V8 Segfault - difficult to reproduce

[tejohnso]

I'm getting a segfault in the renderer process on both win64 and lnx64. I've not yet isolated a minimal test case but the interrupt always occurs at NewFromUtf8.

Program received signal SIGSEGV, Segmentation fault.
0x00007f0f7cacba08 in v8::String::NewFromUtf8(v8::Isolate_, char const_, v8::String::NewStringType, int) ()

This is on the latest release 1.2.2.

[enlight]

Is there a stack trace or a crash dump?

[tejohnso]

Program received signal SIGABRT, Aborted.
0x00007f0f6fcd1cc9 in GI_raise (sig=sig@entry=6)
at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) where
#0 0x00007f0f6fcd1cc9 in GI_raise (sig=sig@entry=6)
at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007f0f6fcd50d8 in GI_abort () at abort.c:89
#2 0x00007f0f7b56f992 in base::debug::BreakDebugger() ()
from app/libbase.so
#3 0x00007f0f7b570564 in ?? ()
from app/libbase.so
#4
#5 0x00007f0f7cacba08 in v8::String::NewFromUtf8(v8::Isolate, char const, v8::String::NewStringType, int) ()
from app/libv8.so
#6 0x0000000000977592 in mate::Converterbase::BasicStringPiece<std::string, void>::ToV8(v8::Isolate, base::BasicStringPiecestd::string const&) ()
#7 0x0000000000905aad in v8::Localv8::Value mate::ConvertToV8base::BasicStringPiece<std::string >(v8::Isolate, base::BasicStringPiecestd::string const&) ()
#8 0x00000000009059fd in mate::StringToV8(v8::Isolate, base::BasicStringPiecestd::string const&) ()
#9 0x0000000000930cfb in v8::Localv8::Value mate::EmitEvent<char [5]>(v8::Isolate, v8::Localv8::Object, char const (&) [5]) ()
#10 0x0000000000930245 in atom::AtomRendererClient::WillReleaseScriptContext(v8::Localv8::Context, content::RenderFrame*) ()

[zcbenz]

I don't have any idea from the stack trace.

[tejohnso]

Aside from trying to create a repeatable minimal test case, is there something else that would help?

[tejohnso]

I found ELECTRON_ENABLE_STACK_DUMPING and received a dump that might be more helpful

Received signal 11 SEGV_MAPERR 000c00000000
#0 0x7f304dc62d6b
#1 0x7f304861d340
#2 0x0000008e062c node::Environment::isolate()
#3 0x00000093021d atom::AtomRendererClient::WillReleaseScriptContext()
#4 0x000000930569 atom::(anonymous namespace)::AtomRenderFrameObserver::WillReleaseScriptContext()
#5 0x7f3049f6a4ea content::RenderFrameImpl::willReleaseScriptContext()
#6 0x7f304b3f8d34
#7 0x7f304b3faed0 blink::WindowProxyManager::clearForClose()
#8 0x7f304b3c39fa blink::ScriptController::clearForClose()
#9 0x7f304b92f60d blink::LocalFrame::detach()
#10 0x7f304b907a8b blink::Frame::detachChildren()
#11 0x7f304b92f57e blink::LocalFrame::detach()
#12 0x7f304bacb925
#13 0x7f304bad0ae7 blink::ContainerNode::willRemoveChild()
#14 0x7f304bad08ad blink::ContainerNode::removeChild()
#15 0x7f304bb35c77 blink::Node::removeChild()
#16 0x7f304b551264
#17 0x7f304f1d0faa v8::internal::FunctionCallbackArguments::Call()
#18 0x7f304f203be4
#19 0x7f304f20e6ef
#20 0x35fe7c9092a7
r8: 00007f3049f6a520 r9: 0000000000000007 r10: 0000280d16a0c880 r11: 000000004140e967
r12: 00007fffc8d56d58 r13: 00007fffc8d570a0 r14: 0000000000000000 r15: 0000299aedb8b048
di: 0000000c00000000 si: 0000000000000110 bp: 00007fffc8d56c90 bx: 00007fffc8d56d38
dx: 0000299aedb8b048 ax: 0000000c00000000 cx: 0000299aedb8b048 sp: 00007fffc8d56c90
ip: 00000000008e062c efl: 0000000000010206 cgf: 0000000000000033 erf: 0000000000000004
trp: 000000000000000e msk: 0000000000000000 cr2: 0000000c00000000
[end of stack trace]

This one as well

Received signal 11 000000000000
#0 0x7f6f9e75fd6b
#1 0x7f6f9911a340
#2 0x7f6f9fcbaa08 v8::String::NewFromUtf8()
#3 0x000000977592 mate::Converter<>::ToV8()
#4 0x000000905aad mate::ConvertToV8<>()
#5 0x0000009059fd mate::StringToV8()
#6 0x000000930cfb ZN4mate9EmitEventIA5_cJEEEN2v85LocalINS2_5ValueEEEPNS2_7IsolateENS3_INS2_6ObjectEEERKT_DpRKT0
#7 0x000000930245 atom::AtomRendererClient::WillReleaseScriptContext()
#8 0x000000930569 atom::(anonymous namespace)::AtomRenderFrameObserver::WillReleaseScriptContext()
#9 0x7f6f9aa674ea content::RenderFrameImpl::willReleaseScriptContext()
#10 0x7f6f9bef5d34
#11 0x7f6f9bef7ed0 blink::WindowProxyManager::clearForClose()
#12 0x7f6f9bec09fa blink::ScriptController::clearForClose()
#13 0x7f6f9c42c60d blink::LocalFrame::detach()
#14 0x7f6f9c404a8b blink::Frame::detachChildren()
#15 0x7f6f9c42c57e blink::LocalFrame::detach()
#16 0x7f6f9c5c8925
#17 0x7f6f9c5cdae7 blink::ContainerNode::willRemoveChild()
#18 0x7f6f9c5cd8ad blink::ContainerNode::removeChild()
#19 0x7f6f9c632c77 blink::Node::removeChild()
#20 0x7f6f9c04e264
#21 0x7f6f9fccdfaa v8::internal::FunctionCallbackArguments::Call()
#22 0x7f6f9fd00be4
#23 0x7f6f9fd0b6ef
#24 0x0008443092a7
r8: 00007f6f9aa67520 r9: 0000000000000007 r10: 00001d93dbb4ce00 r11: 0000000018bf2ba7
r12: 00007ffc73a5c7f8 r13: 00007ffc73a5cb40 r14: 0000000000c97c79 r15: 4100002145bb7f29
di: 4100002145bb7f29 si: 0000000000c97c79 bp: 0000000000000000 bx: 0000000000000004
dx: 0000000000000000 ax: 0000000000000000 cx: 0000000000000004 sp: 00007ffc73a5c5a0
ip: 00007f6f9fcbaa08 efl: 0000000000010287 cgf: 0000000000000033 erf: 0000000000000000
trp: 000000000000000d msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]

[juturu]

Posting the following stack trace as well which i was able to hit with debugger on.

INVALID_POINTER_WRITE
Tid [0x3b0c]
Frame [0x00]: v8!v8::CpuProfileNode::GetHitLineCount

LAST_CONTROL_TRANSFER: from 6a815e93 to 6a80047a

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
6ac2ac2c v8!v8::CpuProfileNode::GetHitLineCount+0xadba
017b8348 v8!v8::String::NewFromUtf8+0x23
0018de64 electron!mate::Converterbase::BasicStringPiece<std::basic_string<char,std::char_traits<char,std::allocator > >,void>::ToV8+0x30
0018de64 electron!mate::ConvertToV8base::BasicStringPiece<std::basic_string<char,std::char_traits<char,std::allocator > > >+0x14
0018de64 electron!mate::StringToV8+0x20
68000000 electron!mate::EmitEvent<char [5]>+0x52
0a35c390 electron!atom::AtomRendererClient::WillReleaseScriptContext+0x74
5bf48628 electron!atom::`anonymous namespace'::AtomRenderFrameObserver::WillReleaseScriptContext+0x31