Skip to content

Instantly share code, notes, and snippets.

@metamatt
Last active August 29, 2015 14:11
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save metamatt/b2aca06fb424559fa7b7 to your computer and use it in GitHub Desktop.
Save metamatt/b2aca06fb424559fa7b7 to your computer and use it in GitHub Desktop.
reproducible v8 fatal error in debug version of nodejs 0.10.33
  1. Check out node 0.10.33 source
  2. ./configure --without-snapshot --debug
  3. make
  4. copy/symlink out/Debug/node so it's the node binary on your path
  5. create a package.json with the following contents
{
  "dependencies": {
    "archiver": "0.13",
    "connect": "~2.15.0"
  }
}
  1. npm install archiver connect

This will crash with

#
# Fatal error in ../deps/v8/src/hydrogen-instructions.cc, line 641
# CHECK(cur == other_operand) failed
#


==== Stack trace ============================================

Security context: 0x3961e3e06b71 <JS Object>#0#
    2: replace(aka replace) [native string.js:~221] (this=0xe394f8ce981 <String[14]: >=0.3.0 <0.4.0>,a=0x171a6045d3a1 <JS RegExp>#1#,b=0x171a604591c9 <JS Function hyphenReplace>#2#)
    3: parseRange [/usr/lib/node_modules/npm/node_modules/semver/semver.js:686] (this=0xe394f7c3ae9 <a Range>#3#,range=0xe394f8ce981 <String[14]: >=0.3.0 <0.4.0>)
    4: /* anonymous */ [/usr/lib/node_modules/npm/node_modules/semver/semver.js:652] (this=0xe394f7c3ae9 <a Range>#3#,range=0xe394f8ce981 <String[14]: >=0.3.0 <0.4.0>)
    5: arguments adaptor frame: 3->1
    6: map [native array.js:~1215] (this=0xe394f7c3b69 <JS Array[1]>#4#,a=0xe394f7c3c21 <JS Function>#5#,b=0xe394f7c3ae9 <a Range>#3#)
    7: new constructor(aka Range) [/usr/lib/node_modules/npm/node_modules/semver/semver.js:~640] (this=0xe394f7c3ae9 <a Range>#3#,range=0xe394f8ce981 <String[14]: >=0.3.0 <0.4.0>,loose=0x3961e3e04141 <true>)
    9: satisfies [/usr/lib/node_modules/npm/node_modules/semver/semver.js:1016] (this=0x3961e3e06c91 <JS Global Object>#6#,version=0x1f05f2fb2b41 <String[5]: 0.2.7>,range=0xe394f8ce981 <String[14]: >=0.3.0 <0.4.0>,loose=0x3961e3e04141 <true>)
   10: /* anonymous */ [/usr/lib/node_modules/npm/node_modules/semver/semver.js:~1025] (this=0x3961e3e06c91 <JS Global Object>#6#,version=0x1f05f2fb2b41 <String[5]: 0.2.7>)
   11: arguments adaptor frame: 3->1
   12: filter [native array.js:~1036] (this=0xe394f79e129 <JS Array[28]>#7#,a=0xe394f79e189 <JS Function>#8#,b=0x3961e3e04121 <undefined>)
   13: arguments adaptor frame: 1->2
   14: maxSatisfying [/usr/lib/node_modules/npm/node_modules/semver/semver.js:1025] (this=0x171a60455e91 <JS Function SemVer>#9#,versions=0xe394f79e129 <JS Array[28]>#7#,range=0xe394f8ce981 <String[14]: >=0.3.0 <0.4.0>,loose=0x3961e3e04141 <true>)
   15: next [/usr/lib/node_modules/npm/lib/cache/add-named.js:236] (this=0x3961e3e06c91 <JS Global Object>#6#)
   16: setData [/usr/lib/node_modules/npm/lib/cache/add-named.js:215] (this=0x3961e3e06c91 <JS Global Object>#6#,er=0x3961e3e04121 <undefined>,d=0xe394f720401 <an Object>#10#,json=0xe394f7853d9 <Very long string[33889]>#11#,resp=0xe394f78d859 <an Object>#12#)
   18: RES [/usr/lib/node_modules/npm/node_modules/inflight/inflight.js:23] (this=0x3961e3e06c91 <JS Global Object>#6#)
   19: arguments adaptor frame: 4->0
   21: /* anonymous */ [/usr/lib/node_modules/npm/node_modules/once/once.js:17] (this=0x3961e3e06c91 <JS Global Object>#6#)
   22: arguments adaptor frame: 4->0
   23: get_ [/usr/lib/node_modules/npm/lib/cache/caching-client.js:118] (this=0xc26bc5bb2e9 <a CachingRegistryClient>#13#,uri=0xe394f8df791 <String[36]: https://registry.npmjs.org/minimatch>,cachePath=0xe394f8e5021 <String[56]: /home/magi/.npm/registry.npmjs.org/minimatch/.cache.json>,params=0xe394f8e09f9 <an Object>#14#,cb=0xe394f8e0169 <JS Function>#15#)
   24: /* anonymous */ [/usr/lib/node_modules/npm/lib/cache/caching-client.js:87] (this=0x3961e3e06c91 <JS Global Object>#6#,er=0x3961e3e04101 <null>,data=0xe394f720401 <an Object>#10#)
   25: /* anonymous */ [evalmachine.<anonymous>:271] (this=0x3961e3e06c91 <JS Global Object>#6#,er=0x3961e3e04101 <null>)
   26: /* anonymous */ [/usr/lib/node_modules/npm/node_modules/graceful-fs/graceful-fs.js:102] (this=0x3961e3e06c91 <JS Global Object>#6#,er=0x3961e3e04101 <null>)
   28: oncomplete [evalmachine.<anonymous>:107] (this=0xe394f704d51 <an Object>#16#)
   29: arguments adaptor frame: 1->0

(plus a much longer tail of V8 debug information)

It will also leave a core; if you invoke gdb node core you'll be able to decode the stack trace for the native code into something like

Core was generated by `npm                                       '.
Program terminated with signal 5, Trace/breakpoint trap.
#0  v8::internal::OS::DebugBreak () at ../deps/v8/src/platform-linux.cc:415
415	}
(gdb) bt
#0  v8::internal::OS::DebugBreak () at ../deps/v8/src/platform-linux.cc:415
#1  0x0000000000c87088 in v8::internal::OS::Abort () at ../deps/v8/src/platform-linux.cc:397
#2  0x00000000008e9210 in V8_Fatal (file=0xdb4a08 "../deps/v8/src/hydrogen-instructions.cc", line=641, format=0xdb3c95 "CHECK(%s) failed")
    at ../deps/v8/src/checks.cc:58
#3  0x00000000009a7875 in v8::internal::HInstruction::Verify (this=0x1cb8ae0) at ../deps/v8/src/hydrogen-instructions.cc:641
#4  0x00000000009bddd0 in v8::internal::HGraph::Verify (this=0x170dd90, do_full_verify=false) at ../deps/v8/src/hydrogen.cc:503
#5  0x00000000009e6a7b in v8::internal::HPhase::End (this=0x7fff54414d30) at ../deps/v8/src/hydrogen.cc:9979
#6  0x00000000008f7186 in v8::internal::HPhase::~HPhase (this=0x7fff54414d30, __in_chrg=<optimized out>) at ../deps/v8/src/hydrogen.h:1389
#7  0x00000000009c876f in v8::internal::HGraph::EliminateRedundantBoundsChecks (this=0x170dd90) at ../deps/v8/src/hydrogen.cc:3698
#8  0x00000000009c8246 in v8::internal::HGraph::Optimize (this=0x170dd90, bailout_reason=0x7fff54414f00) at ../deps/v8/src/hydrogen.cc:3359
#9  0x00000000008f2044 in v8::internal::OptimizingCompiler::OptimizeGraph (this=0x7fff54414f50) at ../deps/v8/src/compiler.cc:359
#10 0x00000000008f13ba in v8::internal::MakeCrankshaftCode (info=0x7fff54415120) at ../deps/v8/src/compiler.cc:209
#11 0x00000000008f22c3 in v8::internal::GenerateCode (info=0x7fff54415120) at ../deps/v8/src/compiler.cc:393
#12 0x00000000008f235b in v8::internal::MakeCode (info=0x7fff54415120) at ../deps/v8/src/compiler.cc:409
#13 0x00000000008f3d8b in v8::internal::Compiler::CompileLazy (info=0x7fff54415120) at ../deps/v8/src/compiler.cc:815
#14 0x0000000000a86e11 in v8::internal::CompileLazyHelper (info=0x7fff54415120, flag=v8::internal::CLEAR_EXCEPTION) at ../deps/v8/src/objects.cc:7563
#15 0x0000000000a87780 in v8::internal::JSFunction::CompileOptimized (function=..., osr_ast_id=..., flag=v8::internal::CLEAR_EXCEPTION)
    at ../deps/v8/src/objects.cc:7666
#16 0x0000000000b12253 in v8::internal::Runtime_LazyRecompile (args=..., isolate=0x1565070) at ../deps/v8/src/runtime.cc:7925
#17 0x00003573bf506362 in ?? ()
#18 0x000000ae00000000 in ?? ()
#19 0x00003573bf5062c1 in ?? ()
#20 0x00007fff54415280 in ?? ()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment