child_process: null channel handle on close

`HandleWrap::OnClose` destroys the underlying C++ object and null's the
internal field pointer to it. Therefore there should be no references to
the wrapping JavaScript object.

`null` the process' `_channel` field right after closing it, to ensure
no crashes will happen.

Fix: #2847
PR-URL: #3041
Reviewed-By: Trevor Norris <trev.norris@gmail.com>

Author: indutny

lib/internal/child_process.js

@@ -449,6 +449,7 @@ function setupChannel(target, channel) {
       target.disconnect();
       channel.onread = nop;
       channel.close();
+      target._channel = null;
       maybeClose(target);
     }
   };

test/parallel/test-child-process-fork-regr-gh-2847.js

@@ -0,0 +1,40 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+
+const cluster = require('cluster');
+const net = require('net');
+const util = require('util');
+
+if (!cluster.isMaster) {
+  // Exit on first received handle to leave the queue non-empty in master
+  process.on('message', function() {
+    process.exit(1);
+  });
+  return;
+}
+
+var server = net.createServer(function(s) {
+  setTimeout(function() {
+    s.destroy();
+  }, 100);
+}).listen(common.PORT, function() {
+  var worker = cluster.fork();
+
+  function send(callback) {
+    var s = net.connect(common.PORT, function() {
+      worker.send({}, s, callback);
+    });
+  }
+
+  worker.process.once('close', common.mustCall(function() {
+    // Otherwise the crash on `_channel.fd` access may happen
+    assert(worker.process._channel === null);
+    server.close();
+  }));
+
+  // Queue up several handles, to make `process.disconnect()` wait
+  for (var i = 0; i < 100; i++)
+    send();
+});