fix: use-after-free crash at process exit from per-instance cleanup hooks

Every VideoDecoderAsync/VideoEncoderAsync constructor registered an env
cleanup hook whose argument pointed at a member of the instance, and the
destructor never removed it. Any instance GC'd during the process's
lifetime left a dangling hook; at exit, RunCleanup() executed it,
writing through freed memory — which by then was often reused by node's
own CleanupQueue hash table, corrupting it so the next ThreadSafeFunction
destructor's RemoveEnvironmentCleanupHook crashed (confirmed via crash
report: SIGSEGV in CleanupHookCallback hash find during RunCleanup).

Replace the per-instance hooks with one addon-level flag registered once
in Init. Also pin the JS wrapper (Ref/Unref) while jobs are in flight so
queued job-done callbacks, which capture this, can never outlive the
instance; Close() balances the pin.

Repro (construct/encode/drop 120 encoders without close, GC, exit)
crashed ~5% of runs on main; 0/60 after the fix. This is the likely
root cause of the ubuntu CI flake since v1.2.0 and the FFmpeg-7.x
static-build exit aborts.

Claude-Session: https://claude.ai/code/session_01QCBuz9ekP3aosHS34QaAqK

Author: caseymanos

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [1.3.1] - 2026-07-18
+
+### Fixed
+- Intermittent crash at process exit (SIGSEGV/SIGABRT during teardown). Each codec instance registered an env cleanup hook pointing into itself and never removed it; instances collected during the process's lifetime left dangling hooks that corrupted Node's cleanup queue when run at exit. One process-level flag now serves all instances, and codec objects are pinned while work is in flight so queued completion callbacks can never outlive them. Also the likely cause of the ubuntu CI flake since v1.2.0 and the FFmpeg-7.x static-build aborts.
+
 ## [1.3.0] - 2026-07-15
 
 ### Added

native/async_decoder.cpp

@@ -1,4 +1,5 @@
 #include "async_decoder.h"
+#include "env_state.h"
 #include "frame.h"
 
 Napi::FunctionReference VideoDecoderAsync::constructor;
@@ -63,22 +64,22 @@ VideoDecoderAsync::VideoDecoderAsync(const Napi::CallbackInfo& info)
         1
     );
     tsfnJobDone_.Unref(env);
-
-    // At env teardown TSFNs are finalized before this wrapper's destructor
-    // runs; flag it so the destructor skips Release on dead handles
-    env.AddCleanupHook([](bool* flag) { *flag = true; }, &envTeardown_);
 }
 
 // Hold the event loop open while jobs are in flight (JS thread only)
 void VideoDecoderAsync::JobSubmitted(Napi::Env env) {
     if (activeJobs_++ == 0) {
         tsfnOutput_.Ref(env);
+        // pin the wrapper so queued job-done callbacks (which capture this)
+        // can never outlive the instance
+        Ref();
     }
 }
 
 void VideoDecoderAsync::JobFinished(Napi::Env env) {
     if (activeJobs_ > 0 && --activeJobs_ == 0) {
         tsfnOutput_.Unref(env);
+        Unref();
     }
 }
 
@@ -98,7 +99,7 @@ VideoDecoderAsync::~VideoDecoderAsync() {
     }
 
     // Release thread-safe functions unless env teardown already finalized them
-    if (!envTeardown_) {
+    if (!nwc_env_teardown.load()) {
         if (tsfnOutput_) tsfnOutput_.Release();
         if (tsfnError_) tsfnError_.Release();
         if (tsfnFlush_) tsfnFlush_.Release();
@@ -490,7 +491,10 @@ void VideoDecoderAsync::Close(const Napi::CallbackInfo& info) {
     if (tsfnError_) { tsfnError_.Release(); tsfnError_ = Napi::ThreadSafeFunction(); }
     if (tsfnFlush_) { tsfnFlush_.Release(); tsfnFlush_ = Napi::ThreadSafeFunction(); }
     if (tsfnJobDone_) { tsfnJobDone_.Release(); tsfnJobDone_ = Napi::ThreadSafeFunction(); }
-    activeJobs_ = 0;
+    if (activeJobs_ > 0) {
+        activeJobs_ = 0;
+        Unref();  // balance the in-flight pin; queued JobFinished sees 0 and skips
+    }
 
     configured_ = false;
 }

native/async_decoder.h

@@ -63,7 +63,7 @@ class VideoDecoderAsync : public Napi::ObjectWrap<VideoDecoderAsync> {
 
