Sitelet https://github.com/nodejs/node/issues/40832#issuecomment-1202997527
Skip to content

snapshot cause EXC_BAD_ACCESS #40832

Closed
Closed
snapshot cause EXC_BAD_ACCESS#40832
Labels
buildIssues and PRs related to Node.js builds or CI infrastructure.macosIssues and PRs related to the macOS platform.snapshotIssues and PRs related to the startup snapshot.

Description

@caijw
caijw
opened on Nov 17, 2021

Version

v18.0.0-pre

Platform

Darwin MY-MC0 19.5.0 Darwin Kernel Version 19.5.0: Thu Apr 30 18:25:59 PDT 2020; root:xnu-6153.121.1~7/RELEASE_X86_64 x86_64

Subsystem

No response

What steps will reproduce the bug?

Nodejs loads a specific snapshot, and causes a memory error EXC_BAD_ACCESS.
This happens on Macos platform and Linux platform.

➜  node git:(snapshot-user) ✗ lldb --  ./out/Debug/node --snapshot-blob ./example/snapshot.blob
(lldb) target create "./out/Debug/node"
Current executable set to '/Users/jingweicai/dev/node/out/Debug/node' (x86_64).
(lldb) settings set -- target.run-args  "--snapshot-blob" "./example/snapshot.blob"
(lldb) r
Process 6097 launched: '/Users/jingweicai/dev/node/out/Debug/node' (x86_64)
node was compiled with optimization - stepping may behave oddly; variables may not be available.
Process 6097 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
    frame #0: 0x000000010108c578 node`v8::internal::Serializer::SerializeObject(v8::internal::Handle<v8::internal::HeapObject>) [inlined] short std::__1::__cxx_atomic_load<short>(__a=<unavailable>, __order=memory_order_relaxed) at atomic:964:12 [opt]
   961 	_LIBCPP_INLINE_VISIBILITY
   962 	_Tp __cxx_atomic_load(__cxx_atomic_base_impl<_Tp> const volatile* __a, memory_order __order) _NOEXCEPT {
   963 	    using __ptr_type = typename remove_const<decltype(__a->__a_value)>::type*;
-> 964 	    return __c11_atomic_load(const_cast<__ptr_type>(&__a->__a_value), static_cast<__memory_order_underlying_t>(__order));
   965 	}
   966 	template<class _Tp>
   967 	_LIBCPP_INLINE_VISIBILITY
Target 0: (node) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
  * frame #0: 0x000000010108c578 node`v8::internal::Serializer::SerializeObject(v8::internal::Handle<v8::internal::HeapObject>) [inlined] short std::__1::__cxx_atomic_load<short>(__a=<unavailable>, __order=memory_order_relaxed) at atomic:964:12 [opt]
    frame #1: 0x000000010108c578 node`v8::internal::Serializer::SerializeObject(v8::internal::Handle<v8::internal::HeapObject>) [inlined] std::__1::__atomic_base<short, false>::load(this=<unavailable>, __m=memory_order_relaxed) const volatile at atomic:1483 [opt]
    frame #2: 0x000000010108c578 node`v8::internal::Serializer::SerializeObject(v8::internal::Handle<v8::internal::HeapObject>) [inlined] short std::__1::atomic_load_explicit<short>(__o=<unavailable>, __m=memory_order_relaxed) at atomic:1819 [opt]
    frame #3: 0x000000010108c578 node`v8::internal::Serializer::SerializeObject(v8::internal::Handle<v8::internal::HeapObject>) [inlined] v8::base::Relaxed_Load(ptr=<unavailable>) at atomicops.h:225 [opt]
    frame #4: 0x000000010108c578 node`v8::internal::Serializer::SerializeObject(v8::internal::Handle<v8::internal::HeapObject>) [inlined] v8::internal::Map::instance_type(this=<unavailable>) const at map-inl.h:343 [opt]
    frame #5: 0x000000010108c578 node`v8::internal::Serializer::SerializeObject(v8::internal::Handle<v8::internal::HeapObject>) [inlined] v8::internal::HeapObject::IsString(this=<unavailable>) const at instance-type-inl.h:79 [opt]
    frame #6: 0x000000010108c574 node`v8::internal::Serializer::SerializeObject(v8::internal::Handle<v8::internal::HeapObject>) [inlined] v8::internal::HeapObject::IsThinString(this=<unavailable>) const at objects-inl.h:196 [opt]
    frame #7: 0x000000010108c574 node`v8::internal::Serializer::SerializeObject(this=0x00007ffeefbfce60, obj=Handle<v8::internal::HeapObject> @ r12) at serializer.cc:122 [opt]
    frame #8: 0x0000000101092038 node`v8::internal::Serializer::ObjectSerializer::VisitPointers(this=<unavailable>, host=<unavailable>, start=<unavailable>, end=<unavailable>) at serializer.cc:882:20 [opt]
    frame #9: 0x0000000101090eb2 node`v8::internal::Serializer::ObjectSerializer::SerializeContent(this=0x00007ffeefbfc6d0, map=Map @ r15, size=952) at serializer.cc:809:14 [opt]
    frame #10: 0x000000010108fc00 node`v8::internal::Serializer::ObjectSerializer::SerializeObject(this=0x00007ffeefbfc6d0) at serializer.cc:780:3 [opt]
    frame #11: 0x0000000101090c49 node`v8::internal::Serializer::ObjectSerializer::Serialize(this=0x00007ffeefbfc6d0) at serializer.cc:712:3 [opt]
    frame #12: 0x000000010105f46b node`v8::internal::CodeSerializer::SerializeObjectImpl(v8::internal::Handle<v8::internal::HeapObject>) [inlined] v8::internal::CodeSerializer::SerializeGeneric(this=<unavailable>, heap_object=<unavailable>) at code-serializer.cc:231:14 [opt]
    frame #13: 0x000000010105f421 node`v8::internal::CodeSerializer::SerializeObjectImpl(this=<unavailable>, obj=Handle<v8::internal::HeapObject> @ r13) at code-serializer.cc:225 [opt]
    frame #14: 0x0000000101092038 node`v8::internal::Serializer::ObjectSerializer::VisitPointers(this=<unavailable>, host=<unavailable>, start=<unavailable>, end=<unavailable>) at serializer.cc:882:20 [opt]
    frame #15: 0x0000000101090eb2 node`v8::internal::Serializer::ObjectSerializer::SerializeContent(this=0x00007ffeefbfc8b0, map=Map @ r15, size=688) at serializer.cc:809:14 [opt]
    frame #16: 0x000000010108fc00 node`v8::internal::Serializer::ObjectSerializer::SerializeObject(this=0x00007ffeefbfc8b0) at serializer.cc:780:3 [opt]
    frame #17: 0x0000000101090c49 node`v8::internal::Serializer::ObjectSerializer::Serialize(this=0x00007ffeefbfc8b0) at serializer.cc:712:3 [opt]
    frame #18: 0x000000010105f46b node`v8::internal::CodeSerializer::SerializeObjectImpl(v8::internal::Handle<v8::internal::HeapObject>) [inlined] v8::internal::CodeSerializer::SerializeGeneric(this=<unavailable>, heap_object=<unavailable>) at code-serializer.cc:231:14 [opt]
