stream_wrap: possible use-after-free in StreamWrap::WriteStringImpl

[bnoordhuis]

    if (args[1]->IsObject()) {
      Local<Object> send_stream_obj = args[1]->ToObject();
      assert(send_stream_obj->InternalFieldCount() > 0);
      StreamWrap* send_stream_wrap = static_cast<StreamWrap*>(
          send_stream_obj->GetAlignedPointerFromInternalField(0));
      send_stream = send_stream_wrap->GetStream();
    }

    r = uv_write2(&req_wrap->req_,
                  wrap->stream_,
                  &buf,
                  1,
                  send_stream,
                  StreamWrap::AfterWrite);

args[1] - the object to send - should not be garbage collected until StreamWrap::AfterWrite is called. It currently works only by accident.

/cc @indutny

[indutny]

Was fixed month ago in 99f0b02