Ubuntu 10.10 - Test suite causing segmentation fault

[cjoudrey]

The test suite crashes under Ubuntu 10.10.

cjoudrey@ubuntu:/tmp/zombie$ cake test
Running test suite ... 

♢ Browser

Segmentation fault

All the dependencies have been installed via npm.

[assaf]

I get it to blow up on 8.04 as well. No idea why or how to fix it, though.

[johkra]

I have this problem on Archlinux using node v0.4.0. (It used to work with node 0.2.x)

When I try to create a new Browser, I get a segmentation fault:

Code to reproduce:

$ node
> var zombie = require("zombie"),
...     browser = new zombie.Browser({debug: true});
Erreur de segmentation

[cjoudrey]

Crashes at this line of browser.js:

newWindow._evalContext = new WindowContext(newWindow);

[briandailey]

Same issue here. Seg faults on any attempt to instantiate a browser.

Installed node.js via source, then npm, and then zombie.js.

[boblail]

Well, I'm anything but a C++ expert, so I put cerr << "something << endl; on almost every line in windowcontext.cc.

With the simple text case of

var zombie = require('zombie');
var browser = new zombie.Browser({debug: true});
browser.visit('http://google.com');

the Seg Fault is occurring on this line

result = script->Run();

in WindowContext::Evaluate.

It's actually being thrown the second time that line is encountered. The first time that line is run is after zombie reports

Zombie: Running script from http://google.com:0:0<script>

The second time is after:

Zombie: Running script from http://google.com

[boblail]

Also, I can get the test suite to run if I comment out the test that loads http://localhost:3003/script/write in script-spec.coffee: "adding script using document.write"

[boblail]

Just before script->Run(), script is constructed from source and filename.

The first time around source is an empty string and filename is "http://google.com:0:0<script>".

The second time filename is "http://google.com" and source seems to be truncated. (It is 425 characters long, but when I copy that block of script from the source of Google.com, it is 1346 characters...)

[boblail]

The value of code in
newWindow._evaluate = (code, filename)-> context.evaluate(code, filename)
in browser.coffee is truncated the same way...

[boblail]

I suspect the problem has something to do with the truncation.

The code that's being truncated starts with window.google=, so in jsdom_patches.coffee:57, I replaced code with the real value of the script tag (copied from google.com) when code.slice(0, 13) == 'window.google'. After doing this, the google.com test ran a dozen more scripts. It seg faulted again, but much later.

[armyofevilrobots]

The plot thickens: Ubuntu 10.10 x86_64, node 0.4.0, and zombie 0.9.1 via npm:

> var zombie = require('zombie');
> var browser = new zombie.Browser({debug: true});
[1]    9105 segmentation fault  node
➜  ~  

ltrace is less than useful, I'll try to run in gdb later on:

malloc(800)                                      = 0x0203f530
memmove(0x7f4a0bf23b60, 0x1fc4050, 81, 27, 1)    = 0x7f4a0bf23b60
memmove(0x7f4a0b9a40c0, 0x1fc504b, 5, 0x1e900000000, 1) = 0x7f4a0b9a40c0
free(0x0203f530)                                 = 
pthread_mutex_lock(0x1f610f8, 0x7f4a319a8079, 0x1f97b80, 10, 5) = 0
pthread_mutex_unlock(0x1f610f8, 0, 0x1f97b80, 10, 0x1f610f8) = 0
memcpy(0x01fa5dc8, "", 8)                        = 0x01fa5dc8
pthread_mutex_lock(0x1f610f8, 0x7f4a319a8079, 0x7f4a2d099471, 0x7f4a2c000000, 1776) = 0
pthread_mutex_unlock(0x1f610f8, 0, 0x7f4a2d099471, 0x7f4a2c000000, 0x1f610f8) = 0
strlen("RegExp")                                 = 6
strlen("String")                                 = 6
--- SIGSEGV (Segmentation fault) ---
+++ killed by SIGSEGV +++

[szimek]

I'm getting segmentation fault on OS X as well using node 0.4.1

> var zombie = require('zombie');
> var browser = new zombie.Browser({debug: true});
> browser.visit('http://google.com');
Zombie: GET http://google.com/
> Zombie: GET http://www.google.com/
Zombie: GET http://www.google.pl/
Zombie: GET http://www.google.pl/ => 200
Zombie: Running script from http://google.com:0:0<script>
Zombie: Running script from http://google.com
Segmentation fault

Seems to occur at https://github.com/assaf/zombie/blob/master/src/zombie/windowcontext.cc#L166

[ljackson]

I am new to zombie but have a need for headless testing so I started with the example listed and switch to google.com and starting seeing wierdness, before I went crazy i found this issue and dug a bit. Thanks for the hard work it does load my local site I need to test....

