Node: HeapProfiler.takeHeapSnapshot will cause Node.js crash

[leeight]

• Version: v8.9.3 & v10.12.0 & v11.0.0
• Platform: macOS Mojave Version 10.14.1 Beta (18B67a)
• Subsystem:

I'm trying use inspector module to get the head snapshot, but the Node.js will crash after post HeapProfiler.takeHeapSnapshot command to the inspector.

It crash randomly, but easily reproduce it.

const inspector = require('inspector');

function post(session, action, params) {
  return new Promise((resolve, reject) => {
    session.post(action, params, (err, data) => {
      if (err) {
        return reject(err);
      }
      resolve(data);
    });
  });
}

async function main() {
  const session = new inspector.Session();
  session.connect();
  await post(session, 'HeapProfiler.enable');
  await post(session, 'HeapProfiler.startSampling', {
    samplingInterval: 32768
  });

  // Take the snapshot
  const chunks = [];

  session.on('HeapProfiler.addHeapSnapshotChunk', data => {
    chunks.push(data.params.chunk);
  });
  await post(session, 'HeapProfiler.takeHeapSnapshot', {
    reportProgress: false
  });

  const snapshot = chunks.join('');
  console.log(snapshot);
}

main();

[addaleax]

This seems to work on master (and v11.x), so I guess in the worst case we can bisect to figure out what fixed this…

Here’s a stack trace, btw:

Thread 1 "node" received signal SIGSEGV, Segmentation fault.
0x00000000010c9ae8 in v8::internal::StringsStorage::GetEntry(char const*, int) ()
(gdb) bt
#0  0x00000000010c9ae8 in v8::internal::StringsStorage::GetEntry(char const*, int) ()
#1  0x00000000010ca510 in v8::internal::StringsStorage::GetFunctionName(v8::internal::Name*) ()
#2  0x00000000010c7ca2 in v8::internal::SamplingHeapProfiler::AddStack() ()
#3  0x00000000010c80d6 in v8::internal::SamplingHeapProfiler::SampleObject(unsigned long, unsigned long) ()
#4  0x0000000000ed095f in v8::internal::AllocationObserver::AllocationStep(int, unsigned long, unsigned long) ()
#5  0x0000000000f20f16 in v8::internal::Space::AllocationStep(int, unsigned long, int) ()
#6  0x0000000000f2aad7 in v8::internal::LargeObjectSpace::AllocateRaw(int, v8::internal::Executability) ()
#7  0x0000000000ed72f4 in v8::internal::Heap::AllocateRaw(int, v8::internal::AllocationSpace, v8::internal::AllocationAlignment) ()
#8  0x0000000000ede222 in v8::internal::Heap::AllocateRawWithRetryOrFail(int, v8::internal::AllocationSpace, v8::internal::AllocationAlignment) ()
#9  0x0000000000ea63c5 in v8::internal::Factory::AllocateRawWithImmortalMap(int, v8::internal::PretenureFlag, v8::internal::Map*, v8::internal::AllocationAlignment) [clone .constprop.141] ()
#10 0x0000000000eadc6a in v8::internal::Factory::NewRawOneByteString(int, v8::internal::PretenureFlag) ()
#11 0x00000000011a4e3d in v8::internal::Runtime_StringBuilderConcat(int, v8::internal::Object**, v8::internal::Isolate*) ()
#12 0x000021b8c1a5c0d8 in ?? ()
#13 0x000021b8c1a5c041 in ?? ()
#14 0x00007ffd2352eb80 in ?? ()

/cc @nodejs/v8

[psmarshall]

I can take a look, I touched StringsStorage last

[psmarshall]

V8 issue: https://bugs.chromium.org/p/v8/issues/detail?id=8373

[leeight]

@psmarshall Thanks for your explanation. It works well after remove the following code. 👍

await post(session, 'HeapProfiler.startSampling', {
  samplingInterval: 32768
});

[mmarchini]

For the record, the last time I tried to promisify the inspector I had issues as well (although I don't remember if it was crashing...)

[BridgeAR]

Node.js v8.x has reached the end-of-life and won't receive any fixes anymore. I am closing this since this issue only applies to Node.js v8.x. Other release lines received a fix.

No matter if you run into this issue or not, please update to a newer Node.js version in case you still use v8.x.