Crash in AfterOpenFileHandle

[tniessen]

Version

latest (18.0.0)

Platform

Linux

Subsystem

fs (presumably)

What steps will reproduce the bug?

1. Compile Node.js:

   ./configure
   make

   For reference, I am building Node.js as of 3a6b975.

2. Add WPTs for wasm/webapi and wasm/jsapi:

   git node wpt wasm/webapi
   git node wpt wasm/jsapi

   For reference, for me, this has resulted in the following additions to versions.json:

     "wasm/jsapi": {
       "commit": "1dd414c79616489ea021c800eb0375a709e8114e",
       "path": "wasm/jsapi"
     },
     "wasm/webapi": {
       "commit": "fd1b23eeaaf9a01555d4fa29cf79ed11a4c44a50",
       "path": "wasm/webapi"
     }

3. Create test/wpt/status/wasm/webapi.json and mark all tests as failing:

   {
     "historical.any.js": {
       "skip": "indexedDB is not defined"
     },
     "origin.sub.any.js": {
       "skip": "CORS not implemented"
     },
   
     "abort.any.js": {
       "fail": "WPTRunner does not support fetch()"
     },
     "contenttype.any.js": {
       "fail": "WPTRunner does not support fetch()"
     },
     "empty-body.any.js": {
       "fail": "Bug in undici, see https://github.com/nodejs/undici/issues/1345"
     },
     "idlharness.any.js": {
       "fail": "not configured"
     },
     "status.any.js": {
       "fail": "WPTRunner does not support fetch()"
     },
   
     "body.any.js": { "fail": "." },
     "rejected-arg.any.js": { "fail": "." },
     "invalid-args.any.js": { "fail": "." },
     "invalid-code.any.js": { "fail": "." },
     "instantiateStreaming-bad-imports.any.js": { "fail": "." },
     "instantiateStreaming.any.js": { "fail": "." },
     "modified-contenttype.any.js": { "fail": "." }
   }

   If any of these WPTs are not failing, that likely only means that node's compliance with the WPTs improved. In that case, we might not be able to reproduce this bug using these WPTs anymore, but it does not necessarily mean that the bug has been fixed.

4. Create test/wpt/test-wasm-webapi.js:

   'use strict';
   
   require('../common');
   const { WPTRunner } = require('../common/wpt');
   
   const runner = new WPTRunner('wasm/webapi');
   runner.runJsTests();

5. Run the test until it crashes:

   while ./node test/wpt/test-wasm-webapi.js ; do : ; done

How often does it reproduce? Is there a required condition?

The probability that any given test run crashes appears to be low, but after sufficiently many runs, it inevitably crashes.

What is the expected behavior?

Many WPT error messages and expected failures, but no crash.

What do you see instead?

Many WPT error messages and expected failures, and eventually:

FATAL ERROR: v8::FromJust Maybe value is Nothing.
 1: 0x55b6fb8f7284 node::Abort() [./node]
 2: 0x55b6fb7ed3ee node::FatalError(char const*, char const*) [./node]
 3: 0x55b6fbb10c2c v8::api_internal::FromJustIsNothing() [./node]
 4: 0x55b6fb8222a5 node::UVException(v8::Isolate*, int, char const*, char const*, char const*, char const*) [./node]
 5: 0x55b6fb8ffb0b node::fs::FSReqAfterScope::Reject(uv_fs_s*) [./node]
 6: 0x55b6fb9045c8 node::fs::AfterOpenFileHandle(uv_fs_s*) [./node]
 7: 0x55b6fc531651  [./node]
 8: 0x55b6fc535838  [./node]
 9: 0x55b6fc5497d4  [./node]
10: 0x55b6fc536254 uv_run [./node]
11: 0x55b6fb81c756 node::SpinEventLoop(node::Environment*) [./node]
12: 0x55b6fb9dc759 node::worker::Worker::Run() [./node]
13: 0x55b6fb9dcb4c  [./node]
14: 0x7f3c3bdf3609  [/lib/x86_64-linux-gnu/libpthread.so.0]
15: 0x7f3c3bd18163 clone [/lib/x86_64-linux-gnu/libc.so.6]

Additional information

Discovered while testing #42701. Reproduced both locally and on multiple CI systems.

Hopefully, we will add support for fetch() in the WPTRunner soon, at which point these instructions will likely not lead to the crash, assuming the currently vast number of ENOENT errors that occur when the WPTs attempt to use fetch() is responsible for the crash within fs.

However, once that happens and when these instructions do not reproduce the crash anymore, that does not mean that the underlying bug has been fixed.

If you find a simpler reproduction, please comment below :)

[tniessen]

Refs: #42701 (comment)

[oliversalzburg]

I'm currently investigating an issue I'm experiencing in Prettier and was wondering if this is the same issue prettier/prettier#12753 Thanks for the help 😄