local fatal error for test/js-native-api/test_object/test.js

Platform: macOS arm64

I don't know when it started exactly.

$  out/Release/node test/js-native-api/test_object/test.js
node(1489,0x1095dfd40) malloc: *** error for object 0x13cf049e0: pointer being freed was not allocated
node(1489,0x1095dfd40) malloc: *** set a breakpoint in malloc_error_break to debug
[1]    1489 abort      out/Release/node

Sometimes it fails with this abort, other times with a segmentation fault.

Process 31710 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x10)
    frame #0: 0x0000000100180fe4 node`v8impl::(anonymous namespace)::Reference::SecondPassCallback(data=0x000000016fdf62e0)::Reference> const&) at js_native_api_v8.cc:405:26
   402    }
   403 
   404    static void SecondPassCallback(const v8::WeakCallbackInfo<Reference>& data) {
-> 405      data.GetParameter()->Finalize();
   406    }
   407 
   408    v8impl::Persistent<v8::Value> _persistent;
Target 0: (node) stopped.

@nodejs/node-api

This may be an indication that V8 is not removing the weak callback once queued, even though we are calling ClearWeak() from the environment teardown-induced finalization loop. We may want to consider the alternative solution mentioned in #37616 (comment) to see if that prevents this problem.

This may be related: #38000

@targos

@targos it will be helpful to share the node version that you are testing against. thanks!

@gabrielschulhof the tricky thing is that the ClearWeak() is expected to be called during the first pass callback. So that is the API contract that ClearWeak() will not clear the second pass callback. I've submitted an issue to v8 to discuss this https://bugs.chromium.org/p/v8/issues/detail?id=11608 . And as a fix from node when the cancellation of second pass callback is not available, I've submitted #38000 to address the issue.

@legendecas

@legendecas I'm testing with the master branch.

Saw it crash in a GitHub workflow too: https://github.com/nodejs/node/runs/2338974533

The GitHub Actions build-tarball workflow has been consistently failing due to this test crashing after 78343bb / #37263: https://github.com/nodejs/node/actions/workflows/build-tarball.yml?query=branch%3Amaster

@ExE-Boss

Does it make sense to temporarily revert 78343bb / #37263 to see if that brings us back to passing actions runs?

cc: @ExE-Boss, @aduh95

It looks like #38250 may fix this.

src: fix finalization crash

Navigation Menu

Repository navigation

local fatal error for test/js-native-api/test_object/test.js #38040

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

local fatal error for test/js-native-api/test_object/test.js #38040

Description

Activity

targos commented on Apr 2, 2021

targos commented on Apr 2, 2021

gabrielschulhof commented on Apr 2, 2021

mhdawson commented on Apr 9, 2021

legendecas commented on Apr 9, 2021

targos commented on Apr 11, 2021

targos commented on Apr 14, 2021

richardlau commented on Apr 14, 2021

BethGriggs commented on Apr 14, 2021

jasnell commented on Apr 15, 2021

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions