a simple script to crash Node.js with an assertion failure: (loop->watchers[w->fd] == w)

[pmq20]

This crash was reported several times in [1] [2] [3] [4], I also devised a simple script to reproduce the crash as below.

var fd = 3;
while (fd<1000) {
  try {
    var stream = new net.Socket({
      fd: fd,
      readable: false,
      writable: true
    });
    stream.on('error', function() {});
    stream.write('might crash');
  } catch(e) {}
  fd += 1;
}

[1] joyent/libuv#838
[2] joyent/libuv#1348
[3] jeremycx/node-LDAP#33
[4] serialport/node-serialport#262

[Fishrock123]

@pmq20 What Node version and which OS? I can't repro on Node v4.2.1 and OS X 10.10.5

[pmq20]

@Fishrock123 I'm using Node.js v4.2.1 and Mac OS X 10.11 (15A284)

[Fishrock123]

@pmq20 My machine has a Quad-core 2.6ghz i7 -- perhaps the test isn't race-y enough?

[pmq20]

@Fishrock123 I have revised the script to loop on fd, could you try it again?

[pmq20]

[Fishrock123]

Reproed. Thanks.

Jeremiahs-MacBook-Pro:here-be-dragons Jeremiah$ node
> var fd = 3
undefined
> while (fd<1000) {
... try {
..... var stream = new net.Socket({
....... fd,
....... readable: false,
....... writable: true
....... })
..... stream.on('error', ()=>{})
..... stream.write('might crash')
..... } catch(e) {}
... fd++
... }
Assertion failed: (loop->watchers[w->fd] == w), function uv__io_stop, file ../deps/uv/src/unix/core.c, line 856.
Abort trap: 6

[indutny]

I'm not sure if this could be considered a bug. Libuv does not allow to watch the same file descriptors twice, and this is a manifestation of this behavior.

Most of the bugs that I have seen that was triggering loop->watchers[w->fd] == w in user-land, were due to poorly written C++ addons.

[pmq20]

@indutny I just thought pure JS code without any addons should not cause C-level panic under any circumstance

[indutny]

@pmq20 well, it probably should throw indeed. cc @bnoordhuis @saghul