fix(runtime): keep the V8 platform and main Runtime alive through exit() (#469)

* fix(runtime): keep the V8 platform and main Runtime alive through exit()

Both were file-scope globals with non-trivial destructors, so exit() tore
them down from whatever thread called it. iOS reclaims a suspended app by
calling exit() on a BackBoard thread while the main thread and every worker
are still running; the platform was freed first, then ~Runtime terminated the
workers, and a worker disposing its isolate dereferenced the freed platform
in V8's TracingCpuProfilerImpl destructor. The same pass also locked the live
main isolate and deallocated JS-owned ObjC objects on a foreign thread.

The platform is now a raw pointer that is never deleted; V8 holds it by raw
pointer for every isolate anyway. The main Runtime is a raw pointer deleted
only by shutdownRuntime and before re-initialization, so embedders keep the
deliberate teardown and restart paths unchanged.

* fix(runtime): clear the main runtime pointer before destroying it

Matches the order the previous unique_ptr reset had, so a caller checking
runtime_ during shutdownRuntime sees null rather than a runtime whose
destructor is running.

* docs(runtime): describe runtime lifetime without the removed unique_ptr

Author: edusperoni

NativeScript/NativeScript.mm

@@ -39,7 +39,18 @@ - (void)runScriptString:(NSString*)script runLoop:(BOOL)runLoop {
   tns::Tasks::Drain();
 }
 
-std::unique_ptr<Runtime> runtime_;
+// A raw pointer so that exit() never runs ~Runtime from a static destructor:
+// exit() can come from any thread while the main thread and every worker are
+// still live, and a teardown then races them and the other static destructors.
+// A dying process needs no teardown; shutdownRuntime is the deliberate path.
+Runtime* runtime_ = nullptr;
+
+// Cleared before ~Runtime runs so no caller sees a runtime mid-destruction.
+static void DestroyMainRuntime() {
+  Runtime* runtime = runtime_;
+  runtime_ = nullptr;
+  delete runtime;
+}
 
 - (void)runMainApplication {
   runtime_->RunMainScript();
@@ -141,9 +152,7 @@ - (void)shutdownRuntime {
     Console::DetachInspectorClient();
   }
   tns::Tasks::ClearTasks();
-  if (runtime_ != nullptr) {
-    runtime_ = nullptr;
-  }
+  DestroyMainRuntime();
 }
 
 - (instancetype)initializeWithConfig:(Config*)config {
@@ -165,8 +174,8 @@ - (instancetype)initializeWithConfig:(Config*)config {
     RuntimeConfig.LogToSystemConsole = [config LogToSystemConsole];
 
     Runtime::Initialize();
-    runtime_ = nullptr;
-    runtime_ = std::make_unique<Runtime>();
+    DestroyMainRuntime();
+    runtime_ = new Runtime();
 
     std::chrono::high_resolution_clock::time_point t1 = std::chrono::high_resolution_clock::now();
     Isolate* isolate = runtime_->CreateIsolate();
@@ -181,7 +190,7 @@ - (instancetype)initializeWithConfig:(Config*)config {
       Isolate::Scope isolate_scope(isolate);
       HandleScope handle_scope(isolate);
       v8_inspector::JsV8InspectorClient* inspectorClient =
-          new v8_inspector::JsV8InspectorClient(runtime_.get());
+          new v8_inspector::JsV8InspectorClient(runtime_);
       inspectorClient->init();
       inspectorClient->registerModules();
       inspectorClient->connect([config ArgumentsCount], [config Arguments]);

NativeScript/runtime/Runtime.h

@@ -100,7 +100,7 @@ class Runtime {
     return currentRuntime_->IsRuntimeWorker();
   }
 
-  static std::shared_ptr<v8::Platform> GetPlatform() { return platform_; }
+  static v8::Platform* GetPlatform() { return platform_; }
 
   static id GetAppConfigValue(std::string key);
 
@@ -119,9 +119,6 @@ class Runtime {
   static napi_env GetNapiEnvIfAlive(const Runtime* runtime);
 
