Clearscript: "new Date().toLocaleString()" crashes ClearScriptV8 (v7.1.1)

[arnold-statham]

Code:

using var scriptEngine = new V8ScriptEngine();
scriptEngine.Execute("new Date().toLocaleString()");

Project file. Same for linux-x64

  <ItemGroup>
    <PackageReference Include="Microsoft.ClearScript.Core" Version="7.1.1" />
    <PackageReference Include="Microsoft.ClearScript.V8" Version="7.1.1" />
    <PackageReference Include="Microsoft.ClearScript.V8.Native.win-x64" Version="7.1.1" />
  </ItemGroup>

Error:

Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
Repeat 2 times:
--------------------------------
   at Microsoft.ClearScript.V8.SplitProxy.V8SplitProxyNative+Impl_Windows_X64.V8Context_ExecuteCode(Handle, Ptr, Ptr, UInt64, Boolean, IntPtr, Ptr, Boolean, Ptr)
--------------------------------
   at Microsoft.ClearScript.V8.SplitProxy.V8SplitProxyNative+Impl_Windows_X64.Microsoft.ClearScript.V8.SplitProxy.IV8SplitProxyNative.V8Context_ExecuteCode(Handle, System.String, System.String, UInt64, Boolean, IntPtr, System.String, Boolean)
   at Microsoft.ClearScript.V8.SplitProxy.V8ContextProxyImpl+<>c__DisplayClass17_0.<Execute>b__0(Microsoft.ClearScript.V8.SplitProxy.IV8SplitProxyNative)
   at Microsoft.ClearScript.V8.SplitProxy.V8SplitProxyNative.Invoke[[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](System.Func`2<Microsoft.ClearScript.V8.SplitProxy.IV8SplitProxyNative,System.__Canon>)
   at Microsoft.ClearScript.V8.SplitProxy.V8ContextProxyImpl.Execute(Microsoft.ClearScript.UniqueDocumentInfo, System.String, Boolean)
   at Microsoft.ClearScript.V8.V8ScriptEngine.ExecuteRaw(Microsoft.ClearScript.UniqueDocumentInfo, System.String, Boolean)
   at Microsoft.ClearScript.V8.V8ScriptEngine.ExecuteInternal(Microsoft.ClearScript.UniqueDocumentInfo, System.String, Boolean)
   at Microsoft.ClearScript.V8.V8ScriptEngine+<>c__DisplayClass103_0.<Execute>b__0()
   at Microsoft.ClearScript.ScriptEngine.ScriptInvokeInternal[[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](System.Func`1<System.__Canon>)
   at Microsoft.ClearScript.V8.V8ScriptEngine+<>c__DisplayClass110_0`1[[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].<ScriptInvoke>b__0()
   at Microsoft.ClearScript.V8.SplitProxy.V8SplitProxyManaged.InvokeHostAction(IntPtr)
   at Microsoft.ClearScript.V8.SplitProxy.V8SplitProxyNative+Impl_Windows_X64.V8Context_InvokeWithLock(Handle, IntPtr)
   at Microsoft.ClearScript.V8.SplitProxy.V8SplitProxyNative+Impl_Windows_X64.V8Context_InvokeWithLock(Handle, IntPtr)
   at Microsoft.ClearScript.V8.SplitProxy.V8SplitProxyNative+Impl_Windows_X64.Microsoft.ClearScript.V8.SplitProxy.IV8SplitProxyNative.V8Context_InvokeWithLock(Handle, IntPtr)
   at Microsoft.ClearScript.V8.SplitProxy.V8ContextProxyImpl+<>c__DisplayClass13_0.<InvokeWithLock>b__0(Microsoft.ClearScript.V8.SplitProxy.IV8SplitProxyNative)
   at Microsoft.ClearScript.V8.SplitProxy.V8SplitProxyNative.Invoke(System.Action`1<Microsoft.ClearScript.V8.SplitProxy.IV8SplitProxyNative>)
   at Microsoft.ClearScript.V8.SplitProxy.V8ContextProxyImpl.InvokeWithLock(System.Action)
   at Microsoft.ClearScript.V8.V8ScriptEngine.ScriptInvoke[[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](System.Func`1<System.__Canon>)
   at Microsoft.ClearScript.V8.V8ScriptEngine.Execute(Microsoft.ClearScript.UniqueDocumentInfo, System.String, Boolean)
   at Microsoft.ClearScript.ScriptEngine.Execute(Microsoft.ClearScript.DocumentInfo, System.String)
   at Microsoft.ClearScript.ScriptEngine.Execute(System.String, Boolean, System.String)
   at Microsoft.ClearScript.ScriptEngine.Execute(System.String, System.String)
   at Microsoft.ClearScript.ScriptEngine.Execute(System.String)
   at TestClearScript.Program.Main(System.String[])

[ClearScriptLib]

Hi @arnold-statham,

Thanks for reporting this.

The crash occurs if Date.prototype.toLocaleString is invoked when ICU data is unavailable. You can avoid it by referencing Microsoft.ClearScript.V8.ICUData in your project.

V8 usually throws an exception in similar situations, so we consider this a bug, and we've reported it here. Whether the V8 team agrees that it's a bug remains to be seen.

Thanks again!

[arnold-statham]

It works as a charm! thanks for your quick response!

[katangensis]

I ran into a similar problem which crashes my program. I'm not sure if the solution mentioned applies.
I run this function multiple times concurrently.

ClearScriptV8 (v7.1.1) running on .NET Framework 4.8
C# code:

private async Task MakeAsyncRequests(string url = "https://en.wikipedia.org/wiki/Computer") {
            V8ScriptEngine engine = null;
            try {
                engine = new V8ScriptEngine(V8ScriptEngineFlags.EnableTaskPromiseConversion);//runtime.CreateScriptEngine(V8ScriptEngineFlags.EnableTaskPromiseConversion);
                var typeCollection = new HostTypeCollection("mscorlib", "System", "System.Core");
                engine.AddHostObject("clr", typeCollection);
                engine.AddHostType(typeof(Console));
                engine.AddHostType(typeof(JavaScriptExtensions));
                engine.AddHostType(typeof(HttpClient));
                engine.AddHostType(typeof(HttpRequestMessage));
                engine.AddHostType(typeof(HttpMethod));
                engine.AddHostType(typeof(HttpStatusCode));
                engine.Script.sleep = new Func<int, Task>(x => Task.Delay(x));

                engine.Execute($@"
                Console.WriteLine('Loading Script');
                    async function Start() {{
                        var errors = 0;
                        var success = 0;
                        Console.WriteLine('Starting...');
                        var Client = new HttpClient();
                        while(errors < 100000 && success < 200) {{
                            try {{
                                var request = new HttpRequestMessage(HttpMethod.Get, '{url}');
                                request.Headers.Add('user-agent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36');
                                request.Headers.Add('accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9');
                                request.Headers.Add('accept-language', 'en-US,en;q=0.9');

                                var response = await Client.SendAsync(request);
                                var result = await response.Content.ReadAsStringAsync();
                                if(response.IsSuccessStatusCode) {{
                                    Console.WriteLine(result);
                                    success++;
                                }} else {{
                                    Console.WriteLine('Failed to get data');
                                    errors++;
                                }}
                            }} catch(ex) {{
                                Console.WriteLine(ex);
                            }}
                            Console.WriteLine('\n');
                            await sleep(10000);
                        }}
                        Console.WriteLine('Done');
                        Client.Dispose();
                        return success >= 200;
                    }}
                ");

                await Task.Delay(2000);

                dynamic result = await (System.Threading.Tasks.Task<dynamic>)engine.Invoke("Start");         

                Console.WriteLine("\nResult: " + result.ToString());

            } catch(Exception e) {
                Console.WriteLine(e.Message);
            } finally {
                engine.Dispose();
            }
}

Event viewer crash after a few hours:

Faulting module name: ClearScriptV8.win-x86.dll, version: 7.1.1.0, time stamp: 0x6040d3e6
Exception code: 0xc0000005
-------------------------
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.AccessViolationException
   at Microsoft.ClearScript.V8.SplitProxy.V8SplitProxyNative+Impl_Windows_X86.NativeCallback_Invoke(Handle)
   at Microsoft.ClearScript.V8.SplitProxy.V8SplitProxyNative+Impl_Windows_X86.Microsoft.ClearScript.V8.SplitProxy.IV8SplitProxyNative.NativeCallback_Invoke(Handle)
   at Microsoft.ClearScript.V8.SplitProxy.NativeCallbackImpl.<Invoke>b__4_0(Microsoft.ClearScript.V8.SplitProxy.IV8SplitProxyNative)
   at Microsoft.ClearScript.V8.SplitProxy.V8SplitProxyNative.InvokeNoThrow(System.Action`1<Microsoft.ClearScript.V8.SplitProxy.IV8SplitProxyNative>)
   at Microsoft.ClearScript.V8.SplitProxy.NativeCallbackImpl.Invoke()
   at Microsoft.ClearScript.Util.MiscHelpers.Try(System.Action)
   at Microsoft.ClearScript.Util.MiscHelpers+<>c__DisplayClass33_0.<QueueNativeCallback>b__0(System.Object)
   at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   at System.Threading.ThreadPoolWorkQueue.Dispatch()
   at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()

[ClearScriptLib]

Hi @katangensis,

Your issue is unrelated but resembles the one discussed at the end of the thread for Issue #84.

Unfortunately we haven't managed to reproduce it. We ran ten concurrent invocations of MakeAsyncRequests in a loop for several hours without encountering any problems. This was in a 32-bit test application on .NET Framework 4.8.

Do you have a minimal sample that reproduces the issue? Alternatively a full crash dump could provide a clue.

Thanks!

[katangensis]

Hi, I encountered this issue twice after leaving the program running overnight on two consecutive nights. I ran this function around 90 times concurrently. However, today when I woke up it did not crash so now I'm second guessing why it crashed.

I've been working on converting some of the logic of my C# app into JS code and so this example was me just testing how well it would work with ClearScriptV8 and its seems super promising nevertheless.

I'll just continue to convert more of my C# code but will be sure to send a minimal sample and a crash dump if I can recreate the crash again consistently. Thank you anyways!

[ClearScriptLib]

Version 7.1.2 includes a patch for the toLocaleString issue. Thanks again!