_d
     if (wrapper->collected)
         return;
 
-    if (toggle_down) {
-        /* We're dropping from 2 refs to 1 ref: we are the last holder, so the
-         * wrapper may be collected. Install the weak ref (unless it already is). */
-        if (wrapper->dying)
-            return;
+    bool only_toggle_ref =
+        g_atomic_int_get ((const gint *) &gobject->ref_count) <= 1;
+
+    if (only_toggle_ref && !wrapper->dying) {
         wrapper->dying = true;
-        /* Two-pass weak callback: the first pass runs *during* GC (before any
-         * JS/GTK code resumes) and only flips a flag, so WrapperFromGObject can
-         * tell a reclaimed wrapper from a live one and never marshals a dead
-         * handle to JS. All GObject teardown happens in the second pass — a
-         * first-pass callback may not call into GObject. */
         wrapper->persistent.v8::PersistentBase<Object>::SetWeak (
             wrapper, GObjectDestroyedFirstPass, v8::WeakCallbackType::kParameter);
-    } else {
-        /* We're going from 1 ref to 2 refs: something other than us now holds
-         * the object, so the wrapper must stay alive (strong) until that ref is
-         * dropped again. Reviving here is essential — without it a wrapper that
-         * went weak once (e.g. a freshly constructed object at refcount 1) would
-         * never become strong again when GTK takes ownership, and GC could then
-         * collect a wrapper whose GObject is still in use (notably a subclassed
-         * widget owned by GTK, losing its overridden vfuncs and instance state). */
-        if (!wrapper->dying)
-            return;
+    } else if (!only_toggle_ref && wrapper->dying) {
         wrapper->dying = false;
         wrapper->persistent.ClearWeak ();
     }
 }
 
+/* Fires synchronously on whatever thread crosses the 1<->2 refcount boundary
+ * — e.g. GLib's worker thread dropping the ref it held on a GSubprocess while
+ * waiting for the child to exit. V8 global handles may only be touched from
+ * the JS thread: a SetWeak/ClearWeak from a worker raced the scavenger's
+ * weak-handle processing and corrupted the global-handle list (fatal "Check
+ * failed: Heap::InFromPage(heap_object)" in a later scavenge, or random
+ * SIGSEGV). Off-thread notifications are deferred to the main context; the
+ * notified direction is not forwarded because the deferred reconciliation
+ * re-derives it from the refcount (see toggle_queue.h). */
+static void ToggleNotify(gpointer user_data, GObject *gobject, gboolean toggle_down) {
+    if (G_UNLIKELY (g_thread_self () != GNodeJS::js_thread)) {
+        toggleQueue.Synchronize (gobject);
+        return;
+    }
+
+    SynchronizeToggleState (gobject);
+}
+
 static void AssociateGObject(Local<Object> object, GObject *gobject, GType gtype) {
     Nan::SetInternalFieldPointer(object, 0, gobject);
 
@@ -202,6 +224,9 @@ static void AssociateGObject(Local<Object> object, GObject *gobject, GType gtype
 static void GObjectFinalized(gpointer data, GObject *where_the_object_was) {
     auto *wrapper = (GObjectWrapper *) data;
     wrapper->gobject = NULL;
+    /* A deferred off-thread toggle may still be queued for this object; the
+     * drain must not touch freed memory. */
+    toggleQueue.Cancel (where_the_object_was);
 }
 
 static void GObjectConstructor(const FunctionCallbackInfo<Value> &info) {
@@ -308,6 +333,11 @@ static gboolean GObjectTeardownIdle(gpointer data) {
     /* If the GObject was already finalized out from under us, GObjectFinalized
      * cleared the pointer; there is nothing left to detach or unref. */
     if (gobject != NULL) {
+        /* The weak ref that would cancel a queued off-thread toggle on
+         * finalize is removed below, so cancel any pending entry now — the
+         * toggle ref drop at the end may be the object's last reference. */
+        toggleQueue.Cancel (gobject);
+
         /* Drop the weak ref first so removing the toggle ref (which may finalize
          * the object) doesn't re-enter GObjectFinalized. */
         g_object_weak_unref (gobject, GObjectFinalized, wrapper);

package/src/gobject.h

@@ -18,6 +18,11 @@ namespace GNodeJS {
 MaybeLocal<Function>    MakeClass            (GIBaseInfo *info);
 Local<Value>            WrapperFromGObject   (GObject *object);
 GObject *               GObjectFromWrapper   (Local<Value> value);
+
+/* Reconcile the wrapper's V8 persistent (weak or strong) with the GObject's
+ * current refcount. Main thread only; called inline by ToggleNotify on the JS
+ * thread and by toggleQueue's drain for deferred off-thread notifications. */
+void                    SynchronizeToggleState (GObject *gobject);
 Local<Value>            GetSignalHandler     (GObject *gobject, guint index);
 Local<FunctionTemplate> GetBaseClassTemplate ();
 MaybeLocal<Value>       GetGObjectProperty   (GObject * gobject, const char *prop_name);

package/src/toggle_queue.cc

@@ -0,0 +1,44 @@
+
+#include "toggle_queue.h"
+#include "gobject.h"
+
+namespace GNodeJS {
+
+ToggleQueue toggleQueue;
+
+void ToggleQueue::Synchronize (GObject *gobject) {
+    g_mutex_lock (&lock);
+    if (g_slist_find (objects, gobject) == NULL)
+        objects = g_slist_prepend (objects, gobject);
+    if (source == 0)
+        source = g_idle_add (ToggleQueue::Drain, this);
+    g_mutex_unlock (&lock);
+}
+
+void ToggleQueue::Cancel (GObject *gobject) {
+    g_mutex_lock (&lock);
+    objects = g_slist_remove (objects, gobject);
+    g_mutex_unlock (&lock);
+}
+
+/* Runs on the main context. The lock is held across the drain so a (buggy,
+ * over-unreffed) off-thread finalize cancelling its entry cannot race the
+ * entry being processed. SynchronizeToggleState never re-enters the queue,
+ * so this cannot deadlock. */
+gboolean ToggleQueue::Drain (gpointer user_data) {
+    auto *self = static_cast<ToggleQueue *> (user_data);
+
+    g_mutex_lock (&self->lock);
+    GSList *objects = self->objects;
+    self->objects = NULL;
+    self->source = 0;
+
+    for (GSList *l = objects; l != NULL; l = l->next)
+        SynchronizeToggleState ((GObject *) l->data);
+
+    g_slist_free (objects);
+    g_mutex_unlock (&self->lock);
+    return G_SOURCE_REMOVE;
+}
+
+}; /* GNodeJS */

package/src/toggle_queue.h

@@ -0,0 +1,53 @@
+
+#pragma once
+
+#include <glib-object.h>
+
+namespace GNodeJS {
+
+/*
+ * Defers toggle-state synchronization to the main context.
+ *
+ * "Synchronize" is meant as reconcile — bring the wrapper's V8 persistent
+ * (weak or strong) in line with the GObject's current refcount — not as
+ * synchronous execution: requests may come from any thread, and the
+ * reconciliation itself always runs later, from an idle on the main context.
+ *
+ * A toggle notification runs on whatever thread crosses the 1<->2 refcount
+ * boundary, but V8 global handles may only be touched from the JS thread
+ * (see ToggleNotify in gobject.cc). Off-thread notifications land here.
+ *
+ * The queue stores no direction: by the time the idle runs, the notified
+ * direction is stale (the refcount may have crossed the boundary again, in
+ * either order). Each drained object is instead reconciled from its current
+ * refcount (SynchronizeToggleState), which makes the deferral idempotent and
+ * ordering-insensitive.
+ *
+ * Entries hold no reference (taking one from inside a toggle handler would
+ * recursively fire the opposite toggle). A live wrapper's toggle ref keeps
+ * the object's refcount >= 1, so a queued object cannot be finalized under
+ * normal operation; as a safety net the GObjectFinalized weak callback and
+ * the wrapper teardown Cancel() any pending entry.
+ */
+class ToggleQueue {
+public:
+    /* Request a deferred synchronization of the object's toggle state.
+     * Callable from any thread. */
+    void Synchronize (GObject *gobject);
+
+    /* Drop the object's pending synchronization, if any. Callable from any
+     * thread. Must be called before the object can be finalized, so the
+     * drain never touches freed memory. */
+    void Cancel (GObject *gobject);
+
+private:
+    static gboolean Drain (gpointer user_data);
+
+    GMutex  lock;
+    GSList *objects;
+    guint   source;
+};
+
+extern ToggleQueue toggleQueue;
+
+}; /* GNodeJS */

package/src/value.cc

@@ -1293,15 +1293,24 @@ void FreeGIArgument(GITypeInfo *type_info, GIArgument *arg, GITransfer transfer,
         if (free_elements) {
             GITypeInfo *element_info = g_type_info_get_param_type(type_info, 0);
 
-            GITransfer  element_transfer  = GI_TRANSFER_EVERYTHING;
-            GIDirection element_direction = GI_DIRECTION_OUT;
+            /* Free elements in the direction they were allocated: an
+             * OUT/EVERYTHING list transferred us one reference per element,
+             * released here (the wrappers hold their own). An IN list was
+             * built by V8ToGIArgument, which allocates strings but borrows
+             * GObject/boxed pointers straight from their wrappers — freeing
+             * with IN/NOTHING releases the strings and leaves the borrowed
+             * pointers alone (mirrors FreeGIArgumentArray). Unreffing IN
+             * elements stole a reference per element from their real owners
+             * (e.g. Gdk.FileList.newFromList: the GFiles were finalized while
+             * the GdkFileList's deep copy still pointed at them). */
+            GITransfer  element_transfer  = is_in ? GI_TRANSFER_NOTHING : GI_TRANSFER_EVERYTHING;
             GIArgument  element_arg;
 
             GSList* list = (GSList *)arg->v_pointer;
 
             for (; list != NULL; list = list->next) {
                 element_arg.v_pointer = list->data;
-                FreeGIArgument(element_info, &element_arg, element_transfer, element_direction);
+                FreeGIArgument(element_info, &element_arg, element_transfer, direction);
             }
 
             g_base_info_unref(element_info);