Appears with node v0.4.0 zombie at f53a4db I believe I may have found the oddness with google.com appears the zombie code parsing is not handling the chunked and/or gziped data and is getting only partials to send to the Evaluate method in zombie.

I have the following changes that show the issue:

http://pastebin.com/ujEKExLS

Also I was getting a segfault in the primitives interation as it was running off the end of the array so I added a nulll in the static SetPrimitive *WindowContext::primitives[] = { initization and checked for it in the for loop, maybe a vector would be better ?

When run on :
#test.js

var zombie = require("zombie");
var assert = require("assert");

var browser = new zombie.Browser({ debug: false});
browser.visit('http://google.com');

I get the following results w/o segfault now but still invalid....

node test.js
Test: :http://google.com:0:0<script>
Test: window.google={kEI:"CbhiTf3LFM6O_Aa3ramPAQ",kEXPI:"27893,28305,28454,28589,28607,28832",kCSI:{e:"27893,28305,28454,28589,28607,28832",ei:"CbhiTf3LFM6O_Aa3ramPAQ",expi:"27893,28305,28454,28589,28607,28832"},ml:function(){},kHL:"en",time:function(){return(new Date).getTime()},log:function(c,d,
b){var a=new Image,e=google,g=e.lc,f=e.li;a.onerror=(a.onload=(a.onabort=function(){delete g[f]}));g[f]=a;b=b||"/gen_204?atyp=i:http://google.com:0:0<script>
Test: Script errors
Test: window.google={kEI:"CbhiTf3LFM6O_Aa3ramPAQ",kEXPI:"27893,28305,28454,28589,28607,28832",kCSI:{e:"27893,28305,28454,28589,28607,28832",ei:"CbhiTf3LFM6O_Aa3ramPAQ",expi:"27893,28305,28454,28589,28607,28832"},ml:function(){},kHL:"en",time:function(){return(new Date).getTime()},log:function(c,d,
b){var a=new Image,e=google,g=e.lc,f=e.li;a.onerror=(a.onload=(a.onabort=function(){delete g[f]}));g[f]=a;b=b||"/gen_204?atyp=i&ct="+c+":http://google.com
Test: Script errors
Test: window.google={kEI:"CbhiTf3LFM6O_Aa3ramPAQ",kEXPI:"27893,28305,28454,28589,28607,28832",kCSI:{e:"27893,28305,28454,28589,28607,28832",ei:"CbhiTf3LFM6O_Aa3ramPAQ",expi:"27893,28305,28454,28589,28607,28832"},ml:function(){},kHL:"en",time:function(){return(new Date).getTime()},log:function(c,d,
b){var a=new Image,e=google,g=e.lc,f=e.li;a.onerror=(a.onload=(a.onabort=function(){delete g[f]}));g[f]=a;b=b||"/gen_204?atyp=i&ct="+c+"&cad="+d+":http://google.com
Test: Script errors
Test: window.google={kEI:"CbhiTf3LFM6O_Aa3ramPAQ",kEXPI:"27893,28305,28454,28589,28607,28832",kCSI:{e:"27893,28305,28454,28589,28607,28832",ei:"CbhiTf3LFM6O_Aa3ramPAQ",expi:"27893,28305,28454,28589,28607,28832"},ml:function(){},kHL:"en",time:function(){return(new Date).getTime()},log:function(c,d,
b){var a=new Image,e=google,g=e.lc,f=e.li;a.onerror=(a.onload=(a.onabort=function(){delete g[f]}));g[f]=a;b=b||"/gen_204?atyp=i&ct="+c+"&cad="+d+"&zx="+google.time();a.src=b;e.li=f+1},lc:[],li:0,Toolbelt:{}};
window.google.sn="webhp";var i=window.google.timers={};window.google.startTick=function(a,b){i[a]={t:{start:(new Date).getTime()},bfr:!(!b)}};window.google.tick=function(a,b,c){if(!i[a])google.startTick(a);i[a].t[b]=c||(new Date).getTime()};google.startTick("load",true);try{}catch(v){}
window.google.jsrt_kill=1;
var _gjwl=location;function _gjuc(){var e=_gjwl.href.indexOf("#");if(e:http://google.com
Test: Script errors
Test: window.google={kEI:"CbhiTf3LFM6O_Aa3ramPAQ",kEXPI:"27893,28305,28454,28589,28607,28832",kCSI:{e:"27893,28305,28454,28589,28607,28832",ei:"CbhiTf3LFM6O_Aa3ramPAQ",expi:"27893,28305,28454,28589,28607,28832"},ml:function(){},kHL:"en",time:function(){return(new Date).getTime()},log:function(c,d,
b){var a=new Image,e=google,g=e.lc,f=e.li;a.onerror=(a.onload=(a.onabort=function(){delete g[f]}));g[f]=a;b=b||"/gen_204?atyp=i&ct="+c+"&cad="+d+"&zx="+google.time();a.src=b;e.li=f+1},lc:[],li:0,Toolbelt:{}};
window.google.sn="webhp";var i=window.google.timers={};window.google.startTick=function(a,b){i[a]={t:{start:(new Date).getTime()},bfr:!(!b)}};window.google.tick=function(a,b,c){if(!i[a])google.startTick(a);i[a].t[b]=c||(new Date).getTime()};google.startTick("load",true);try{}catch(v){}
window.google.jsrt_kill=1;
var _gjwl=location;function _gjuc(){var e=_gjwl.href.indexOf("#");if(e>=0){var a=_gjwl.href.substring(e);if(a.indexOf(":http://google.com
Test: Script errors

