Nick Gerleman 678c3a8dd5 Fix use-after-free if JNI Yoga nodes are garbage collected using multiple threads (#37243)
Summary:
X-link: https://github.com/facebook/react-native/pull/37243

X-link: https://github.com/facebook/litho/pull/944

Pull Request resolved: https://github.com/facebook/yoga/pull/1279

Java bindings for Yoga rely solely on garbage collection for memory management. Each Java `YogaNode` has references to its children and parent Java Nodes. This means, for a node to be garbage collected, it cannot be reachable from any user accessible node. Each node then has single ownership of a `YGNodeRef`. When the `YogaNode` is garbage collected, a finalizer is run to call `YGNodeFree` and free the underlying native Yoga Node.

This may cause a use-after-free if finalizers are run from multiple threads. This is because `YGNodeFree` does more than just freeing, but instead also interacts with its parent and children nodes to detach itself, and remove any dangling pointers. If multiple threads run finalizers at once, one may traverse and try to mutate a node which another is freeing.

Because we know the entire connected tree is dead, there is no need to remove dangling pointers, so I want to expose a way to just free a Yoga Node, without it mutating the tree as a side effect.

This adds a currently private `YGNodeDeallocate` that frees without traversal. Ideally from naming this is what `YGNodeFree` would do, but we think changing the behavior of that might be too disruptive to OSS. At the same time there may be other memory safety related API changes we would like to eventually make, so this isn't made public beyond the JNI bindings to prevent needing to transition more APIs.

Changelog: [Internal]

Reviewed By: rshest

Differential Revision: D45556206

fbshipit-source-id: 8e95929eb0e2d94fb83f63bcac5bae9c44d4d599
2023-05-10 21:11:45 -07:00
2023-05-05 04:07:40 -07:00
2023-05-09 10:43:02 -07:00
2022-12-29 10:27:00 -08:00
2023-05-09 10:43:02 -07:00
2023-01-16 04:16:07 -08:00
2019-01-08 12:50:41 -08:00
2017-05-27 09:12:22 -07:00
2023-05-04 11:30:01 -07:00
2023-05-05 04:07:40 -07:00
2021-08-13 08:24:14 -07:00
2023-05-04 11:30:01 -07:00
2023-01-16 04:16:07 -08:00
2016-12-07 17:41:50 +00:00

Yoga Support Ukraine CocoaPods npm Maven Central

Yoga is an embeddable and performant flexbox layout engine with bindings for multiple languages.

Building

Yoga's main implementation targets C++ 14 with accompanying build logic in CMake. A wrapper is provided to build the main library and run unit tests.

./unit_tests <Debug|Release>

While not required, this script will use ninja if it is installed for faster builds.

Yoga is additionally part of the vcpkg collection of ports maintained by Microsoft and community contributors. If the version is out of date, please create an issue or pull request on the vcpkg repository.

Adding Tests

Many of Yoga's tests are automatically generated, using HTML fixtures describing node structure. These are rendered in Chrome to generate an expected layout result for the tree. New fixtures can be added to gentest/fixtures.

<div id="my_test" style="width: 100px; height: 100px; align-items: center;">
  <div style="width: 50px; height: 50px;"></div>
</div>

To generate new tests from added fixtures:

  1. Run bundle install in the gentest directory to install dependencies of the test generator.
  2. Run ruby gentest.rb in the gentest directory.

Debugging

Yoga provides a VSCode "launch.json" configuration which allows debugging unit tests. Simply add your breakpoints, and run "Debug C++ Unit tests (lldb)" (or "Debug C++ Unit tests (vsdbg)" on Windows).

Description
Yoga is an embeddable layout engine targeting web standards.
Readme MIT 37 MiB
Yoga 3.2.1 Latest
2024-12-12 17:41:47 -08:00
Languages
C++ 46.4%
Java 25.2%
TypeScript 23.1%
HTML 2.6%
JavaScript 1%
Other 1.6%