-
Notifications
You must be signed in to change notification settings - Fork 29.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
segmentation fault at v8::internal::StoreBuffer::EnsureSpace () #11156
Comments
Can you provide a use case that can be used to recreate the failure? |
Sorry, this is from one of a couple core files found on a system, so we don't really know under what situation this crashed. The back trace for both core files are the same. Would the core file itself be any help? It's too big to be allowed here but I can put it on OneDrive and share it. |
/cc @nodejs/v8 |
@shyhpei Is testing a debug build ( For now, can you |
debug build is not doable - we used the binary build from nodejs site and never actually build the node here. And the crash is on a production system. We didn't encounter crash before in our lab. "disassemble" output will be in next comment. Here is "info registers" output: (gdb) info register |
(gdb) set pagination off |
Thanks. The offending instructions are these two:
It segfaults because rdx == 0, loaded from address 0x167846f04100 (because rax == 0x167846f04101.) It corresponds with this block of code in More specifically, it's the Even more specific, it segfaults on a (It reads the map pointer from the word at address 0x167846f04100, the address of the heap object. Heap object pointers have their LSB set but it's masked off when accessing the object's fields; the map pointer is at offset 0; ergo, it's at address 0x167846f04100.) The crash, in other words, happens because of a heap object in a bad state. Unfortunately, I cannot tell you why it happens. Is there any way for us to reproduce? Did you get the node binary from nodejs.org or somewhere else? |
By the way, if nothing else, try upgrading to the latest v4.x release and see if the problem persists. |
Super detailed analysis @bnoordhuis, thanks. Unfortunately the whole remembered set implementation got replaced in more recent versions of v8. I would also give upgrading to the latest v4.x a shot. |
Many thanks for looking into this. The binary is downloaded directly from nodejs.org, and I don't know how to reproduce this either. The crash happened twice on just one of many production systems with same node binary. The core files are the reason we know it crashed. I will give upgrading to the latest 4.x build (4.7.3 now) a try. Thanks again! |
@shyhpei how did updating work out for you? Can this issue be closed now? |
This issue has been inactive for sufficiently long that it seems like perhaps it should be closed. Feel free to re-open (or leave a comment requesting that it be re-opened) if you disagree. I'm just tidying up and not acting on a super-strong opinion or anything like that. |
Core file too big to attach, but back trace below:
The text was updated successfully, but these errors were encountered: