[vm/io] Fix crashes in Socket.setOption

Don't call native methods on a socket which is closed
or in process of being closed. On some OSes this will
crash the VM because underlying FD is actually a malloc
allocated handle object which will be destroyed by 
the event handler once it receives and processes close
request.

BUG=b/335437875
TEST=standalone/io/abrupt_close_test

Change-Id: I557d725a6cce020a6a1e3df0bd3e2c836a6a6964
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/467841
Reviewed-by: Martin Kustermann <[email protected]>
Commit-Queue: Slava Egorov <[email protected]>

Author: mraleph

sdk/lib/_internal/vm/bin/socket_patch.dart

@@ -1593,7 +1593,7 @@ base class _NativeSocket extends _NativeSocketNativeWrapper
   int get port {
     if (localAddress.type == InternetAddressType.unix) return 0;
     if (localPort != 0) return localPort;
-    if (isClosing || isClosed) throw const SocketException.closed();
+    _ensureNotClosingOrClosed();
     var result = _nativeGetPort();
     if (result is OSError) {
       throw result;
@@ -1603,14 +1603,14 @@ base class _NativeSocket extends _NativeSocketNativeWrapper
 
   int get remotePort {
     if (localAddress.type == InternetAddressType.unix) return 0;
-    if (isClosing || isClosed) throw const SocketException.closed();
+    _ensureNotClosingOrClosed();
     return _nativeGetRemotePeer()[1];
   }
 
   InternetAddress get address => localAddress;
 
   InternetAddress get remoteAddress {
-    if (isClosing || isClosed) throw const SocketException.closed();
+    _ensureNotClosingOrClosed();
     var result = _nativeGetRemotePeer();
     var addr = result[0] as List<Object?>;
     var type = InternetAddressType._from(addr[0] as int);
@@ -1951,6 +1951,8 @@ base class _NativeSocket extends _NativeSocketNativeWrapper
   }
 
   dynamic getOption(SocketOption option) {
+    _ensureNotClosingOrClosed();
+
     // TODO(40614): Remove once non-nullability is sound.
     ArgumentError.checkNotNull(option, "option");
     var result = _nativeGetOption(option._value, address.type._value);
@@ -1959,13 +1961,17 @@ base class _NativeSocket extends _NativeSocketNativeWrapper
   }
 
   bool setOption(SocketOption option, value) {
+    _ensureNotClosingOrClosed();
+
     // TODO(40614): Remove once non-nullability is sound.
     ArgumentError.checkNotNull(option, "option");
     _nativeSetOption(option._value, address.type._value, value);
     return true;
   }
 
   Uint8List getRawOption(RawSocketOption option) {
+    _ensureNotClosingOrClosed();
+
     // TODO(40614): Remove once non-nullability is sound.
     ArgumentError.checkNotNull(option, "option");
     ArgumentError.checkNotNull(option.value, "option.value");
@@ -1974,6 +1980,8 @@ base class _NativeSocket extends _NativeSocketNativeWrapper
   }
 
   void setRawOption(RawSocketOption option) {
+    _ensureNotClosingOrClosed();
+
     // TODO(40614): Remove once non-nullability is sound.
     ArgumentError.checkNotNull(option, "option");
     ArgumentError.checkNotNull(option.value, "option.value");
@@ -2009,6 +2017,8 @@ base class _NativeSocket extends _NativeSocketNativeWrapper
   }
 
   void joinMulticast(InternetAddress addr, NetworkInterface? interface) {
+    _ensureNotClosingOrClosed();
+
     final interfaceAddr =
         multicastAddress(addr, interface) as _InternetAddress?;
     var interfaceIndex = interface == null ? 0 : interface.index;
@@ -2020,6 +2030,8 @@ base class _NativeSocket extends _NativeSocketNativeWrapper
   }
 
   void leaveMulticast(InternetAddress addr, NetworkInterface? interface) {
+    _ensureNotClosingOrClosed();
+
     final interfaceAddr =
         multicastAddress(addr, interface) as _InternetAddress?;
     var interfaceIndex = interface == null ? 0 : interface.index;
@@ -2034,6 +2046,12 @@ base class _NativeSocket extends _NativeSocketNativeWrapper
     return Platform.isWindows && _nativeHasPendingWrite();
   }
 
+  // Native methods are not guarding against closed sockets, which can
+  // lead to crashes.
+  void _ensureNotClosingOrClosed() {
+    if (isClosing || isClosed) throw const SocketException.closed();
+  }
+
   @pragma("vm:external-name", "Socket_SetSocketId")
   external void _nativeSetSocketId(int id, int typeFlags);
   @pragma("vm:external-name", "Socket_Available")

tests/standalone/io/abrupt_close_test.dart

@@ -0,0 +1,65 @@
+// Copyright (c) 2025, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// Check that Socket.setOption does not crash when socket closes due to
+// an error.
+
+import 'dart:async';
+import 'dart:io';
+
+import 'package:expect/async_helper.dart';
+import 'package:expect/expect.dart';
+
+void main(List<String> args) async {
+  var clientDone = false;
+  var serverDone = false;
+
+  asyncStart();
+  // Start the server which will accept a connection and then immediately
+  // shutdown itself and the incoming connection.
+  final server = await ServerSocket.bind(InternetAddress.loopbackIPv4, 0);
+  late final StreamSubscription serverSub;
+  serverSub = server.listen((socket) async {
+    socket.destroy();
+    serverSub.cancel();
+    server.close();
+    serverDone = true;
+  });
+
+  // Connect to the server and trigger a socket error by writing into a closed
+  // socket (because server shuts down immediately after accepting the
+  // connection).
+  final socket = await Socket.connect(
+    InternetAddress.loopbackIPv4,
+    server.port,
+  );
+  final clientSub = socket.listen(
+    (_) {},
+    onDone: () {
+      clientDone = true;
+    },
+    onError: (e) {},
+  );
+  socket.add([0]);
+  socket.flush().ignore(); // Ignore write error, otherwise it will be uncaught.
+
+  // Now repeat
+  await Future.delayed(Duration(milliseconds: 10));
+  for (var i = 0; i < 1000; i++) {
+    try {
+      socket.setOption(SocketOption.tcpNoDelay, true);
+    } on SocketException catch (e) {
+      // We expect SocketException.closed() but no other error.
+      if (e.message != SocketException.closed().message) {
+        rethrow;
+      }
+    }
+
+    await Future.delayed(Duration(milliseconds: 1));
+  }
+  Expect.isTrue(clientDone);
+  Expect.isTrue(serverDone);
+  socket.destroy();
+  asyncEnd();
+}