Node: Crash when accessing some ArrayBuffers from a node addon

[rconde01]

I'm using electron-nightly with WebGPU. One of the WebGPU functions returns an ArrayBuffer. When I pass this ArrayBuffer to my node addon it crashes when retrieving the ByteLength after a few iterations. Passing an ArrayBuffer created manually on the js side appears to work fine.

Here is a minimal reproduction case: https://github.com/the-ocho/webgpuArrayBufferNodeAddonCrash

I'm talking to the chrome WebGPU team about this. If the addon team has any guidance on what I may be doing wrong, or they may be doing wrong, I would appreciate it.

[addaleax]

@rconde01 Can you fill out the bug report template, in particular OS and Node.js version (or Electron version)?

[rconde01]

Version: from dev tools process.versions: {node: "12.16.2", v8: "8.4.166-electron.0", uv: "1.34.2", zlib: "1.2.11", brotli: "1.0.7", …}
Platform: Windows 10 64-bit

What steps will reproduce the bug?

Clone and run the example at https://github.com/the-ocho/webgpuArrayBufferNodeAddonCrash

How often does it reproduce? Is there a required condition?

Every time on windows and mac

What is the expected behavior?

The copy completes successfully and doesn't crash.

What do you see instead?

It crashes when calling ArrayBuffer.ByteLength() on the addon side after a couple of iterations.

Additional information

See original post.

[addaleax]

@rconde01 So… I would probably recommend moving this to the Electron issue tracker, because:

• This is an Electron nightly build and I’d assume that the stable build doesn’t have this issue
• Node v12.x is no less than 6 major V8 versions apart from the V8 version in that nightly build, and supporting that bridge is Electron’s territory, not ours
• The fix is probably for Electron to float a patch that we couldn’t even apply to Node v12.x if we wanted to, due to that V8 version disparity – My guess would be that that is e66a2acc4cb9fc09fc32d1833b89ae56468a0931

I’m not 100 % sure but I’m fairly certain that this is due to a migration in how ArrayBuffer instances are managed, which V8 has been performing for a while now and which is a major breaking change for some addons (and therefore also a breaking change for Electron).

/cc @codebytere

[codebytere]

hey @rconde01 - @addaleax is right and this would be a better fit for the Electron repo! Please close this and open it on https://github.com/electron/electron so i can take a better look :)

[codebytere]

@addaleax for posterity that sadly does not fix it, it dies on a GetBackingStore codepath too:

Stacktrace

#
# Fatal error in , line 0
# ignored
#
#
#
#FailureMessage Object: 0x7ffeea9155800   Electron Framework                  0x000000010a53a079 v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 17358137
1   Electron Framework                  0x000000010a49dc53 v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 16718099
2   Electron Framework                  0x000000010c334edb v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 48794523
3   Electron Framework                  0x000000010c31ce63 v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 48696099
4   Electron Framework                  0x0000000108d51447 v8::internal::BackingStore::Reallocate(v8::internal::Isolate*, unsigned long) + 567
5   Electron Framework                  0x0000000108a84102 v8::ArrayBuffer::GetBackingStore() + 242
6   Electron Framework                  0x000000010ddc133d napi_get_arraybuffer_info + 77
7   copy_to_webgpu_arraybuffer.node     0x000000010790b835 update_array_buffer(Napi::CallbackInfo const&) + 426
8   copy_to_webgpu_arraybuffer.node     0x000000010790c509 napi_value__* Napi::details::WrapCallback<Napi::details::CallbackData<void (*)(Napi::CallbackInfo const&), void>::Wrapper(napi_env__*, napi_callback_info__*)::'lambda'()>(Napi::details::CallbackData<void (*)(Napi::CallbackInfo const&), void>::Wrapper(napi_env__*, napi_callback_info__*)::'lambda'()) + 47
9   copy_to_webgpu_arraybuffer.node     0x000000010790c4bf Napi::details::CallbackData<void (*)(Napi::CallbackInfo const&), void>::Wrapper(napi_env__*, napi_callback_info__*) + 33
10  Electron Framework                  0x000000010ddbb14a napi_create_function + 906
11  Electron Framework                  0x0000000108ae2e4f v8::internal::Accessors::MakeAccessor(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Name>, void (*)(v8::Local<v8::Name>, v8::PropertyCallbackInfo<v8::Value> const&), void (*)(v8::Local<v8::Name>, v8::Local<v8::Value>, v8::PropertyCallbackInfo<v8::Boolean> const&)) + 17391
12  Electron Framework                  0x0000000108ae2351 v8::internal::Accessors::MakeAccessor(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Name>, void (*)(v8::Local<v8::Name>, v8::PropertyCallbackInfo<v8::Value> const&), void (*)(v8::Local<v8::Name>, v8::Local<v8::Value>, v8::PropertyCallbackInfo<v8::Boolean> const&)) + 14577
13  Electron Framework                  0x0000000108ae19c1 v8::internal::Accessors::MakeAccessor(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Name>, void (*)(v8::Local<v8::Name>, v8::PropertyCallbackInfo<v8::Value> const&), void (*)(v8::Local<v8::Name>, v8::Local<v8::Value>, v8::PropertyCallbackInfo<v8::Boolean> const&)) + 12129
14  Electron Framework                  0x0000000109522c78 v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 485688
15  Electron Framework                  0x00000001094b6295 v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 40789
16  Electron Framework                  0x00000001094b6295 v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 40789
17  Electron Framework                  0x00000001094b3dda v8::internal::SetupIsolateDelegate::SetupHeap(v8::internal::Heap*) + 31386

[rconde01]

The chromium/webgpu team has a lead on this so you can stand down for now. Thanks for looking into this!!

[codebytere]

@rconde01 do you have a link to a crbug so i can track?

[rconde01]

https://chromium-review.googlesource.com/c/chromium/src/+/2176654
https://chromiumdash.appspot.com/commit/5520f37edb217ddfbde63655388e53c4c2e99d9e