Assertion failed: ((start) <= (end)), function SliceOnto, file ../src/smalloc.cc

[cperryk]

I'm getting this fatal error running a script in io.js that I don't get running the same script in node.js:

Assertion failed: ((start) <= (end)), function SliceOnto, file ../src/smalloc.cc
Abort trap: 6

I have no idea how to go about fixing this, and I don't know what/where this smalloc.cc file is.

What my script does is use MailParser to parse the text of an email into a js object. It gets a readstream of an email, pipes that into MailParser, but this error always triggers at the same line (names redacted):

To: Foo bar <foobar@foobar>, foo bar <foobar@foobar>

So, not sure if this is a MailParser error, but it seems likely to be something else considering it works fine in node.

[micnic]

Hi, I tried the example from the module's readme, modified fields and everything seems to work fine. Would you mind to add a minimal sequence of code which can trigger this error?

[cperryk]

I'll try!

[Fishrock123]

@cperryk Can we get some code to reproduce with?

[cperryk]

Having some trouble with that. I can't reproduce the issue by downloading the email individually or just feeding its text to MailParser manually. Might just want to consider this closed unless I find more clues.

[micnic]

Ok, will be closed until you can reproduce this bug

[trevnorris]

@cperryk A couple others have also reported this. If you can come up with any number of steps to reproduce I'll take a look. Thanks.

[dchest]

Issue in Node tracker: nodejs/node-v0.x-archive#9180

[dchest]

I suspect an issue somewhere in fs.writeSync when the argument is a string.

@trevnorris can you please take a look if the issue is in this line:

https://github.com/iojs/io.js/blob/v1.x/lib/fs.js#L659

Are the arguments to binding.writeString correct? (Introduced in commit 7ca77ea).

[Fishrock123]

@dchest might be on to something? https://github.com/iojs/io.js/blob/v1.x/src/node_file.cc#L794-L802

[dchest]

Okay, [convoluted] steps to reproduce:

1. git clone https://github.com/dchest/tweetnacl-js
2. cd tweetnacl-js
3. make -C test/c
4. npm install tape
5. ./node_modules/.bin/tape test/c/00-secretbox.js test/c/01-scalarmult.js
6. wait while lots of lines appear on the screen, then get:

Assertion failed: (end <= source_len), function SliceOnto, file ../src/smalloc.cc, line 280.

Looks unrelated to the particular project (tweetnacl-js), and appears in tape (here?), as running without tape won't cause the assertion.

Backtrace (sorry, without JS symbols):

(lldb) bt
* thread #1: tid = 0x3e9a6d, 0x00007fff9068c286 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x00007fff9068c286 libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x00007fff938de42f libsystem_pthread.dylib`pthread_kill + 90
    frame #2: 0x00007fff94d75b53 libsystem_c.dylib`abort + 129
    frame #3: 0x00007fff94d3dc39 libsystem_c.dylib`__assert_rtn + 321
    frame #4: 0x0000000100465224 node`node::smalloc::SliceOnto(v8::FunctionCallbackInfo<v8::Value> const&) + 650
    frame #5: 0x0000000100134963 node`v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo<v8::Value> const&)) + 159
    frame #6: 0x0000000100150cf9 node`v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) + 538
    frame #7: 0x00001658aa20740e
    frame #8: 0x00001658aa4f7d07
    frame #9: 0x00001658aa232de6
    frame #10: 0x00001658aa375524
    frame #11: 0x00001658aa423532
    frame #12: 0x00001658aa25e0a6
    frame #13: 0x00001658aa30fd57
    frame #14: 0x00001658aa207b75
    frame #15: 0x00001658aa4ce3a7
    frame #16: 0x00001658aa25e0a6
    frame #17: 0x00001658aa30fd57
    frame #18: 0x00001658aa4cdd16
    frame #19: 0x00001658aa4cd365
    frame #20: 0x00001658aa25b1c0
    frame #21: 0x00001658aa228d31
    frame #22: 0x00000001001d49ee node`v8::internal::Invoke(bool, v8::internal::Handle<v8::internal::JSFunction>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) + 419
    frame #23: 0x000000010012247c node`v8::Function::Call(v8::Handle<v8::Value>, int, v8::Handle<v8::Value>*) + 224
    frame #24: 0x00000001004415b8 node`node::MakeCallback(node::Environment*, v8::Handle<v8::Value>, v8::Handle<v8::Function>, int, v8::Handle<v8::Value>*) + 618
    frame #25: 0x0000000100447bf7 node`node::CheckImmediate(uv_check_s*) + 98
    frame #26: 0x00000001004aa921 node`uv__run_check + 33
    frame #27: 0x00000001004a6b98 node`uv_run + 257
    frame #28: 0x00000001004477ae node`node::Start(int, char**) + 342
    frame #29: 0x00000001000033b4 node`start + 52

[Fishrock123]

Doesn't seem like the fs.writeSync thing is directly an issue. I can't get this to fail:

var fs = require('fs')

fs.open('./test', 'w', function(err, fd) {
  if (err) return console.log(err)

  fs.writeSync(fd, 'hello world1', /* insert whatever the heck you want */)
})

[dchest]

@Fishrock123 agreed, looks like the arguments in binding.writeString are in the proper order, except position can be removed.

[trevnorris]

@dchest Thanks. I can get the script to fail using that method.

[trevnorris]

The failure comes from Buffer where it attempts to slice a chunk from the pool. I'm not exactly sure how that's possible, but looking into it.

[trevnorris]

To confirm that, set Buffer.poolSize = 0; at the top of the test and you'll see it never fails.

[trevnorris]

Fixed by c6fd2c5.

[dchest]

@trevnorris great job, thank you!

[trevnorris]

@dchest Np. And thank you for the reproducible test case. Without it I wouldn't have found the problem. :)