    frame #19: 0x000000010105f421 node`v8::internal::CodeSerializer::SerializeObjectImpl(this=<unavailable>, obj=Handle<v8::internal::HeapObject> @ r13) at code-serializer.cc:225 [opt]
    frame #20: 0x0000000101092038 node`v8::internal::Serializer::ObjectSerializer::VisitPointers(this=<unavailable>, host=<unavailable>, start=<unavailable>, end=<unavailable>) at serializer.cc:882:20 [opt]
    frame #21: 0x0000000100e2e293 node`void v8::internal::BodyDescriptorApply<v8::internal::CallIterateBody, void, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*>(v8::internal::InstanceType, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*) [inlined] void v8::internal::BodyDescriptorBase::IteratePointer<v8::internal::ObjectVisitor>(obj=HeapObject @ r15, offset=16, v=0x00007ffeefbfcad0) at objects-body-descriptors-inl.h:118:6 [opt]
    frame #22: 0x0000000100e2e277 node`void v8::internal::BodyDescriptorApply<v8::internal::CallIterateBody, void, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*>(v8::internal::InstanceType, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*) [inlined] void v8::internal::BytecodeArray::BodyDescriptor::IterateBody<v8::internal::ObjectVisitor>(map=<unavailable>, obj=HeapObject @ r15, object_size=<unavailable>, v=0x00007ffeefbfcad0) at objects-body-descriptors-inl.h:480 [opt]
    frame #23: 0x0000000100e2e277 node`void v8::internal::BodyDescriptorApply<v8::internal::CallIterateBody, void, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*>(v8::internal::InstanceType, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*) [inlined] void v8::internal::CallIterateBody::apply<v8::internal::BytecodeArray::BodyDescriptor, v8::internal::ObjectVisitor>(map=<unavailable>, obj=HeapObject @ r15, object_size=<unavailable>, v=0x00007ffeefbfcad0) at objects-body-descriptors-inl.h:1269 [opt]
    frame #24: 0x0000000100e2e277 node`void v8::internal::BodyDescriptorApply<v8::internal::CallIterateBody, void, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*>(type=<unavailable>, p1=<unavailable>, p2=HeapObject @ r15, p3=832, p4=0x00007ffeefbfcad0) at objects-body-descriptors-inl.h:1181 [opt]
    frame #25: 0x0000000101090eb2 node`v8::internal::Serializer::ObjectSerializer::SerializeContent(this=0x00007ffeefbfcad0, map=Map @ r15, size=832) at serializer.cc:809:14 [opt]
    frame #26: 0x000000010108fc00 node`v8::internal::Serializer::ObjectSerializer::SerializeObject(this=0x00007ffeefbfcad0) at serializer.cc:780:3 [opt]
    frame #27: 0x0000000101090c49 node`v8::internal::Serializer::ObjectSerializer::Serialize(this=0x00007ffeefbfcad0) at serializer.cc:712:3 [opt]
    frame #28: 0x000000010105f46b node`v8::internal::CodeSerializer::SerializeObjectImpl(v8::internal::Handle<v8::internal::HeapObject>) [inlined] v8::internal::CodeSerializer::SerializeGeneric(this=<unavailable>, heap_object=<unavailable>) at code-serializer.cc:231:14 [opt]
    frame #29: 0x000000010105f421 node`v8::internal::CodeSerializer::SerializeObjectImpl(this=<unavailable>, obj=Handle<v8::internal::HeapObject> @ r13) at code-serializer.cc:225 [opt]
    frame #30: 0x0000000101092038 node`v8::internal::Serializer::ObjectSerializer::VisitPointers(this=<unavailable>, host=<unavailable>, start=<unavailable>, end=<unavailable>) at serializer.cc:882:20 [opt]
    frame #31: 0x0000000100e2e317 node`void v8::internal::BodyDescriptorApply<v8::internal::CallIterateBody, void, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*>(v8::internal::InstanceType, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*) [inlined] void v8::internal::BodyDescriptorBase::IterateCustomWeakPointer<v8::internal::ObjectVisitor>(obj=HeapObject @ r15, offset=8, v=0x00007ffeefbfccf0) at objects-body-descriptors-inl.h:155:6 [opt]
    frame #32: 0x0000000100e2e2fb node`void v8::internal::BodyDescriptorApply<v8::internal::CallIterateBody, void, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*>(v8::internal::InstanceType, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*) [inlined] void v8::internal::SharedFunctionInfo::BodyDescriptor::IterateBody<v8::internal::ObjectVisitor>(map=<unavailable>, obj=HeapObject @ r15, object_size=<unavailable>, v=0x00007ffeefbfccf0) at objects-body-descriptors-inl.inc:87 [opt]
    frame #33: 0x0000000100e2e2fb node`void v8::internal::BodyDescriptorApply<v8::internal::CallIterateBody, void, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*>(v8::internal::InstanceType, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*) [inlined] void v8::internal::CallIterateBody::apply<v8::internal::SharedFunctionInfo::BodyDescriptor, v8::internal::ObjectVisitor>(map=<unavailable>, obj=HeapObject @ r15, object_size=<unavailable>, v=0x00007ffeefbfccf0) at objects-body-descriptors-inl.h:1269 [opt]
    frame #34: 0x0000000100e2e2fb node`void v8::internal::BodyDescriptorApply<v8::internal::CallIterateBody, void, v8::internal::Map, v8::internal::HeapObject, int, v8::internal::ObjectVisitor*>(type=<unavailable>, p1=<unavailable>, p2=HeapObject @ r15, p3=64, p4=0x00007ffeefbfccf0) at objects-body-descriptors-inl.h:1243 [opt]
    frame #35: 0x0000000101090eb2 node`v8::internal::Serializer::ObjectSerializer::SerializeContent(this=0x00007ffeefbfccf0, map=Map @ r15, size=64) at serializer.cc:809:14 [opt]
    frame #36: 0x000000010108fc00 node`v8::internal::Serializer::ObjectSerializer::SerializeObject(this=0x00007ffeefbfccf0) at serializer.cc:780:3 [opt]
    frame #37: 0x0000000101090c49 node`v8::internal::Serializer::ObjectSerializer::Serialize(this=0x00007ffeefbfccf0) at serializer.cc:712:3 [opt]
    frame #38: 0x000000010105f565 node`v8::internal::CodeSerializer::SerializeObjectImpl(v8::internal::Handle<v8::internal::HeapObject>) [inlined] v8::internal::CodeSerializer::SerializeGeneric(this=<unavailable>, heap_object=Handle<v8::internal::HeapObject> @ r13) at code-serializer.cc:231:14 [opt]
    frame #39: 0x000000010105f51b node`v8::internal::CodeSerializer::SerializeObjectImpl(this=<unavailable>, obj=Handle<v8::internal::HeapObject> @ r13) at code-serializer.cc:192 [opt]
    frame #40: 0x000000010108c78b node`v8::internal::Serializer::VisitRootPointers(v8::internal::Root, char const*, v8::internal::FullObjectSlot, v8::internal::FullObjectSlot) [inlined] v8::internal::Serializer::SerializeRootObject(this=0x00007ffeefbfce60, slot=FullObjectSlot @ rbx) at serializer.cc:150:5 [opt]
    frame #41: 0x000000010108c77a node`v8::internal::Serializer::VisitRootPointers(this=0x00007ffeefbfce60, root=<unavailable>, description=<unavailable>, start=<unavailable>, end=FullObjectSlot @ r14) at serializer.cc:141 [opt]
    frame #42: 0x000000010105eba5 node`v8::internal::CodeSerializer::SerializeSharedFunctionInfo(this=0x00007ffeefbfce60, info=Handle<v8::internal::SharedFunctionInfo> @ r15) at code-serializer.cc:102:3 [opt]
    frame #43: 0x000000010105e8c5 node`v8::internal::CodeSerializer::Serialize(info=<unavailable>) at code-serializer.cc:81:39 [opt]
    frame #44: 0x00000001006bacb0 node`v8::ScriptCompiler::CreateCodeCacheForFunction(function=<unavailable>) at api.cc:2791:10 [opt]
    frame #45: 0x00000001002c6531 node`node::native_module::NativeModuleLoader::LookupAndCompile(this=0x000000010477a380, context=(val_ = 0x00000001090e0080), id="internal/modules/esm/translators", parameters=0x00007ffeefbfd440 size=6, result=0x00007ffeefbfd514) at node_native_module.cc:306:7
    frame #46: 0x00000001002c603b node`node::native_module::NativeModuleLoader::CompileAsModule(this=0x000000010477a380, context=(val_ = 0x00000001090e0080), id="internal/modules/esm/translators", result=0x00007ffeefbfd514) at node_native_module.cc:187:10
    frame #47: 0x00000001002d1643 node`node::native_module::NativeModuleEnv::CompileFunction(args=0x00007ffeefbfd9c0) at node_native_module_env.cc:140:42
    frame #48: 0x0000000100780bdb node`v8::internal::FunctionCallbackArguments::Call(this=0x00007ffeefbfda28, handler=CallHandlerInfo @ 0x00007ffeefbfd9e0) at api-arguments-inl.h:152:3 [opt]
    frame #49: 0x000000010077f4b4 node`v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(isolate=<unavailable>, function=Handle<v8::internal::HeapObject> @ 0x00007ffeefbfdaa0, new_target=Handle<v8::internal::HeapObject> @ 0x00007ffeefbfda98, fun_data=<unavailable>, receiver=<unavailable>, args=BuiltinArguments @ 0x00007ffeefbfdae0) at builtins-api.cc:112:36 [opt]
    frame #50: 0x000000010077d8b2 node`v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) at builtins-api.cc:142:5 [opt]
    frame #51: 0x000000010077d72a node`v8::internal::Builtin_HandleApiCall(args_length=<unavailable>, args_object=<unavailable>, isolate=0x00000001100b0000) at builtins-api.cc:130 [opt]
    frame #52: 0x0000000101568ef9 node`Builtins_CEntry_Return1_DontSaveFPRegs_ArgvOnStack_BuiltinExit + 57
    frame #53: 0x00000001014e9e0e node`Builtins_InterpreterEntryTrampoline + 206
    frame #54: 0x00000001014e9e0e node`Builtins_InterpreterEntryTrampoline + 206
    frame #55: 0x00000001014e9e0e node`Builtins_InterpreterEntryTrampoline + 206
    frame #56: 0x00000001014e9e0e node`Builtins_InterpreterEntryTrampoline + 206
    frame #57: 0x00000001014e9e0e node`Builtins_InterpreterEntryTrampoline + 206
    frame #58: 0x00000001014e9e0e node`Builtins_InterpreterEntryTrampoline + 206
    frame #59: 0x00000001014e9e0e node`Builtins_InterpreterEntryTrampoline + 206
    frame #60: 0x00000001014e9e0e node`Builtins_InterpreterEntryTrampoline + 206
    frame #61: 0x00000001014e9e0e node`Builtins_InterpreterEntryTrampoline + 206
    frame #62: 0x00000001014e9e0e node`Builtins_InterpreterEntryTrampoline + 206
    frame #63: 0x00000001014e9e0e node`Builtins_InterpreterEntryTrampoline + 206
    frame #64: 0x00000001014e9e0e node`Builtins_InterpreterEntryTrampoline + 206
    frame #65: 0x00000001014e791b node`Builtins_JSEntryTrampoline + 91
    frame #66: 0x00000001014e7643 node`Builtins_JSEntry + 131
    frame #67: 0x0000000100905db7 node`v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) [inlined] v8::internal::GeneratedCode<unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, long, unsigned long**>::Call(this=<unavailable>, args=<unavailable>, args=<unavailable>, args=<unavailable>, args=<unavailable>, args=<unavailable>, args=<unavailable>) at simulator.h:152:12 [opt]
    frame #68: 0x0000000100905db5 node`v8::internal::(anonymous namespace)::Invoke(isolate=0x00000001100b0000, params=0x00007ffeefbfe528)::InvokeParams const&) at execution.cc:375 [opt]
    frame #69: 0x0000000100904f7b node`v8::internal::Execution::Call(isolate=0x00000001100b0000, callable=<unavailable>, receiver=<unavailable>, argc=5, argv=0x000000010885b940) at execution.cc:470:10 [opt]
    frame #70: 0x00000001006d4ee3 node`v8::Function::Call(this=0x0000000109095840, context=<unavailable>, recv=(val_ = 0x00000001100b0170), argc=5, argv=<unavailable>) at api.cc:5157:7 [opt]
    frame #71: 0x0000000100151973 node`node::ExecuteBootstrapper(env=0x0000000109097800, id="internal/main/repl", parameters=0x00007ffeefbfe7f8 size=5, arguments=0x00007ffeefbfe7d0 size=5) at node.cc:185:34
    frame #72: 0x0000000100153a7a node`node::StartExecution(env=0x0000000109097800, main_script_id="internal/main/repl") at node.cc:452:7
    frame #73: 0x0000000100153727 node`node::StartExecution(env=0x0000000109097800, cb=node::StartExecutionCallback @ 0x00007ffeefbfea10)>) at node.cc:516:12
    frame #74: 0x000000010000f785 node`node::LoadEnvironment(env=0x0000000109097800, cb=node::StartExecutionCallback @ 0x00007ffeefbfeab0)>) at environment.cc:409:10
    frame #75: 0x0000000100296a79 node`node::NodeMainInstance::Run(this=0x00007ffeefbfebe0, exit_code=0x00007ffeefbfeb2c, env=0x0000000109097800) at node_main_instance.cc:144:5
    frame #76: 0x0000000100296339 node`node::NodeMainInstance::Run(this=0x00007ffeefbfebe0, env_info=0x00007ffeefbfed28) at node_main_instance.cc:138:3
    frame #77: 0x000000010015672e node`node::Start(argc=3, argv=0x00007ffeefbff018) at node.cc:1205:38
    frame #78: 0x0000000101a3d19e node`main(argc=3, argv=0x00007ffeefbff018) at node_main.cc:127:10
    frame #79: 0x00007fff6e9bdcc9 libdyld.dylib`start + 1
    frame #80: 0x00007fff6e9bdcc9 libdyld.dylib`start + 1

