node-chakracore segfault with latest master

[obastemur]

Steps to repro

• clone node-chakracore

git clone https://github.com/nodejs/node-chakracore nctest

• patch with chakracore master

cd nctest
rm -rf deps/chakrashim/core
cd deps/chakrashim
git clone https://github.com/microsoft/chakracore core

• patch with chakracore master node-chakracore fixes

cd core
git remote add obastemur https://github.com/obastemur/ChakraCore
git fetch obastemur
git cherry-pick 58527f139b3087c3c4fdf2d9d2e6f3603af8072f
git cherry-pick 80c857bbddb5d669156b0f250b3390d196a955a5

• build

cd ../../../
./configure
make -j4

• test

./node tools/eslint/bin/eslint.js --cache --rulesdir=tools/eslint-rules --ext=.js,.mjs,.md benchmark doc lib test tools

• output

Running JS linter...
make[2]: *** [lint-js] Segmentation fault: 11

• lldb output

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
    frame #0: 0x0000000100a5978f node`Js::JavascriptString::Is(void*) + 47
node`Js::JavascriptString::Is:
->  0x100a5978f <+47>: cmpl   $0x7, (%rax)
    0x100a59792 <+50>: sete   %al
    0x100a59795 <+53>: popq   %rbp
    0x100a59796 <+54>: retq   
Target 0: (node) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
  * frame #0: 0x0000000100a5978f node`Js::JavascriptString::Is(void*) + 47
    frame #1: 0x00000001008f28a6 node`Js::IntlEngineInterfaceExtensionObject::EntryIntl_CompareString(Js::RecyclableObject*, Js::CallInfo, ...) + 118
    frame #2: 0x0000000100a5bcd5 node`Js::JavascriptString::EntryLocaleCompare(Js::RecyclableObject*, Js::CallInfo, ...) + 261

p.s.: went back to 9f1bcd577854ac7dcda7f9aa499a629f181d4183 in the history but still the same. Due to build breaks one ncc, it's hard to track down.

[MSLaguana]

Spoke with @jackhorton and this is the same problem that causes crashes in npm with our nightlies; since we changed to use ICU for xplat intl we've had a bug where some functions that aren't implemented yet don't fall back correctly, and it looks like this is hitting one of those.

[obastemur]

since we changed to use ICU for xplat intl we've had a bug

FYI; Disabled intl manually (on node) yet issue stands.

[jackhorton]

How did you manually disable Intl, exactly?

[obastemur]

• remove --with-intl from chakracore.gyp
• replace icu_path under chakracore.gyp to icu-small
• ./configure --without-intl

[jackhorton]

This wasn't the error I saw in my testing, but #4187 at least fixes the Linux error.

[obastemur]

The issue with npm still stands, do you also observe the same?

[obastemur]

repro ->

> ./node tools/remark-cli/cli.js -q -f ./*.md doc src lib benchmark tools/doc/ tools/icu/

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x10)
    frame #0: 0x00000001008737c2 node`Js::JavascriptOperators::OP_GetElementI(void*, void*, Js::ScriptContext*) + 386
node`Js::JavascriptOperators::OP_GetElementI:
->  0x1008737c2 <+386>: cmpb   $0x0, 0x10(%rbx)
    0x1008737c6 <+390>: je     0x100873b15               ; <+1237>
    0x1008737cc <+396>: movq   %rbx, %rdi
    0x1008737cf <+399>: callq  0x1006879b0               ; Js::PropertyRecord::GetNumericValue() const
Target 0: (node) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x10)
  * frame #0: 0x00000001008737c2 node`Js::JavascriptOperators::OP_GetElementI(void*, void*, Js::ScriptContext*) + 386
    frame #1: 0x000000090ce8928f
    frame #2: 0x000000010092399b node`void Js::JavascriptArray::ForEachItemInRange<true, Js::JavascriptArray::EntryForEach(Js::RecyclableObject*, Js::CallInfo, ...)::$_7>(unsigned int, unsigned int, Js::ScriptContext*, Js::JavascriptArray::EntryForEach(Js::RecyclableObject*, Js::CallInfo, ...)::$_7) + 651
    frame #3: 0x0000000100923247 node`Js::JavascriptArray::EntryForEach(Js::RecyclableObject*, Js::CallInfo, ...) + 471
    frame #4: 0x0000000100abe47e node`amd64_CallFunction + 78
    frame #5: 0x000000010085d7a1 node`void Js::InterpreterStackFrame::OP_CallCommon<Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallIWithICIndex<Js::LayoutSizePolicy<(Js::LayoutSize)0> > > >(Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallIWithICIndex<Js::LayoutSizePolicy<(Js::LayoutSize)0> > > const*, Js::RecyclableObject*, unsigned int, Js::AuxArray<unsigned int> const*) + 289
    frame #6: 0x000000010081794c node`Js::InterpreterStackFrame::ProcessProfiled() + 17500
    frame #7: 0x00000001007f1b56 node`Js::InterpreterStackFrame::Process() + 230
    frame #8: 0x00000001007f169c node`Js::InterpreterStackFrame::InterpreterHelper(Js::ScriptFunction*, Js::ArgumentReader, void*, void*, Js::InterpreterStackFrame::AsmJsReturnStruct*) + 1932
    frame #9: 0x00000001007f0efd node`Js::InterpreterStackFrame::InterpreterThunk(Js::JavascriptCallStackLayout*) + 93
    frame #10: 0x00000009048a32f2
    frame #11: 0x0000000100abe47e node`amd64_CallFunction + 78
    frame #12: 0x0000000100958e50 node`void* Js::JavascriptFunction::CalloutHelper<false>(Js::RecyclableObject*, void*, void*, void*, Js::ScriptContext*) + 704
    frame #13: 0x000000090a6d838c
    frame #14: 0x0000000100abe47e node`amd64_CallFunction + 78
    frame #15: 0x0000000100958e50 node`void* Js::JavascriptFunction::CalloutHelper<false>(Js::RecyclableObject*, void*, void*, void*, Js::ScriptContext*) + 704

[obastemur]

The reason for the second segfault is node-chakracore/master is based on release/1.7 and there is a known swb bug in release/1.7 that is fixed already.

https://github.com/Microsoft/ChakraCore/blob/release/1.7/lib/Runtime/Library/ConcatString.h#L12

It should be
Field(PropertyString *) propertyString;

@digitalinfinity @MSLaguana cherry-pick ? patch? FYI! closing this issue as it's actually fixed on ChakraCore end.

[jackhorton]

Can that patch be put into ChakraCore release/1.7 so that it comes here "for free"? Every time we update deps/charkashim/core, we do so with a rm -rf core; git clone ... deps/chakrashim/core, so we cant overwrite it only in node.

[obastemur]

Here you go #4272