This continues a while.... then it hangs node so not sure whats up there.

Thanks,
Leif

[assaf]

The hardest issues to debug always come in threes.

There's a seg fault issue in 0.9.1. I left the array terminator out, so it would seg fault trying to read past the end of the array. That happens on Linux, but the code works fine on OS X (at least in my dev environment). If this bug affects you, Zombie will blow up trying to create a new Browser object.

Fixed in 0.9.2.

There's a contexts in 0.9.1. If the JavaScript throws an exception, it will propagate up the stack but Zombie does not switch the contexts back. I'm not sure if that's responsible for any of the errors discussed above. Worth checking again.

Also fixed in 0.9.2.

Some scripts seg fault when they're evaluated. The best that I could tell, this is a combination of two unrelated bugs. One bug is in the way scripts are extracted form the HTML document and passed to Zombie. If a script has & in it, it would be truncated and passed on to Zombie for evaluation as a partial script ending in "&".

This should raise an "unexpected end of input", but either bug in V8 or the way I've been using the V8 API, causes Zombie to seg fault. You can try this at home:

browser.evaluate "1 &&"

I don't have a fix for either of these two issues yet.

If any of you could help me trace down the truncation issue, that would be great help.

[armyofevilrobots]

Confirmed that the newest version of Zombie 0.9.4 built on Ubuntu 10.10 64 bit and ran the test suite without errors ✓ OK » 295 honored (2.764s).

The simple google test so many people complained with runs flawlessly afaict, with no segfault, happily ticking along on window timeouts.

Thanks so much! This lets me get back to my functional test harness.

[szimek]

Just tested it on OS X and I don't get segfaults anymore as well.

However with jsdom 0.2.0 some tests fail - 2 in browser-spec.coffee and 4 in eventloop-spec.coffee

[assaf]

Closing since this is fixed.

[kvz]

I have the same problem when running with browser.runScripts = true; on a company page here.
Probably a bug in my js code or something? However the dump is huge and the errors I find in them don't give clues how to solve it.

Any ideas to workaround this? Or show more useful debugging info?

[benbuckman]

I'm still getting this, on browser.close(). Please re-open.

[marlun]

I'm getting it on browser.visit() on node 0.9.8 and zombie 1.4.1

[umbrella-mikhail-menshinskiy]

I'm getting it too. Please re-open the ticket, problem isn't solved

[al6x]

Mac OS, Zombie 1.4.1 in half of test runs tests failed with "Segmentation fault: 11". Looks like random, can't provide details how to reproduce.