V8 Fatal Exception, 0x99b617

[duereg]

Version: Node, 6.10.1
Platform: Linux, version 4.4.27

#
# Fatal error in , line 0
# unreachable code
#

==== C stack trace ===============================

 1: V8_Fatal
 2: 0x99b617
 3: v8::internal::AstNumberingVisitor::VisitArrayLiteral(v8::internal::ArrayLiteral*)
 4: v8::internal::AstNumberingVisitor::VisitConditional(v8::internal::Conditional*)
 5: v8::internal::AstNumberingVisitor::VisitObjectLiteral(v8::internal::ObjectLiteral*)
 6: v8::internal::AstNumberingVisitor::VisitAssignment(v8::internal::Assignment*)
 7: v8::internal::AstNumberingVisitor::VisitBlock(v8::internal::Block*)
 8: v8::internal::AstNumberingVisitor::VisitBlock(v8::internal::Block*)
 9: v8::internal::AstNumberingVisitor::Renumber(v8::internal::FunctionLiteral*)
10: v8::internal::AstNumbering::Renumber(v8::internal::Isolate*, v8::internal::Zone*, v8::internal::FunctionLiteral*)
11: v8::internal::Compiler::Analyze(v8::internal::ParseInfo*)
12: 0xb4e248
13: 0xb55966
14: v8::internal::Compiler::Compile(v8::internal::Handle<v8::internal::JSFunction>, v8::internal::Compiler::ClearExceptionFlag)
15: v8::internal::Accessors::FunctionLengthGetter(v8::Local<v8::Name>, v8::PropertyCallbackInfo<v8::Value> const&)
16: 0x72825232722
Illegal instruction (core dumped)

[mscdex]

Do you have a simple example to reproduce the crash?

/cc @nodejs/v8

[mscdex]

Additionally, you may want to file an issue over at https://bugs.chromium.org/p/v8/.

[duereg]

@mscdex I could probably come up with a simple use case. I'll file an issue with the v8 folks. This only happens in 6.10.1 as far as I can see (downgrading to 6.9 resolved the issue).

[duereg]

https://bugs.chromium.org/p/v8/issues/detail?id=6131

[mscdex]

By 6.9 do you mean 6.9.5 or 6.9.0? Also, does 6.10.0 exhibit the same problem?

[mscdex]

FWIW

These V8-related PRs were merged in v6.10.0:

• fix compile bug in v8/lookup.h #10525
• deps: backport 224d376 from V8 upstream #10546
• Filter left trimmer v6.x #10666
• v6.x: deps: cherry-pick baba152 from V8 upstream #10689
• deps backport 7c3748a from upstream V8 #10881

These V8-related PRs were merged in v6.10.1:

• v8: fix new.target inheritance from c++ #9293
• deps: cherry-pick a814b8a from upstream V8 #10733
• v6.x: deps: backport dfb8d33 from V8 upstream #11483

[duereg]

6.10.0 does no exhibit the same problem. 6.9.0 and 6.9.5 also do not exhibit the same problem. I have a reproducible test case, but I need to streamline it to just the minimum elements. This looks to be isolated to 6.10.1.

In the v8 issue, the chromium team stated that the version of v8 used by 6.10.1 is no longer supported, and this issue is not present in later version of v8.

https://bugs.chromium.org/p/v8/issues/detail?id=6131#c2

[gibfahn]

@duereg if you could include a way of reproducing that would be helpful.

Also which version of Linux?

[mscdex]

If you're feeling adventurous, you could try reverting each of those 3 V8-related commits, one at a time, and see which one is causing the problem.

[duereg]

I have a way of reproducing - I can reproduce it locally on my Mac, as well on our CI environment, which is:

Platform: Linux, version 4.4.27

So I believe it might be platform agnostic.

[duereg]

@gibfahn I'm going to try to create a simple gist to recreate tonight.
@mscdex I'm never run node locally from a non-binary. Depends on how adventurous I'm feeling, I might try this weekend

[gibfahn]

@duereg cheers. FWIW, it should be just ./configure && make -j4 to rebuild, then use the ./node symlink in the directory to run your testcase.

[mscdex]

If you want to test reverting one of the V8 commits, just checkout the v6.10.1 tag, then git revert <commit hash>, recompile, and test the newly compiled executable with your script.

The commits to try reverting for #9293 are:

• 47cbb88
• 0eb4f1d
• a38d091
• daa56a6

The commit to try reverting for #10733 is 3fc6a22.

The commit to try reverting for #11483 is 3ab070d.