   // Milliseconds since this runtime's time origin, on the monotonic clock.
-  // Not inline on purpose: an inline definition would have to reach the
-  // platform through GetPlatform(), which copies a shared_ptr on every call,
-  // while the out-of-line definition reads platform_ directly.
   double PerformanceNowMillis();
 
   // Wall-clock milliseconds since the Unix epoch at the moment the time origin
@@ -138,7 +135,10 @@ class Runtime {
 
  private:
   static thread_local Runtime* currentRuntime_;
-  static std::shared_ptr<v8::Platform> platform_;
+  // Lives until the process dies and is never deleted: V8 holds it by raw
+  // pointer for every isolate, and exit() runs static destructors while the
+  // main thread and worker threads are still tearing isolates down.
+  static v8::Platform* platform_;
   static std::vector<v8::Isolate*> isolates_;
   static SpinMutex isolatesMutex_;
   static bool v8Initialized_;
@@ -171,13 +171,9 @@ class Runtime {
   CFRunLoopObserverRef rejectionObserver_ = nullptr;
   double timeOriginMonotonic_;
   double timeOriginRealtimeMs_;
-  // TODO: refactor this. This is only needed because, during program
-  // termination (UIApplicationMain not called) the Cache::Workers is released
-  // (static initialization order fiasco
-  // https://en.cppreference.com/w/cpp/language/siof) so it released the
-  // Cache::Workers shared_ptr and then releases the Runtime unique_ptr
-  // eventually we just need to refactor so that Runtime::Initialize is
-  // responsible for its initalization and lifecycle
+  // Keeps Caches::Workers alive for as long as this runtime exists: ~Runtime
+  // reads it, and a worker runtime can be deleted on its own thread while
+  // exit() is already running static destructors on another.
   std::shared_ptr<ConcurrentMap<int, std::shared_ptr<Caches::WorkerState>>>
       workerCache_;
 };

NativeScript/runtime/Runtime.mm

@@ -193,12 +193,10 @@ static void InitializeImportMetaObject(Local<Context> context, Local<Module> mod
 // kCFTimeZoneSystemTimeZoneDidChangeNotification, NULL);
 
 void DisposeIsolateWhenPossible(Isolate* isolate) {
-  // most of the time, this will never delay disposal
-  // occasionally this can happen when the runtime is destroyed by actions of its own isolate
-  // as an example: isolate calls exit(0), which in turn destroys the Runtime unique_ptr
-  // another scenario is when embedding nativescript, if the embedder deletes the runtime as a
-  // result of a callback from JS in the case of exit(0), the app will die before actually disposing
-  // the isolate, which isn't a problem
+  // Disposal is deferred only while the isolate is still entered, which happens
+  // when the runtime is deleted by code running inside its own isolate: an
+  // embedder calling shutdownRuntime from a JS callback. exit() never deletes a
+  // runtime, so a process that is dying leaves its isolates to the OS.
   if (isolate->IsInUse()) {
     dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(10.0 * NSEC_PER_MSEC)),
                    dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_LOW, 0), ^{
@@ -331,9 +329,9 @@ void DisposeIsolateWhenPossible(Isolate* isolate) {
 
     // wrap the default platform so foreground tasks ride each runtime
     // thread's CFRunLoop instead of sitting in never-pumped libplatform queues
-    Runtime::platform_ = std::make_shared<NativeScriptPlatform>(platform::NewDefaultPlatform());
+    Runtime::platform_ = new NativeScriptPlatform(platform::NewDefaultPlatform());
 
-    V8::InitializePlatform(Runtime::platform_.get());
+    V8::InitializePlatform(Runtime::platform_);
     V8::Initialize();
     v8Initialized_ = true;
   }
@@ -781,7 +779,7 @@ void DisposeIsolateWhenPossible(Isolate* isolate) {
   return nullptr;
 }
 
-std::shared_ptr<Platform> Runtime::platform_;
+Platform* Runtime::platform_ = nullptr;
 std::vector<Isolate*> Runtime::isolates_;
 bool Runtime::v8Initialized_ = false;
 thread_local Runtime* Runtime::currentRuntime_ = nullptr;