Node 12 crashes at node::BaseObject::InternalFieldSet

[paglias]

• Version: 12.16.1
• Platform: docker container running on GKE
• Subsystem:

What steps will reproduce the bug?

Not known.

How often does it reproduce? Is there a required condition?

Not known.

What is the expected behavior?

No crash?

What do you see instead?

We're having issues with our nodejs based web server where, in production, it crashes with the following stack trace:

/usr/local/bin/node[78]: ../src/base_object-inl.h:140:static void node::BaseObject::InternalFieldSet(v8::Local<v8::String>, v8::Local<v8::Value>, const v8::PropertyCallbackInfo<void>&) [with int Field = 2; bool (v8::Value::* typecheck)() const = &v8::Value::IsFunction]: Assertion `((*value)->*typecheck)()' failed.
0x9bcb80 node::Abort() [/usr/local/bin/node]
0x9bcc07 [/usr/local/bin/node]
0xa6a262 [/usr/local/bin/node]
0xea39cc v8::internal::Object::SetPropertyWithAccessor(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>) [/usr/local/bin/node]
0xec033b v8::internal::Object::SetPropertyInternal(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>, v8::internal::StoreOrigin, bool*) [/usr/local/bin/node]
0xec04a3 v8::internal::Object::SetProperty(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) [/usr/local/bin/node]
0xfe46d7 v8::internal::Runtime::SetObjectProperty(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) [/usr/local/bin/node]
0xfe579a v8::internal::Runtime_SetKeyedProperty(int, unsigned long*, v8::internal::Isolate*) [/usr/local/bin/node]
0x134e879 [/usr/local/bin/node]

Additional information

I'm sorry for the lack of extra information but this is the only logs we've been able to obtain and unfortunately we don't have a way to reproduce it.

We're running several instances of our express.js based server using the cluster module to create multiple processes. We get these crashes quite often but we've not been able to link them to any precise action.

[addaleax]

@paglias Yeah, more information would definitely be helpful here. In particular, a core dump or a JS strack trace would help a lot, if you can generate one. (A core dump should provide a JS stack trace.)

Most likely, what’s happening is that the .onread property of an internal stream handle is set to something that’s not a function. That does not appear to happen, however, in Node’s own source, so it’s most likely that your code or the code of one of your npm packages is messing with Node’s internals, which is obviously bound to go wrong earlier or later.

[paglias]

@addaleax thanks! I'll try to get a core dump (although it may take some time as right now I'm not able to reproduce it outside of our production environment)

Do you know how I could try to get a JS stack trace out of it without a core dump? Or how to narrow down the npm package / internal code that might be causing this?

[addaleax]

@addaleax thanks! I'll try to get a core dump (although it may take some time as right now I'm not able to reproduce it outside of our production environment)

Thanks!

Do you know how I could try to get a JS stack trace out of it without a core dump?

Not really, unless attaching a debugger and waiting for the crash to happen is an option? But that seems harder than getting a core dump.

Or how to narrow down the npm package / internal code that might be causing this?

You could grep around for packages that contain the words onread and/or _handle. It might give you a number of false positives, though.

[paglias]

I managed to find out the source of this, it's the clone npm package used by one of our dependencies, which is downloaded 12m times a month but they don't seem interested in fixing it pvorb/clone#106

anyway, thanks @addaleax for the help earlier, I'm going to close the issue