src: keep the first snapshot blob alive for later isolates

[codebytere]

An embedder that creates a CommonEnvironmentSetup from an EmbedderSnapshotData, tears it down, releases the snapshot data and later creates a second setup hands V8 freed memory: the second isolate is deserialized from the first, already-freed blob. It happens to work with glibc because the pages are usually still intact; ASAN reports a heap-use-after-free in v8::internal::Snapshot::Initialize.

V8 shares the read-only heap between isolates, so NewIsolate() creates every isolate from the snapshot blob the first isolate in the process used. It did that by keeping a pointer to the first caller's CreateParams in a function-local static (the comment next to it already said "this isn't really memory-safe"), and nothing kept the blob those params point at alive.

NewIsolate() now records the first blob and its external references under a mutex instead of the caller's CreateParams, and ~SnapshotData() leaves that one blob allocated, since its owner can go away before the last isolate is created. Nothing is copied, and node itself is unaffected because its snapshot already lives until TearDownOncePerProcess(). node.h now says that snapshot_data has to outlive the setup and that every setup in a process has to use the same snapshot.

Tests:

• test/embedding/test-embedding-snapshot-twice.js runs a snapshot twice in one embedtest process (new --embedder-run-twice switch), freeing the EmbedderSnapshotData in between; heap-use-after-free under ASAN before the change, clean after.
• The rest of test/embedding passes.

Refs: #45885

---

Disclosure: the code, test and this description were written by Claude Code, directed and reviewed by @codebytere.

[nodejs-github-bot]

Review requested:

• @nodejs/startup

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76953/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.06%. Comparing base (2befec5) to head (654a6cf).
⚠️ Report is 77 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65779      +/-   ##
==========================================
+ Coverage   89.99%   90.06%   +0.06%     
==========================================
  Files         757      769      +12     
  Lines      257739   261413    +3674     
  Branches    48881    49632     +751     
==========================================
+ Hits       231961   235431    +3470     
- Misses      16861    17022     +161     
- Partials     8917     8960      +43     

Files with missing lines	Coverage Δ
src/api/environment.cc	78.93% <100.00%> (+0.37%)	⬆️
src/node.h	91.66% <ø> (ø)
src/node_internals.h	80.35% <ø> (ø)
src/node_snapshotable.cc	73.55% <100.00%> (+0.02%)	⬆️

... and 82 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76978/