How often does it reproduce? Is there a required condition?

I'm modifying nodejs to support loading third party snapshots.
This happens when you snapshot a javascjrpt file:

(function () {
  var re = /./;
  re.exec = function () {
    var result = [];
    result.groups = { a: '7' };
    return result;
  };
  ''.replace(re, '$<a>') !== '7';
  return ''.replace(re, '$<a>') !== '7';
})();

and loads the snapshot when nodejs bootstrap.
This also happens with the new feature user land snapshots.
I added a test case on the v8 and did not find this problem:

UNINITIALIZED_TEST(ModifyRegExp) {
  DisableAlwaysOpt();
  DisableEmbeddedBlobRefcounting();
  v8::StartupData blob;
  {
    v8::SnapshotCreator creator;
    v8::Isolate* isolate = creator.GetIsolate();
    {
      v8::HandleScope handle_scope(isolate);
      v8::Local<v8::Context> context = v8::Context::New(isolate);
      v8::Context::Scope context_scope(context);
      CompileRun("var f = function() { return 1; }");
      creator.SetDefaultContext(context);
    }
    {
      v8::HandleScope handle_scope(isolate);
      v8::Local<v8::Context> context = v8::Context::New(isolate);
      v8::Context::Scope context_scope(context);
      CompileRun("var f = function() { return 2; }");
      CompileRun(
        R"(
          (function () {
            var re = /./;
            re.exec = function () {
              var result = [];
              result.groups = { a: '7' };
              return result;
            };
            ''.replace(re, '$<a>') !== '7';
            return ''.replace(re, '$<a>') !== '7';
          })();
        )"
      );

      CHECK_EQ(0u, creator.AddContext(context));
    }
    {
      v8::HandleScope handle_scope(isolate);
      v8::Local<v8::Context> context = v8::Context::New(isolate);
      v8::Context::Scope context_scope(context);
      CHECK_EQ(1u, creator.AddContext(context));
    }
    blob =
        creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kKeep);
  }

  v8::Isolate::CreateParams params;
  params.snapshot_blob = &blob;
  params.array_buffer_allocator = CcTest::array_buffer_allocator();
  // Test-appropriate equivalent of v8::Isolate::New.
  v8::Isolate* isolate = TestSerializer::NewIsolate(params);
  {
    v8::Isolate::Scope isolate_scope(isolate);
    {
      v8::HandleScope handle_scope(isolate);
      v8::Local<v8::Context> context = v8::Context::New(isolate);
      v8::Context::Scope context_scope(context);
      ExpectInt32("f()", 1);
    }
    {
      v8::HandleScope handle_scope(isolate);
      v8::Local<v8::Context> context =
          v8::Context::FromSnapshot(isolate, 0).ToLocalChecked();
      v8::Context::Scope context_scope(context);
      ExpectInt32("f()", 2);
    }
    {
      v8::HandleScope handle_scope(isolate);
      v8::Local<v8::Context> context =
          v8::Context::FromSnapshot(isolate, 1).ToLocalChecked();
      v8::Context::Scope context_scope(context);
      ExpectUndefined("this.f");
    }
  }

  // int *ptr = nullptr;
  // ptr[1000] = 10;

  isolate->Dispose();
  delete[] blob.data;
  FreeCurrentEmbeddedBlob();
}

test case output:

➜  v8 git:(7bc8680c05) ✗  gm x64.debug  cctest/test-serialize/ModifyRegExp
# autoninja -C out/x64.debug cctest d8
ninja: Entering directory `out/x64.debug'
[3/3] LINK ./cctest
# "/usr/local/bin/python2" tools/run-tests.py --outdir=out/x64.debug cctest/test-serialize/ModifyRegExp 
Build found: /home/ubuntu/code/v8/v8/out/x64.debug
>>> Autodetected:
pointer_compression
pointer_compression_shared_cage
webassembly
>>> Running tests for x64.debug
>>> Running with test processors
[00:03|%   0|+   1|-   0]: Done                              
>>> 7187 base tests produced 1 (0%) non-filtered tests
>>> 1 tests ran
Done! - V8 compilation finished successfully.

It seems that this is an issue of nodejs.

What is the expected behavior?

No response

What do you see instead?

No response

Additional information

No response

Activity

  1. Mesteery
    added
    buildIssues and PRs related to Node.js builds or CI infrastructure.
    macosIssues and PRs related to the macOS platform.
    snapshotIssues and PRs related to the startup snapshot.
    on Nov 17, 2021

  2. targos commented on Nov 21, 2021

    @targos
    targos
    on Nov 21, 2021
    Member

    @joyeecheung

  3. caijw commented on Nov 22, 2021

    @caijw
    caijw
    on Nov 22, 2021
    Author

    #38905 (comment)
    #38905 (comment)

    Need to report a issue to v8.

  4. joyeecheung commented on Mar 28, 2022

    @joyeecheung
    joyeecheung
    on Mar 28, 2022
    Member

    This is tracked in V8 as https://bugs.chromium.org/p/v8/issues/detail?id=12718 - it appears that there is a mismatch when the snapshot is de/serialized, so a ScopeInfo gets corrupted (apart from that, some string in the constant pools of certain bytecodes are corrupted too) and caused the crash - I am currently tracing down where that mismatch is coming from (aside: #42466 still reproduces this error when the snippet is run to build into the embedded snapshot, so that rules out issues with FileIO)

  5. joyeecheung commented on Jun 10, 2022

    @joyeecheung
    joyeecheung
    on Jun 10, 2022
    Member

    FYI I've confirmed that https://chromium-review.googlesource.com/c/v8/v8/+/3616553 can fix this though I reverted it soon after landing it due to another memory corruption that seems to be only reproducible with chromium (which I am trying to fix..).

  6. goloveychuk commented on Jun 14, 2022

    @goloveychuk
    goloveychuk
    on Jun 14, 2022

    I've applied your fix as patch to current master and confirming that it's fixed segfault with above trace.
    But I've found that when I run my script, sometimes (30%) of the time I have
    [1] 45882 bus error ./node ./test.js
    Before the patch I had either bus or segfault, mostly segfault.
    Here are the traces:

    (lldb) run
Process 46281 launched: '/Users/vadymh/github/node/node_g' (x86_64)
{ migrate: [Getter] }
Process 46281 exited with status = 0 (0x00000000)
(lldb) run
Process 47117 launched: '/Users/vadymh/github/node/node_g' (x86_64)
Process 47117 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=2, address=0x11740d909)
    frame #0: 0x000000010197ed8b node_g`long std::__1::__libcpp_atomic_refcount_increment<long>(__t=0x000000011740d909) at shared_ptr.h:110:12
   107 	__libcpp_atomic_refcount_increment(_Tp& __t) _NOEXCEPT
   108 	{
   109 	#if defined(_LIBCPP_HAS_BUILTIN_ATOMIC_SUPPORT) && !defined(_LIBCPP_HAS_NO_THREADS)
-> 110 	    return __atomic_add_fetch(&__t, 1, __ATOMIC_RELAXED);
   111 	#else
   112 	    return __t += 1;
   113 	#endif
Target 0: (node_g) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=2, address=0x11740d909)
  * frame #0: 0x000000010197ed8b node_g`long std::__1::__libcpp_atomic_refcount_increment<long>(__t=0x000000011740d909) at shared_ptr.h:110:12
    frame #1: 0x000000010197ed69 node_g`std::__1::__shared_count::__add_shared(this=0x000000011740d901) at shared_ptr.h:172:7
    frame #2: 0x000000010197ed45 node_g`std::__1::__shared_weak_count::__add_shared(this=0x000000011740d901) at shared_ptr.h:211:23
    frame #3: 0x000000010197ed26 node_g`std::__1::shared_ptr<v8::internal::BackingStore>::shared_ptr(this=0x00007ff7bfef14b0, __r=std::__1::shared_ptr<v8::internal::BackingStore>::element_type @ 0x000008c5ea7cfc31 strong=2954361393226499127 weak=7566047411653886996) at shared_ptr.h:850:19
    frame #4: 0x0000000101966abd node_g`std::__1::shared_ptr<v8::internal::BackingStore>::shared_ptr(this=0x00007ff7bfef14b0, __r=std::__1::shared_ptr<v8::internal::BackingStore>::element_type @ 0x000008c5ea7cfc31 strong=2954361393226499127 weak=7566047411653886996) at shared_ptr.h:848:1
    frame #5: 0x000000010196f7fa node_g`v8::internal::Deserializer<v8::internal::Isolate>::PostProcessNewJSReceiver(this=0x00007ff7bfefe5d0, map=Map @ 0x00007ff7bfef1568, obj=Handle<v8::internal::JSReceiver> @ 0x00007ff7bfef1560, raw_obj=JSReceiver @ 0x00007ff7bfef1558, instance_type=JS_TYPED_ARRAY_TYPE, space=kOld) at deserializer.cc:438:28
    frame #6: 0x000000010196ece9 node_g`v8::internal::Deserializer<v8::internal::Isolate>::PostProcessNewObject(this=0x00007ff7bfefe5d0, map=Handle<v8::internal::Map> @ 0x00007ff7bfef17b8, obj=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef17b0, space=kOld) at deserializer.cc:557:12
    frame #7: 0x0000000101965efa node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:710:3
    frame #8: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef1de8) at deserializer.cc:938:40
    frame #9: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef1e58, start_slot_index=1, end_slot_index=40) at deserializer.cc:908:16
    frame #10: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #11: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef2488) at deserializer.cc:938:40
    frame #12: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef24f8, start_slot_index=1, end_slot_index=6) at deserializer.cc:908:16
    frame #13: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #14: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef2b28) at deserializer.cc:938:40
    frame #15: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef2b98, start_slot_index=1, end_slot_index=8) at deserializer.cc:908:16
    frame #16: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #17: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef31c8) at deserializer.cc:938:40
    frame #18: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef3238, start_slot_index=1, end_slot_index=52) at deserializer.cc:908:16
    frame #19: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #20: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef3868) at deserializer.cc:938:40
    frame #21: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef38d8, start_slot_index=1, end_slot_index=8) at deserializer.cc:908:16
    frame #22: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #23: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef3f08) at deserializer.cc:938:40
    frame #24: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef3f78, start_slot_index=1, end_slot_index=7) at deserializer.cc:908:16
    frame #25: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #26: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef45a8) at deserializer.cc:938:40
    frame #27: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef4618, start_slot_index=1, end_slot_index=4) at deserializer.cc:908:16
    frame #28: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #29: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef4c48) at deserializer.cc:938:40
    frame #30: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef4cb8, start_slot_index=1, end_slot_index=6) at deserializer.cc:908:16
    frame #31: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #32: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef52e8) at deserializer.cc:938:40
    frame #33: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef5358, start_slot_index=1, end_slot_index=8) at deserializer.cc:908:16
    frame #34: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #35: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef5988) at deserializer.cc:938:40
    frame #36: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef59f8, start_slot_index=1, end_slot_index=1766) at deserializer.cc:908:16
    frame #37: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #38: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef6028) at deserializer.cc:938:40
    frame #39: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef6098, start_slot_index=1, end_slot_index=5) at deserializer.cc:908:16
    frame #40: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #41: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef66c8) at deserializer.cc:938:40
    frame #42: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef6738, start_slot_index=1, end_slot_index=5) at deserializer.cc:908:16
    frame #43: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #44: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef6d68) at deserializer.cc:938:40
    frame #45: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef6dd8, start_slot_index=1, end_slot_index=7) at deserializer.cc:908:16
    frame #46: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #47: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef7408) at deserializer.cc:938:40
    frame #48: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef7478, start_slot_index=1, end_slot_index=3) at deserializer.cc:908:16
    frame #49: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #50: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef7aa8) at deserializer.cc:938:40
    frame #51: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef7b18, start_slot_index=1, end_slot_index=1101) at deserializer.cc:908:16
    frame #52: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #53: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef8148) at deserializer.cc:938:40
    frame #54: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef81b8, start_slot_index=1, end_slot_index=9) at deserializer.cc:908:16
    frame #55: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kMap) at deserializer.cc:709:3
    frame #56: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x03', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef87e8) at deserializer.cc:938:40
    frame #57: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef8858, start_slot_index=1, end_slot_index=8) at deserializer.cc:908:16
    frame #58: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #59: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef8e88) at deserializer.cc:938:40
    frame #60: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef8ef8, start_slot_index=1, end_slot_index=9) at deserializer.cc:908:16
    frame #61: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kMap) at deserializer.cc:709:3
    frame #62: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x03', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef9528) at deserializer.cc:938:40
    frame #63: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef9598, start_slot_index=1, end_slot_index=7) at deserializer.cc:908:16
    frame #64: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #65: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfef9bc8) at deserializer.cc:938:40
    frame #66: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfef9c38, start_slot_index=1, end_slot_index=9) at deserializer.cc:908:16
    frame #67: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kMap) at deserializer.cc:709:3
    frame #68: 0x0000000101966e0f node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHandle<v8::internal::Isolate> >(this=0x00007ff7bfefe5d0, data='\x03', slot_accessor=SlotAccessorForHandle<v8::internal::Isolate> @ 0x00007ff7bfefa268) at deserializer.cc:938:40
    frame #69: 0x0000000101966d2d node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0) at deserializer.cc:601:3
    frame #70: 0x000000010196594c node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:631:39
    frame #71: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfefa8f8) at deserializer.cc:938:40
    frame #72: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfefa968, start_slot_index=1, end_slot_index=9) at deserializer.cc:908:16
    frame #73: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kMap) at deserializer.cc:709:3
    frame #74: 0x0000000101966e0f node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHandle<v8::internal::Isolate> >(this=0x00007ff7bfefe5d0, data='\x03', slot_accessor=SlotAccessorForHandle<v8::internal::Isolate> @ 0x00007ff7bfefaf98) at deserializer.cc:938:40
    frame #75: 0x0000000101966d2d node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0) at deserializer.cc:601:3
    frame #76: 0x000000010196594c node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:631:39
    frame #77: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfefb628) at deserializer.cc:938:40
    frame #78: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfefb698, start_slot_index=1, end_slot_index=9) at deserializer.cc:908:16
    frame #79: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kMap) at deserializer.cc:709:3
    frame #80: 0x0000000101966e0f node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHandle<v8::internal::Isolate> >(this=0x00007ff7bfefe5d0, data='\x03', slot_accessor=SlotAccessorForHandle<v8::internal::Isolate> @ 0x00007ff7bfefbcc8) at deserializer.cc:938:40
    frame #81: 0x0000000101966d2d node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0) at deserializer.cc:601:3
    frame #82: 0x000000010196594c node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:631:39
    frame #83: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfefc358) at deserializer.cc:938:40
    frame #84: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfefc3c8, start_slot_index=1, end_slot_index=9) at deserializer.cc:908:16
    frame #85: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kMap) at deserializer.cc:709:3
    frame #86: 0x0000000101966e0f node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHandle<v8::internal::Isolate> >(this=0x00007ff7bfefe5d0, data='\x03', slot_accessor=SlotAccessorForHandle<v8::internal::Isolate> @ 0x00007ff7bfefc9f8) at deserializer.cc:938:40
    frame #87: 0x0000000101966d2d node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0) at deserializer.cc:601:3
    frame #88: 0x000000010196594c node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:631:39
    frame #89: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfefd088) at deserializer.cc:938:40
    frame #90: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfefd0f8, start_slot_index=1, end_slot_index=9) at deserializer.cc:908:16
    frame #91: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kMap) at deserializer.cc:709:3
    frame #92: 0x0000000101966e0f node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHandle<v8::internal::Isolate> >(this=0x00007ff7bfefe5d0, data='\x03', slot_accessor=SlotAccessorForHandle<v8::internal::Isolate> @ 0x00007ff7bfefd728) at deserializer.cc:938:40
    frame #93: 0x0000000101966d2d node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0) at deserializer.cc:601:3
    frame #94: 0x000000010196594c node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:631:39
    frame #95: 0x00000001019696ce node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHeapObject>(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHeapObject @ 0x00007ff7bfefddb8) at deserializer.cc:938:40
    frame #96: 0x00000001019695ea node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadData(this=0x00007ff7bfefe5d0, object=Handle<v8::internal::HeapObject> @ 0x00007ff7bfefde28, start_slot_index=1, end_slot_index=274) at deserializer.cc:908:16
    frame #97: 0x0000000101965ec4 node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0, space=kOld) at deserializer.cc:709:3
    frame #98: 0x0000000101966e0f node_g`int v8::internal::Deserializer<v8::internal::Isolate>::ReadSingleBytecodeData<v8::internal::SlotAccessorForHandle<v8::internal::Isolate> >(this=0x00007ff7bfefe5d0, data='\x01', slot_accessor=SlotAccessorForHandle<v8::internal::Isolate> @ 0x00007ff7bfefe458) at deserializer.cc:938:40
    frame #99: 0x0000000101966d2d node_g`v8::internal::Deserializer<v8::internal::Isolate>::ReadObject(this=0x00007ff7bfefe5d0) at deserializer.cc:601:3
    frame #100: 0x000000010195b7d2 node_g`v8::internal::ContextDeserializer::Deserialize(this=0x00007ff7bfefe5d0, isolate=0x000000010f9ab000, global_proxy=Handle<v8::internal::JSGlobalProxy> @ 0x00007ff7bfefe570, embedder_fields_deserializer=v8::DeserializeEmbedderFieldsCallback @ 0x00007ff7bfefe560) at context-deserializer.cc:46:14
    frame #101: 0x000000010195b618 node_g`v8::internal::ContextDeserializer::DeserializeContext(isolate=0x000000010f9ab000, data=0x00007ff7bfefe840, can_rehash=true, global_proxy=Handle<v8::internal::JSGlobalProxy> @ 0x00007ff7bfefe7c0, embedder_fields_deserializer=v8::DeserializeEmbedderFieldsCallback @ 0x00007ff7bfefe7b0) at context-deserializer.cc:24:9
    frame #102: 0x00000001019cf33a node_g`v8::internal::Snapshot::NewContextFromSnapshot(isolate=0x000000010f9ab000, global_proxy=Handle<v8::internal::JSGlobalProxy> @ 0x00007ff7bfefe8e0, context_index=2, embedder_fields_deserializer=v8::DeserializeEmbedderFieldsCallback @ 0x00007ff7bfefe8d0) at snapshot.cc:210:39
    frame #103: 0x0000000101081dfd node_g`v8::internal::Genesis::Genesis(this=0x00007ff7bfefed18, isolate=0x000000010f9ab000, maybe_global_proxy=MaybeHandle<v8::internal::JSGlobalProxy> @ 0x00007ff7bfefec48, global_proxy_template=(val_ = 0x0000000000000000), context_snapshot_index=2, embedder_fields_deserializer=v8::DeserializeEmbedderFieldsCallback @ 0x00007ff7bfefec60, microtask_queue=0x0000000000000000) at bootstrapper.cc:6329:9
    frame #104: 0x0000000101049ee1 node_g`v8::internal::Genesis::Genesis(this=0x00007ff7bfefed18, isolate=0x000000010f9ab000, maybe_global_proxy=MaybeHandle<v8::internal::JSGlobalProxy> @ 0x00007ff7bfefec98, global_proxy_template=(val_ = 0x0000000000000000), context_snapshot_index=2, embedder_fields_deserializer=v8::DeserializeEmbedderFieldsCallback @ 0x00007ff7bfefecb0, microtask_queue=0x0000000000000000) at bootstrapper.cc:6291:59
    frame #105: 0x0000000101049d93 node_g`v8::internal::Bootstrapper::CreateEnvironment(this=0x0000600000221120, maybe_global_proxy=MaybeHandle<v8::internal::JSGlobalProxy> @ 0x00007ff7bfefed90, global_proxy_template=(val_ = 0x0000000000000000), extensions=0x00007ff7bfeff190, context_snapshot_index=2, embedder_fields_deserializer=v8::DeserializeEmbedderFieldsCallback @ 0x00007ff7bfefedb0, microtask_queue=0x0000000000000000) at bootstrapper.cc:330:13
    frame #106: 0x000000010078d0e8 node_g`v8::InvokeBootstrapper<v8::internal::Context>::Invoke(this=0x00007ff7bfefef28, isolate=0x000000010f9ab000, maybe_global_proxy=MaybeHandle<v8::internal::JSGlobalProxy> @ 0x00007ff7bfefee10, global_proxy_template=(val_ = 0x0000000000000000), extensions=0x00007ff7bfeff190, context_snapshot_index=2, embedder_fields_deserializer=DeserializeInternalFieldsCallback @ 0x00007ff7bfefee30, microtask_queue=0x0000000000000000) at api.cc:6235:37
    frame #107: 0x000000010073bd21 node_g`v8::internal::Handle<v8::internal::Context> v8::CreateEnvironment<v8::internal::Context>(isolate=0x000000010f9ab000, extensions=0x00007ff7bfeff190, maybe_global_template=(val_ = 0x0000000000000000), maybe_global_proxy=(val_ = 0x0000000000000000), context_snapshot_index=2, embedder_fields_deserializer=DeserializeInternalFieldsCallback @ 0x00007ff7bfeff130, microtask_queue=0x0000000000000000) at api.cc:6337:21
    frame #108: 0x000000010073b541 node_g`v8::NewContext(external_isolate=0x000000010f9ab000, extensions=0x00007ff7bfeff190, global_template=(val_ = 0x0000000000000000), global_object=(val_ = 0x0000000000000000), context_snapshot_index=2, embedder_fields_deserializer=DeserializeInternalFieldsCallback @ 0x00007ff7bfeff210, microtask_queue=0x0000000000000000) at api.cc:6378:31
    frame #109: 0x000000010073c148 node_g`v8::Context::FromSnapshot(external_isolate=0x000000010f9ab000, context_snapshot_index=1, embedder_fields_deserializer=DeserializeInternalFieldsCallback @ 0x00007ff7bfeff288, extensions=0x0000000000000000, global_object=(val_ = 0x0000000000000000), microtask_queue=0x0000000000000000) at api.cc:6410:10
    frame #110: 0x00000001002ec864 node_g`node::NodeMainInstance::CreateMainEnvironment(this=0x00007ff7bfeff4f0, exit_code=0x00007ff7bfeff484) at node_main_instance.cc:186:15
    frame #111: 0x00000001002ec60b node_g`node::NodeMainInstance::Run(this=0x00007ff7bfeff4f0) at node_main_instance.cc:128:7
    frame #112: 0x00000001001b76b8 node_g`node::Start(argc=2, argv=0x00007ff7bfeff708) at node.cc:1204:38
    frame #113: 0x000000010282b228 node_g`main(argc=2, argv=0x00007ff7bfeff708) at node_main.cc:127:10
    frame #114: 0x000000010f7a14fe dyld`start + 462

