Skip to content

fix: Deadlock in Electron >= v40 #35

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
timfish merged 1 commit into from
May 13, 2026
Merged

fix: Deadlock in Electron >= v40 #35

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion bindings/cpu_profiler.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ class MeasurementsTicker {
cpu_listeners;
v8::Isolate *isolate;
v8::HeapStatistics heap_stats;
uv_cpu_info_t cpu_stats;

public:
MeasurementsTicker(uv_loop_t *loop)
Expand Down Expand Up @@ -161,7 +162,7 @@ void MeasurementsTicker::remove_heap_listener(

// CPU tickers
void MeasurementsTicker::cpu_callback() {
uv_cpu_info_t *cpu = nullptr;
uv_cpu_info_t *cpu = &cpu_stats;
Copy link
Copy Markdown

@cursor cursor Bot May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix may be ineffective; uv_cpu_info overwrites pointer

Medium Severity

The uv_cpu_info API takes a uv_cpu_info_t** and unconditionally overwrites *cpu_infos with a pointer to newly allocated memory. This means initializing cpu to &cpu_stats vs nullptr has no effect — uv_cpu_info will still allocate, overwrite cpu, and the cpu_stats member is never read from or written to. If, however, some Electron-patched uv_cpu_info does skip allocation when *cpu_infos is non-null, then cpu would remain pointing at the single-element member cpu_stats, causing an out-of-bounds read in the loop (when count > 1) and uv_free_cpu_info would attempt to free() a class member variable — both undefined behavior.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 9e90661. Configure here.

Copy link
Copy Markdown
Collaborator Author

@timfish timfish May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested this locally with Electron and it does seem to fix the issue

int count;
int err = uv_cpu_info(&cpu, &count);

Expand Down
Loading