segmentation fault on arm platform while creating snapshot

[meixg]

Linux 5.10.0-1.1.0.7 #1 SMP Wed Nov 24 12:22:03 UTC 2021 aarch64 aarch64 aarch64 GNU/Linux

x86 is ok.

isolated-vm version: 4.4.2
marked version: 4.3.0

how to reproduce:

const ivm = require('isolated-vm');
const fs = require('fs');
const path = require('path');

const markedCode = fs.readFileSync(path.resolve(__dirname, './node_modules/marked/lib/marked.cjs'), 'utf8');

const snapshot = new ivm.Isolate.createSnapshot([
    {
        code: `function marked(exports, require, module, __dirname) {
            ${markedCode}
        }`
    },
    {
        code: `
        const module = {exports: {}};
        const dirname = '${require.resolve('marked')}';
        marked(module.exports, () => {}, module, dirname);
        module.exports.marked.parse('==');
        module.exports.marked.parse('==');
        `
    }
]);

output:

Segmentation fault

core dump:

(llnode) bt
error: need to add support for DW_TAG_base_type 'auto' encoded with DW_ATE = 0x0, bit_size = 0
* thread #1, name = 'node', stop reason = signal SIGSEGV
  * frame #0: 0x00000000010d2d08 node`v8::internal::SerializerAllocator::EncodeReservations() const + 192
    frame #1: 0x00000000010eca78 node`v8::internal::SnapshotData::SnapshotData(v8::internal::Serializer const*) + 72
    frame #2: 0x00000000010ef43c node`v8::internal::Snapshot::Create(v8::internal::Isolate*, std::vector<v8::internal::Context, std::allocator<v8::internal::Context> >*, std::vector<v8::SerializeInternalFieldsCallback, std::allocator<v8::SerializeInternalFieldsCallback> > const&, v8::internal::PerThreadAssertScopeDebugOnly<(v8::internal::PerThreadAssertType)0, false> const&, v8::base::Flags<v8::internal::Snapshot::SerializerFlag, int>) + 212
    frame #3: 0x0000000000bebf94 node`v8::SnapshotCreator::CreateBlob(v8::SnapshotCreator::FunctionCodeHandling) + 1188
    frame #4: 0x0000fffd6834cfb4 isolated_vm.node`ivm::IsolateHandle::CreateSnapshot(script_handles=<unavailable>, warmup_handle=<unavailable>) at isolate_handle.cc:556:86
    frame #5: 0x0000fffd68357838 isolated_vm.node`ivm::detail::CallbackMaker<v8::Local<v8::Value> (*)(ivm::ArrayRange, v8::MaybeLocal<v8::String>), &(ivm::IsolateHandle::CreateSnapshot(ivm::ArrayRange, v8::MaybeLocal<v8::String>)), 0, v8::FunctionCallbackInfo<v8::Value> const&>::Callback(v8::FunctionCallbackInfo<v8::Value> const&) [inlined] void ivm::detail::CallbackMaker<v8::Local<v8::Value> (*)(ivm::ArrayRange, v8::MaybeLocal<v8::String>), &(ivm::IsolateHandle::CreateSnapshot(ivm::ArrayRange, v8::MaybeLocal<v8::String>)), 0, v8::FunctionCallbackInfo<v8::Value> const&>::Spread<0ul, 1ul>(this=<unavailable>)::'lambda'()::operator()() const at callbacks.h:108:20
    frame #6: 0x0000fffd68357740 isolated_vm.node`ivm::detail::CallbackMaker<v8::Local<v8::Value> (*)(ivm::ArrayRange, v8::MaybeLocal<v8::String>), &(ivm::IsolateHandle::CreateSnapshot(ivm::ArrayRange, v8::MaybeLocal<v8::String>)), 0, v8::FunctionCallbackInfo<v8::Value> const&>::Callback(v8::FunctionCallbackInfo<v8::Value> const&) [inlined] _ZN3ivm6detail17InvokeWithoutVoidIZNS0_13CallbackMakerIPFN2v85LocalINS3_5ValueEEENS_10ArrayRangeENS3_10MaybeLocalINS3_6StringEEEEXadL_ZNS_13IsolateHandle14CreateSnapshotES7_SA_EELi0EJRKNS3_20FunctionCallbackInfoIS5_EEEE6SpreadIJLm0ELm1EEEEvSH_St16integer_sequenceImJXspT_EEEEUlvE_EEDcT_PNSt9enable_ifIXntsrSt7is_sameIvDTclfL0p_EEE5valueEvE4typeE((null)=<unavailable>, function=<unavailable>) at callbacks.h:71
    frame #7: 0x0000fffd68357740 isolated_vm.node`ivm::detail::CallbackMaker<v8::Local<v8::Value> (*)(ivm::ArrayRange, v8::MaybeLocal<v8::String>), &(ivm::IsolateHandle::CreateSnapshot(ivm::ArrayRange, v8::MaybeLocal<v8::String>)), 0, v8::FunctionCallbackInfo<v8::Value> const&>::Callback(v8::FunctionCallbackInfo<v8::Value> const&) at callbacks.h:100
    frame #8: 0x0000fffd68357740 isolated_vm.node`ivm::detail::CallbackMaker<v8::Local<v8::Value> (*)(ivm::ArrayRange, v8::MaybeLocal<v8::String>), &(ivm::IsolateHandle::CreateSnapshot(ivm::ArrayRange, v8::MaybeLocal<v8::String>)), 0, v8::FunctionCallbackInfo<v8::Value> const&>::Callback(v8::FunctionCallbackInfo<v8::Value> const&) at callbacks.h:118
    frame #9: 0x0000fffd68357740 isolated_vm.node`ivm::detail::CallbackMaker<v8::Local<v8::Value> (*)(ivm::ArrayRange, v8::MaybeLocal<v8::String>), &(ivm::IsolateHandle::CreateSnapshot(ivm::ArrayRange, v8::MaybeLocal<v8::String>)), 0, v8::FunctionCallbackInfo<v8::Value> const&>::Callback(v8::FunctionCallbackInfo<v8::Value> const&) [inlined] void ivm::detail::RunBarrier<ivm::detail::CallbackMaker<v8::Local<v8::Value> (*)(ivm::ArrayRange, v8::MaybeLocal<v8::String>), &(ivm::IsolateHandle::CreateSnapshot(ivm::ArrayRange, v8::MaybeLocal<v8::String>)), 0, v8::FunctionCallbackInfo<v8::Value> const&>::Callback(v8::FunctionCallbackInfo<v8::Value> const&)::'lambda'()>(fn=<unavailable>)(ivm::ArrayRange, v8::MaybeLocal<v8::String>), &(ivm::IsolateHandle::CreateSnapshot(ivm::ArrayRange, v8::MaybeLocal<v8::String>)), 0, v8::FunctionCallbackInfo<v8::Value> const&>::Callback(v8::FunctionCallbackInfo<v8::Value> const&)::'lambda'()) at error.h:119
    frame #10: 0x0000fffd68357740 isolated_vm.node`ivm::detail::CallbackMaker<v8::Local<v8::Value> (*)(ivm::ArrayRange, v8::MaybeLocal<v8::String>), &(ivm::IsolateHandle::CreateSnapshot(ivm::ArrayRange, v8::MaybeLocal<v8::String>)), 0, v8::FunctionCallbackInfo<v8::Value> const&>::Callback(args#0=0x0000ffffd868a0f8) at callbacks.h:117
    frame #11: 0x0000000000c27c6c node`v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<true>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) + 572
    frame #12: 0x0000000000c28168 node`v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) + 272
    frame #13: 0x0000000000c28788 node`v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) + 32
    frame #14: 0x00000000013a7c8c node`Builtins_CEntry_Return1_DontSaveFPRegs_ArgvOnStack_BuiltinExit + 108
    frame #15: 0x000000000133c3dc node`Builtins_JSBuiltinsConstructStub + 156
    frame #16: 0x0000000001424eac node`Builtins_ConstructHandler + 588
    frame #17: 0x0000000001340894 node`Builtins_InterpreterEntryTrampoline + 244
    frame #18: 0x0000000001340894 node`Builtins_InterpreterEntryTrampoline + 244
    frame #19: 0x0000000001340894 node`Builtins_InterpreterEntryTrampoline + 244
    frame #20: 0x0000000001340894 node`Builtins_InterpreterEntryTrampoline + 244
    frame #21: 0x0000000001340894 node`Builtins_InterpreterEntryTrampoline + 244
    frame #22: 0x0000000001340894 node`Builtins_InterpreterEntryTrampoline + 244
    frame #23: 0x0000000001340894 node`Builtins_InterpreterEntryTrampoline + 244
    frame #24: 0x000000000133e144 node`Builtins_JSEntryTrampoline + 164
    frame #25: 0x000000000133dde8 node`Builtins_JSEntry + 168

[laverdet]

On node v20.x you need --no-node-snapshot

[meixg]

On node v20.x you need --no-node-snapshot

sorry to forget mention node version, i'm using node 14.17.5

[laverdet]

Can you try upgrading node? v14 is past LTS

[kiddkai]

On node v20.x you need --no-node-snapshot

Does node v20.x own snapshot feature mess around the createSnapshot?

edit: found the context: #339

[laverdet]

createSnapshot is not the problem, but the underlying snapshot feature in v8 is super messy. It looks like v8 has gotten more aggressive about sharing snapshot data between isolates. The problem is that isolates created by isolated-vm look nothing like the isolates created by nodejs so none of these cases have been tested.

Anyway, about this issue I'm recommending people simply avoid createSnapshot entirely.

[kiddkai]

Argh that sucks, the cache data doesn’t provide fast enough startup time for us. So we heavily relying on snapshot atm.

It seem like we will have to disable the snapshot on the node side for a while and find an alternative solution.

Thanks 🙏

[moriaam]

Hey @kiddkai, have you found an alternative to snapshots?

[kiddkai]

Hey @kiddkai, have you found an alternative to snapshots?

@moriaam i ended up doing the v8 embedding myself via c++ directory for the snapshot and my custom runtime.