V8 Fatal Exception, 0x99b617

Version: Node, 6.10.1
Platform: Linux, version 4.4.27

#
# Fatal error in , line 0
# unreachable code
#

==== C stack trace ===============================

 1: V8_Fatal
 2: 0x99b617
 3: v8::internal::AstNumberingVisitor::VisitArrayLiteral(v8::internal::ArrayLiteral*)
 4: v8::internal::AstNumberingVisitor::VisitConditional(v8::internal::Conditional*)
 5: v8::internal::AstNumberingVisitor::VisitObjectLiteral(v8::internal::ObjectLiteral*)
 6: v8::internal::AstNumberingVisitor::VisitAssignment(v8::internal::Assignment*)
 7: v8::internal::AstNumberingVisitor::VisitBlock(v8::internal::Block*)
 8: v8::internal::AstNumberingVisitor::VisitBlock(v8::internal::Block*)
 9: v8::internal::AstNumberingVisitor::Renumber(v8::internal::FunctionLiteral*)
10: v8::internal::AstNumbering::Renumber(v8::internal::Isolate*, v8::internal::Zone*, v8::internal::FunctionLiteral*)
11: v8::internal::Compiler::Analyze(v8::internal::ParseInfo*)
12: 0xb4e248
13: 0xb55966
14: v8::internal::Compiler::Compile(v8::internal::Handle<v8::internal::JSFunction>, v8::internal::Compiler::ClearExceptionFlag)
15: v8::internal::Accessors::FunctionLengthGetter(v8::Local<v8::Name>, v8::PropertyCallbackInfo<v8::Value> const&)
16: 0x72825232722
Illegal instruction (core dumped)

Do you have a simple example to reproduce the crash?

/cc @nodejs/v8

Additionally, you may want to file an issue over at https://bugs.chromium.org/p/v8/.

@mscdex

@mscdex I could probably come up with a simple use case. I'll file an issue with the v8 folks. This only happens in 6.10.1 as far as I can see (downgrading to 6.9 resolved the issue).

https://bugs.chromium.org/p/v8/issues/detail?id=6131

By 6.9 do you mean 6.9.5 or 6.9.0? Also, does 6.10.0 exhibit the same problem?

FWIW

These V8-related PRs were merged in v6.10.0:

These V8-related PRs were merged in v6.10.1:

6.10.0 does no exhibit the same problem. 6.9.0 and 6.9.5 also do not exhibit the same problem. I have a reproducible test case, but I need to streamline it to just the minimum elements. This looks to be isolated to 6.10.1.

In the v8 issue, the chromium team stated that the version of v8 used by 6.10.1 is no longer supported, and this issue is not present in later version of v8.

https://bugs.chromium.org/p/v8/issues/detail?id=6131#c2

@duereg

@duereg if you could include a way of reproducing that would be helpful.

Also which version of Linux?

If you're feeling adventurous, you could try reverting each of those 3 V8-related commits, one at a time, and see which one is causing the problem.

I have a way of reproducing - I can reproduce it locally on my Mac, as well on our CI environment, which is:

Platform: Linux, version 4.4.27

So I believe it might be platform agnostic.

@gibfahn

@gibfahn I'm going to try to create a simple gist to recreate tonight.
@mscdex I'm never run node locally from a non-binary. Depends on how adventurous I'm feeling, I might try this weekend

@duereg

@duereg cheers. FWIW, it should be just ./configure && make -j4 to rebuild, then use the ./node symlink in the directory to run your testcase.

If you want to test reverting one of the V8 commits, just checkout the v6.10.1 tag, then git revert <commit hash>, recompile, and test the newly compiled executable with your script.

The commits to try reverting for #9293 are:

The commit to try reverting for #10733 is 3fc6a22.

The commit to try reverting for #11483 is 3ab070d.

Our mocha runner is wrapped in a gulp process. I was hoping to not have to figure that out as well. I'll update the gist to take that into account.

I also cannot get that test case to fail without the gulp runner. The issue seems to lie with the instrumentation code that calculates test coverage, that sits atop of all of this. :/

@targos

@targos updated gist. Download, install, run, everything explodes

Reproducible for me (macOS Sierra):

Stack Trace

==== C stack trace ===============================

 1: V8_Fatal
 2: v8::internal::AstNumberingVisitor::VisitSpread(v8::internal::Spread*)
 3: v8::internal::AstNumberingVisitor::VisitArrayLiteral(v8::internal::ArrayLiteral*)
 4: v8::internal::AstNumberingVisitor::VisitRewritableExpression(v8::internal::RewritableExpression*)
 5: v8::internal::AstNumberingVisitor::VisitBinaryOperation(v8::internal::BinaryOperation*)
 6: v8::internal::AstNumberingVisitor::VisitConditional(v8::internal::Conditional*)
 7: v8::internal::AstNumberingVisitor::VisitObjectLiteral(v8::internal::ObjectLiteral*)
 8: v8::internal::AstNumberingVisitor::VisitAssignment(v8::internal::Assignment*)
 9: v8::internal::AstNumberingVisitor::VisitExpressionStatement(v8::internal::ExpressionStatement*)
10: v8::internal::AstNumberingVisitor::VisitBlock(v8::internal::Block*)
11: v8::internal::AstNumberingVisitor::Renumber(v8::internal::FunctionLiteral*)
12: v8::internal::AstNumbering::Renumber(v8::internal::Isolate*, v8::internal::Zone*, v8::internal::FunctionLiteral*)
13: v8::internal::Compiler::Analyze(v8::internal::ParseInfo*)
14: v8::internal::(anonymous namespace)::GetUnoptimizedCodeCommon(v8::internal::CompilationInfo*)
15: v8::internal::Compiler::Compile(v8::internal::Handle<v8::internal::JSFunction>, v8::internal::Compiler::ClearExceptionFlag)
16: v8::internal::Runtime_CompileLazy(int, v8::internal::Object**, v8::internal::Isolate*)
17: 0x15fb64a092a7
18: 0x15fb64a34338
19: 0x15fb65055791
20: 0x15fb65063a3a
[1]    35429 illegal hardware instruction (core dumped)  gulp

EDIT: Indeed, it doesn't fail if you take out Istanbul, i.e. with:

this diff

diff --git a/gulpfile.babel.js b/gulpfile.babel.js
index d28b64e..0fa981a 100644
--- a/gulpfile.babel.js
+++ b/gulpfile.babel.js
@@ -1,23 +1,12 @@
 import gulp from 'gulp';
-import istanbul from 'gulp-istanbul';
 import {Instrumenter} from 'isparta';
 import mocha from 'gulp-mocha';
 
 function runTestsWithCoverage(cb) {
   return gulp.src(['./brokenNodeTest.js'])
-    .pipe(istanbul({ // Covering files
-      instrumenter: Instrumenter,
-      includeUntested: true
-    }))
-    .pipe(istanbul.hookRequire()) // Force `require` to return covered files
     .on('finish', function finish() {
       gulp.src(["./brokenNodeTest.spec.js"], {read: false})
         .pipe(mocha({reporter: 'spec', timeout: 15000}))
-        .pipe(istanbul.writeReports({
-          dir: "coverage",
-          reportOpts: {dir: "coverage"},
-          reporters: ['text', 'text-summary', 'json', 'html']
-        }))
         .on('end', console.error)
         .on('error', console.error);
     });

Thank you. Here is a reduced testcase based on this:

'use strict';
let a = 0;
const DEFAULT_FLAGS = [1];
const query = {
  flags: true ? (a++,
  [...DEFAULT_FLAGS, 2]) : (a++,
  DEFAULT_FLAGS)
};

Even shorter:

(42, [...[0], 1]);

The crash also happens if I build V8 at the commit that I backported. I'm going to bisect.

deps: backport 2cabc86 from upstream V8

@targos

@targos has this been resolved in 6.10.2?

@duereg

@duereg Yes. Thanks for the report!

Fix landed in 52bdb8f

Navigation Menu

Repository navigation

V8 Fatal Exception, 0x99b617 #11977

12 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

V8 Fatal Exception, 0x99b617 #11977

Description

Activity

mscdex commented on Mar 21, 2017

mscdex commented on Mar 21, 2017

duereg commented on Mar 21, 2017

duereg commented on Mar 21, 2017

mscdex commented on Mar 21, 2017

mscdex commented on Mar 21, 2017

duereg commented on Mar 22, 2017

gibfahn commented on Mar 22, 2017

mscdex commented on Mar 22, 2017

duereg commented on Mar 22, 2017

duereg commented on Mar 22, 2017

gibfahn commented on Mar 22, 2017

mscdex commented on Mar 22, 2017

12 remaining items

duereg commented on Mar 24, 2017

duereg commented on Mar 24, 2017

duereg commented on Mar 24, 2017

gibfahn commented on Mar 24, 2017

targos commented on Mar 25, 2017

targos commented on Mar 25, 2017

targos commented on Mar 25, 2017

duereg commented on Apr 6, 2017

targos commented on Apr 7, 2017

targos commented on Apr 7, 2017

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions