Skip to content

node:http2: keep a stream.write() payload stable while transport JS runs mid-send - #36910

Merged
Jarred-Sumner merged 3 commits into
mainfrom
farm/68e19b12/h2-duplex-cork-uaf
Aug 5, 2026
Merged

node:http2: keep a stream.write() payload stable while transport JS runs mid-send#36910
Jarred-Sumner merged 3 commits into
mainfrom
farm/68e19b12/h2-duplex-cork-uaf

node:http2: own a JS-borrowed DATA payload for the send when transpor…

1ba41f8
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed Aug 4, 2026 in 35m 45s

Code review found 2 important issues

Found 1 candidates, confirmed 4. See review comments for details.

Details

Severity Count
🔴 Important 2
🟡 Nit 2
🟣 Pre-existing 0
Severity File:Line Issue
🟡 Nit src/runtime/api/bun/h2_frame_parser.rs:3135-3143 foreign_cork_runs_js clause is never the deciding factor in any test

Annotations

Check warning on line 3143 in src/runtime/api/bun/h2_frame_parser.rs

See this annotation in the file changed.

@claude claude / Claude Code Review

foreign_cork_runs_js clause is never the deciding factor in any test

The `foreign_cork_runs_js()` clause of `stable_payload`'s guard is never the deciding factor in any test — every writing session in the new suite is JS-Duplex-backed (or TLS-over-JS-Duplex), so `self.transport_write_runs_js()` is always true and short-circuits the `||`. Deleting the closure entirely and reducing :3143 to `self.transport_write_runs_js()` leaves all five new tests green. To make it load-bearing, the cork-handover test's session B needs a *native* TCP/TLS connection to a local serv