    I cannot provide minimal example (it's 20mb of js).

    Also, if you're interested, here are benchmarks of evaluating 20 mb file (it's different nodes versions but still):

    github/node   master ±  hyperfine -i 'node ./marked.js'
Benchmark 1: node ./marked.js
  Time (mean ± σ):      1.708 s ±  0.043 s    [User: 1.778 s, System: 0.127 s]
  Range (min … max):    1.661 s …  1.798 s    10 runs

 github/node   master ±  hyperfine -i './node ./test.js'
Benchmark 1: ./node ./test.js
  Time (mean ± σ):     354.7 ms ±  32.4 ms    [User: 288.7 ms, System: 58.0 ms]
  Range (min … max):   266.4 ms … 380.6 ms    10 runs

  7. joyeecheung commented on Aug 2, 2022

    @joyeecheung
    joyeecheung
    on Aug 2, 2022
    Member

    @goloveychuk Sorry for missing the reply in this thread. From a glance of the stack trace, this looks like a different kind of memory corruption. My instinct is that the store_index read here

    node/deps/v8/src/snapshot/deserializer.cc

    Lines 436 to 437 in 6bbc559

    uint32_t store_index =
    typed_array.GetExternalBackingStoreRefForDeserialization();

    might be bogus. Can you open a separate issue for this bug, and mention it in the tracking issue (#44014) ? Thanks! I'll be closing this issue since the bug it references should now be fixed by https://chromium-review.googlesource.com/c/v8/v8/+/3793525.

  8. joyeecheung
    closed this as completedon Aug 2, 2022

  9. goloveychuk commented on Aug 2, 2022

    @goloveychuk
    goloveychuk
    on Aug 2, 2022

    Not able to reproduce in current master

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    buildIssues and PRs related to Node.js builds or CI infrastructure.macosIssues and PRs related to the macOS platform.snapshotIssues and PRs related to the startup snapshot.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions