src: keep the first snapshot blob alive for later isolates

[codebytere]

V8 shares the read-only heap between isolates, so NewIsolate() creates every isolate from the snapshot blob that the first isolate in the process used. It did that by stashing a pointer to the first CreateParams in a function static (the comment next to it already said "this isn't really memory-safe"). When the first blob came from an EmbedderSnapshotData the embedder has since released, which is the natural thing to do after tearing down a CommonEnvironmentSetup created with CreateFromSnapshot(), the next NewIsolate() hands V8 freed memory and Snapshot::Initialize() reads from it. It happens to work on glibc because the pages are still intact; ASAN reports the use-after-free.

NewIsolate() now records the first blob and external references under a mutex instead of keeping the caller's CreateParams, and ~SnapshotData() leaves that one blob allocated, since its owner can go away before the last isolate is created. Nothing is copied and node itself is unaffected (its snapshot already lives until TearDownOncePerProcess()). node.h now says that snapshot_data has to outlive the setup and that every setup in a process has to use the same snapshot. embedtest gets an --embedder-run-twice switch to exercise two instances in one process.

Tests: test/embedding/test-embedding-snapshot-twice.js runs a snapshot twice in one embedtest process, freeing the EmbedderSnapshotData in between; heap-use-after-free in v8::internal::Snapshot::Initialize under ASAN before, clean after. The rest of test/embedding passes.

Refs: #45885

---

Disclosure: the code, test and this description were written by Claude Code, directed and reviewed by @codebytere.

[nodejs-github-bot]

Review requested:

• @nodejs/startup

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76953/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.06%. Comparing base (2befec5) to head (654a6cf).
⚠️ Report is 61 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65779      +/-   ##
==========================================
+ Coverage   89.99%   90.06%   +0.06%     
==========================================
  Files         757      769      +12     
  Lines      257739   261413    +3674     
  Branches    48881    49632     +751     
==========================================
+ Hits       231961   235431    +3470     
- Misses      16861    17022     +161     
- Partials     8917     8960      +43     

Files with missing lines	Coverage Δ
src/api/environment.cc	78.93% <100.00%> (+0.37%)	⬆️
src/node.h	91.66% <ø> (ø)
src/node_internals.h	80.35% <ø> (ø)
src/node_snapshotable.cc	73.55% <100.00%> (+0.02%)	⬆️

... and 82 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76978/