{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/7259","repository_url":"https://api.github.com/repos/nodejs/node","labels_url":"https://api.github.com/repos/nodejs/node/issues/7259/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/7259/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/7259/events","html_url":"https://github.com/nodejs/node/issues/7259","id":159585464,"number":7259,"title":"V8 crash during MarkCompact GC","user":{"login":"papandreou","id":373545,"avatar_url":"https://avatars.githubusercontent.com/u/373545?v=3","gravatar_id":"","url":"https://api.github.com/users/papandreou","html_url":"https://github.com/papandreou","followers_url":"https://api.github.com/users/papandreou/followers","following_url":"https://api.github.com/users/papandreou/following{/other_user}","gists_url":"https://api.github.com/users/papandreou/gists{/gist_id}","starred_url":"https://api.github.com/users/papandreou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/papandreou/subscriptions","organizations_url":"https://api.github.com/users/papandreou/orgs","repos_url":"https://api.github.com/users/papandreou/repos","events_url":"https://api.github.com/users/papandreou/events{/privacy}","received_events_url":"https://api.github.com/users/papandreou/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodejs/node/labels/v8","name":"v8","color":"0052cc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-06-10T08:36:07Z","updated_at":"2016-06-10T09:07:35Z","closed_at":null,"body":"* **Version**: 6.2.1 (V8 5.0.71.52)\r\n* **Platform**: Ubuntu Linux 16.04, x86_64\r\n* **Subsystem**: V8, GC, Buffer\r\n\r\n### What steps will reproduce the problem?\r\n\r\nCheck out https://github.com/gustavnikolaj/node6-gc-overflow and run https://github.com/gustavnikolaj/node6-gc-overflow/blob/4766e784cadbf795f7be4665012a68de1d20ab13/index.js\r\nIt will fail reliably with node 6.2.1, but it works fine with 5.11.1 (v8 version 4.6.85.31).\r\n\r\n### What is the expected output?\r\n\r\nA single line of \"DONE!\" to stdout.\r\nLike below:\r\n\r\n```\r\n$ nvm use 5.11.1 && node --max-old-space-size=6000 index.js 4000\r\nNow using node v5.11.1 (npm v3.8.6)\r\nDONE!\r\n```\r\n\r\n### What do you see instead?\r\n\r\n```\r\n$ nvm use 6.2.1 && node --max-old-space-size=6000 index.js 4000\r\nNow using node v6.2.1 (npm v3.9.3)\r\n\r\n#\r\n# Fatal error in ../deps/v8/src/heap/spaces.h, line 1516\r\n# Check failed: size_ >= 0.\r\n#\r\n\r\n==== C stack trace ===============================\r\n\r\n1: V8_Fatal\r\n2: 0xc56387\r\n3: v8::internal::MarkCompactCollector::SweepSpaces()\r\n4: v8::internal::MarkCompactCollector::CollectGarbage()\r\n5: v8::internal::Heap::MarkCompact()\r\n6: v8::internal::Heap::PerformGarbageCollection(v8::internal::GarbageCollector, v8::GCCallbackFlags)\r\n7: v8::internal::Heap::CollectGarbage(v8::internal::GarbageCollector, char const*, char const*, v8::GCCallbackFlags)\r\n8: v8::internal::Heap::HandleGCRequest()\r\n9: v8::internal::StackGuard::HandleInterrupts()\r\n10: v8::internal::Runtime_StackGuard(int, v8::internal::Object**, v8::internal::Isolate*)\r\n11: 0xf767a506338\r\nIllegal instruction\r\n```\r\n\r\n### Background\r\n\r\nWe use [assetgraph-builder](https://github.com/assetgraph/assetgraph-builder) to build production versions of our web application. It's a tool that will take a web application and transform the code in various ways.\r\nIt will find style sheets and concatenate them, pick up on images that is referenced and optimize them etc. Because it loads all the assets into memory we have had to use the `--max-old-space-size` flag to avoid running out of memory.\r\n\r\nWhen we attempted to upgrade one of our larger web applications to node.js v6 we ran into the error described above. From what we have gathered, it happens when the garbage collector is attempting to clear more than ~2.2GB of memory using the MarkCompact strategy.\r\n\r\nhttps://github.com/nodejs/node/blob/c7b0d06183038c7ef8cac18a5dcac8b50c959c37/deps/v8/src/heap/spaces.h#L1510-L1517\r\n\r\nOur theory is that the signed 32 bit signed ints are overflowed and thus cause the check to fail. The only difference in the ShrinkSpace function between v8 4.6 and v8 5.0 is that the check has been promoted from a debug-check to a run time check, so we have most likely been exposed to this error longer than we were aware. The commit message suggests that the V8 team is already trying to root cause the problem: https://github.com/v8/v8/commit/168293591111a381b26491407c3ccd16b800a168\r\n\r\nWe have attempted to patch deps/v8 ourselves by naively changing the int types to `size_t` but without luck, so we suspect that it's a bug in the actual calculation algorithm.\r\n\r\n### Reproducing the bug with V8\r\n\r\nWe've also tried and failed to reduce the code snippet to something that will also trigger the bug in `v8_shell`, which means that `Buffer` cannot be used. None of our attempts have been able to trigger a MarkCompact GC, though, but that might be due to a lack of understanding of the heuristics employed by V8. This is the reason why we're reporting the bug here initially."},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/225130775","html_url":"https://github.com/nodejs/node/issues/7259#issuecomment-225130775","issue_url":"https://api.github.com/repos/nodejs/node/issues/7259","id":225130775,"user":{"login":"bnoordhuis","id":275871,"avatar_url":"https://avatars.githubusercontent.com/u/275871?v=3","gravatar_id":"","url":"https://api.github.com/users/bnoordhuis","html_url":"https://github.com/bnoordhuis","followers_url":"https://api.github.com/users/bnoordhuis/followers","following_url":"https://api.github.com/users/bnoordhuis/following{/other_user}","gists_url":"https://api.github.com/users/bnoordhuis/gists{/gist_id}","starred_url":"https://api.github.com/users/bnoordhuis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bnoordhuis/subscriptions","organizations_url":"https://api.github.com/users/bnoordhuis/orgs","repos_url":"https://api.github.com/users/bnoordhuis/repos","events_url":"https://api.github.com/users/bnoordhuis/events{/privacy}","received_events_url":"https://api.github.com/users/bnoordhuis/received_events","type":"User","site_admin":false},"created_at":"2016-06-10T09:07:35Z","updated_at":"2016-06-10T09:07:35Z","body":"> Our theory is that the signed 32 bit signed ints are overflowed and thus cause the check to fail.\r\n\r\nI agree, it seems to stem from V8 using `int` (32 bits) in a number of places where it should be using `intptr_t` (64 bits in 64 bits builds) - the `static_cast<int>(area_end() - area_start())` in `MemoryChunk::area_size()` in particular looks suspect.\r\n\r\nIt looks fairly straightforward to fix but I don't have time to write up a patch.  Does someone from @nodejs/v8 want to take this on?"}}
{"actor":{"display_login":"bnoordhuis"}}