Fatal error in ../deps/v8/src/hydrogen-instructions.cc when running node built with --debug

[misterdjules]

Instructions on how to reproduce this problem pasted from https://gist.github.com/metamatt/b2aca06fb424559fa7b7 to prevent them from disappearing if that gist is deleted at some point. Also, these instructions have been edited slightly to be more generic.

1. Check out node v0.10 branch (edited from the original gist)
2. ./configure --debug (edited from the original gist)
3. make
4. copy/symlink out/Debug/node so it's the node binary on your path
5. create a package.json with the following contents

{
  "dependencies": {
    "archiver": "0.13",
    "connect": "~2.15.0"
  }
}

1. npm install archiver connect

This will crash with

#
# Fatal error in ../deps/v8/src/hydrogen-instructions.cc, line 641
# CHECK(cur == other_operand) failed
#


==== Stack trace ============================================

Security context: 0x3961e3e06b71 <JS Object>#0#
    2: replace(aka replace) [native string.js:~221] (this=0xe394f8ce981 <String[14]: >=0.3.0 <0.4.0>,a=0x171a6045d3a1 <JS RegExp>#1#,b=0x171a604591c9 <JS Function hyphenReplace>#2#)
    3: parseRange [/usr/lib/node_modules/npm/node_modules/semver/semver.js:686] (this=0xe394f7c3ae9 <a Range>#3#,range=0xe394f8ce981 <String[14]: >=0.3.0 <0.4.0>)
    4: /* anonymous */ [/usr/lib/node_modules/npm/node_modules/semver/semver.js:652] (this=0xe394f7c3ae9 <a Range>#3#,range=0xe394f8ce981 <String[14]: >=0.3.0 <0.4.0>)
    5: arguments adaptor frame: 3->1
    6: map [native array.js:~1215] (this=0xe394f7c3b69 <JS Array[1]>#4#,a=0xe394f7c3c21 <JS Function>#5#,b=0xe394f7c3ae9 <a Range>#3#)
    7: new constructor(aka Range) [/usr/lib/node_modules/npm/node_modules/semver/semver.js:~640] (this=0xe394f7c3ae9 <a Range>#3#,range=0xe394f8ce981 <String[14]: >=0.3.0 <0.4.0>,loose=0x3961e3e04141 <true>)
    9: satisfies [/usr/lib/node_modules/npm/node_modules/semver/semver.js:1016] (this=0x3961e3e06c91 <JS Global Object>#6#,version=0x1f05f2fb2b41 <String[5]: 0.2.7>,range=0xe394f8ce981 <String[14]: >=0.3.0 <0.4.0>,loose=0x3961e3e04141 <true>)
   10: /* anonymous */ [/usr/lib/node_modules/npm/node_modules/semver/semver.js:~1025] (this=0x3961e3e06c91 <JS Global Object>#6#,version=0x1f05f2fb2b41 <String[5]: 0.2.7>)
   11: arguments adaptor frame: 3->1
   12: filter [native array.js:~1036] (this=0xe394f79e129 <JS Array[28]>#7#,a=0xe394f79e189 <JS Function>#8#,b=0x3961e3e04121 <undefined>)
   13: arguments adaptor frame: 1->2
   14: maxSatisfying [/usr/lib/node_modules/npm/node_modules/semver/semver.js:1025] (this=0x171a60455e91 <JS Function SemVer>#9#,versions=0xe394f79e129 <JS Array[28]>#7#,range=0xe394f8ce981 <String[14]: >=0.3.0 <0.4.0>,loose=0x3961e3e04141 <true>)
   15: next [/usr/lib/node_modules/npm/lib/cache/add-named.js:236] (this=0x3961e3e06c91 <JS Global Object>#6#)
   16: setData [/usr/lib/node_modules/npm/lib/cache/add-named.js:215] (this=0x3961e3e06c91 <JS Global Object>#6#,er=0x3961e3e04121 <undefined>,d=0xe394f720401 <an Object>#10#,json=0xe394f7853d9 <Very long string[33889]>#11#,resp=0xe394f78d859 <an Object>#12#)
   18: RES [/usr/lib/node_modules/npm/node_modules/inflight/inflight.js:23] (this=0x3961e3e06c91 <JS Global Object>#6#)
   19: arguments adaptor frame: 4->0
   21: /* anonymous */ [/usr/lib/node_modules/npm/node_modules/once/once.js:17] (this=0x3961e3e06c91 <JS Global Object>#6#)
   22: arguments adaptor frame: 4->0
   23: get_ [/usr/lib/node_modules/npm/lib/cache/caching-client.js:118] (this=0xc26bc5bb2e9 <a CachingRegistryClient>#13#,uri=0xe394f8df791 <String[36]: https://registry.npmjs.org/minimatch>,cachePath=0xe394f8e5021 <String[56]: /home/magi/.npm/registry.npmjs.org/minimatch/.cache.json>,params=0xe394f8e09f9 <an Object>#14#,cb=0xe394f8e0169 <JS Function>#15#)
   24: /* anonymous */ [/usr/lib/node_modules/npm/lib/cache/caching-client.js:87] (this=0x3961e3e06c91 <JS Global Object>#6#,er=0x3961e3e04101 <null>,data=0xe394f720401 <an Object>#10#)
   25: /* anonymous */ [evalmachine.<anonymous>:271] (this=0x3961e3e06c91 <JS Global Object>#6#,er=0x3961e3e04101 <null>)
   26: /* anonymous */ [/usr/lib/node_modules/npm/node_modules/graceful-fs/graceful-fs.js:102] (this=0x3961e3e06c91 <JS Global Object>#6#,er=0x3961e3e04101 <null>)
   28: oncomplete [evalmachine.<anonymous>:107] (this=0xe394f704d51 <an Object>#16#)
   29: arguments adaptor frame: 1->0

(plus a much longer tail of V8 debug information)

It will also leave a core; if you invoke gdb node core you'll be able to decode the stack trace for the native code into something like

Core was generated by `npm                                       '.
Program terminated with signal 5, Trace/breakpoint trap.
#0  v8::internal::OS::DebugBreak () at ../deps/v8/src/platform-linux.cc:415
415 }
(gdb) bt
#0  v8::internal::OS::DebugBreak () at ../deps/v8/src/platform-linux.cc:415
#1  0x0000000000c87088 in v8::internal::OS::Abort () at ../deps/v8/src/platform-linux.cc:397
#2  0x00000000008e9210 in V8_Fatal (file=0xdb4a08 "../deps/v8/src/hydrogen-instructions.cc", line=641, format=0xdb3c95 "CHECK(%s) failed")
    at ../deps/v8/src/checks.cc:58
#3  0x00000000009a7875 in v8::internal::HInstruction::Verify (this=0x1cb8ae0) at ../deps/v8/src/hydrogen-instructions.cc:641
#4  0x00000000009bddd0 in v8::internal::HGraph::Verify (this=0x170dd90, do_full_verify=false) at ../deps/v8/src/hydrogen.cc:503
#5  0x00000000009e6a7b in v8::internal::HPhase::End (this=0x7fff54414d30) at ../deps/v8/src/hydrogen.cc:9979
#6  0x00000000008f7186 in v8::internal::HPhase::~HPhase (this=0x7fff54414d30, __in_chrg=<optimized out>) at ../deps/v8/src/hydrogen.h:1389
#7  0x00000000009c876f in v8::internal::HGraph::EliminateRedundantBoundsChecks (this=0x170dd90) at ../deps/v8/src/hydrogen.cc:3698
#8  0x00000000009c8246 in v8::internal::HGraph::Optimize (this=0x170dd90, bailout_reason=0x7fff54414f00) at ../deps/v8/src/hydrogen.cc:3359
#9  0x00000000008f2044 in v8::internal::OptimizingCompiler::OptimizeGraph (this=0x7fff54414f50) at ../deps/v8/src/compiler.cc:359
#10 0x00000000008f13ba in v8::internal::MakeCrankshaftCode (info=0x7fff54415120) at ../deps/v8/src/compiler.cc:209
#11 0x00000000008f22c3 in v8::internal::GenerateCode (info=0x7fff54415120) at ../deps/v8/src/compiler.cc:393
#12 0x00000000008f235b in v8::internal::MakeCode (info=0x7fff54415120) at ../deps/v8/src/compiler.cc:409
#13 0x00000000008f3d8b in v8::internal::Compiler::CompileLazy (info=0x7fff54415120) at ../deps/v8/src/compiler.cc:815
#14 0x0000000000a86e11 in v8::internal::CompileLazyHelper (info=0x7fff54415120, flag=v8::internal::CLEAR_EXCEPTION) at ../deps/v8/src/objects.cc:7563
#15 0x0000000000a87780 in v8::internal::JSFunction::CompileOptimized (function=..., osr_ast_id=..., flag=v8::internal::CLEAR_EXCEPTION)
    at ../deps/v8/src/objects.cc:7666
#16 0x0000000000b12253 in v8::internal::Runtime_LazyRecompile (args=..., isolate=0x1565070) at ../deps/v8/src/runtime.cc:7925
#17 0x00003573bf506362 in ?? ()
#18 0x000000ae00000000 in ?? ()
#19 0x00003573bf5062c1 in ?? ()
#20 0x00007fff54415280 in ?? ()

[misterdjules]

Adding as a P-1 issue since it has already prevented people to investigate other issues by building a debug build of node. See #25495 and https://groups.google.com/d/topic/nodejs/5oWZwM7esD0/discussion.

[misterdjules]

Moving to milestone v0.10.40, as v0.10.39 was released today.

[whitlockjc]

I'd like to look into this. Any chance this will end up with a mentor-available label? ;)

[whitlockjc]

I am unable to reproduce this. I followed the steps @misterdjules provided and I tried two different variations for using the built node executable:

• Keeping node in build directory:
  • export PATH=${NODE_SRC_PATH}/out/Release:$PATH
  • (Follow Julien's instructions)
• Copying node into another directory:
  • cp ${NODE_SRC_PATH}/out/Release/node /tmp
  • export PATH=/tmp:$PATH
  • (Follow Julien's instructions)

Both versions of this, on Ubuntu 12.04 LTS 64-bit, end up with npm install archiver connect running without issue. No crash, no core dump...

[whitlockjc]

Can anyone else try to reproduce this?