     // Worker thread
     std::thread workerThread_;
-    bool envTeardown_ = false;
+
     Napi::ThreadSafeFunction tsfnJobDone_;
     int activeJobs_ = 0;
     void JobSubmitted(Napi::Env env);

native/async_encoder.cpp

@@ -1,4 +1,5 @@
 #include "async_encoder.h"
+#include "env_state.h"
 #include "frame.h"
 #include "color.h"
 #include "svc.h"
@@ -80,22 +81,22 @@ VideoEncoderAsync::VideoEncoderAsync(const Napi::CallbackInfo& info)
         1
     );
     tsfnJobDone_.Unref(env);
-
-    // At env teardown TSFNs are finalized before this wrapper's destructor
-    // runs; flag it so the destructor skips Release on dead handles
-    env.AddCleanupHook([](bool* flag) { *flag = true; }, &envTeardown_);
 }
 
 // Hold the event loop open while jobs are in flight (JS thread only)
 void VideoEncoderAsync::JobSubmitted(Napi::Env env) {
     if (activeJobs_++ == 0) {
         tsfnOutput_.Ref(env);
+        // pin the wrapper so queued job-done callbacks (which capture this)
+        // can never outlive the instance
+        Ref();
     }
 }
 
 void VideoEncoderAsync::JobFinished(Napi::Env env) {
     if (activeJobs_ > 0 && --activeJobs_ == 0) {
         tsfnOutput_.Unref(env);
+        Unref();
     }
 }
 
@@ -124,7 +125,7 @@ VideoEncoderAsync::~VideoEncoderAsync() {
     }
 
     // Release thread-safe functions unless env teardown already finalized them
-    if (!envTeardown_) {
+    if (!nwc_env_teardown.load()) {
         if (tsfnOutput_) tsfnOutput_.Release();
         if (tsfnError_) tsfnError_.Release();
         if (tsfnFlush_) tsfnFlush_.Release();
@@ -969,7 +970,10 @@ void VideoEncoderAsync::Close(const Napi::CallbackInfo& info) {
     if (tsfnError_) { tsfnError_.Release(); tsfnError_ = Napi::ThreadSafeFunction(); }
     if (tsfnFlush_) { tsfnFlush_.Release(); tsfnFlush_ = Napi::ThreadSafeFunction(); }
     if (tsfnJobDone_) { tsfnJobDone_.Release(); tsfnJobDone_ = Napi::ThreadSafeFunction(); }
-    activeJobs_ = 0;
+    if (activeJobs_ > 0) {
+        activeJobs_ = 0;
+        Unref();  // balance the in-flight pin; queued JobFinished sees 0 and skips
+    }
 
     configured_ = false;
 }

native/async_encoder.h

@@ -71,7 +71,7 @@ class VideoEncoderAsync : public Napi::ObjectWrap<VideoEncoderAsync> {
 
     // Worker thread
     std::thread workerThread_;
-    bool envTeardown_ = false;
+
     Napi::ThreadSafeFunction tsfnJobDone_;
     int activeJobs_ = 0;
     void JobSubmitted(Napi::Env env);

native/binding.cpp

@@ -1,4 +1,5 @@
 #include <napi.h>
+#include "env_state.h"
 #include "frame.h"
 #include "audio.h"
 #include "encoder.h"
@@ -11,7 +12,14 @@
 // Forward declaration
 void InitUtil(Napi::Env env, Napi::Object exports);
 
+std::atomic<bool> nwc_env_teardown{false};
+
 Napi::Object Init(Napi::Env env, Napi::Object exports) {
+    // One hook with static-lifetime state; per-instance hooks dangled after
+    // GC and corrupted node's cleanup queue at exit
+    env.AddCleanupHook([](std::atomic<bool>* flag) { flag->store(true); },
+                       &nwc_env_teardown);
+
     // Initialize frame classes
     VideoFrameNative::Init(env, exports);
 

native/env_state.h

@@ -0,0 +1,10 @@
+#pragma once
+#include <atomic>
+
+// Set once at env teardown (registered in binding.cpp Init). Object
+// destructors consult it to skip releasing thread-safe functions the runtime
+// has already finalized. Process-wide: with worker_threads a torn-down env
+// can make another env's destructors skip a release (a leak, never a crash),
+// which beats the alternative — per-instance cleanup hooks dangled after GC
+// and corrupted node's cleanup queue (crash at exit).
+extern std::atomic<bool> nwc_env_teardown;