local fatal error for test/js-native-api/test_object/test.js

[targos]

Platform: macOS arm64

I don't know when it started exactly.

$  out/Release/node test/js-native-api/test_object/test.js
node(1489,0x1095dfd40) malloc: *** error for object 0x13cf049e0: pointer being freed was not allocated
node(1489,0x1095dfd40) malloc: *** set a breakpoint in malloc_error_break to debug
[1]    1489 abort      out/Release/node

Sometimes it fails with this abort, other times with a segmentation fault.

[targos]

Process 31710 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x10)
    frame #0: 0x0000000100180fe4 node`v8impl::(anonymous namespace)::Reference::SecondPassCallback(data=0x000000016fdf62e0)::Reference> const&) at js_native_api_v8.cc:405:26
   402    }
   403 
   404    static void SecondPassCallback(const v8::WeakCallbackInfo<Reference>& data) {
-> 405      data.GetParameter()->Finalize();
   406    }
   407 
   408    v8impl::Persistent<v8::Value> _persistent;
Target 0: (node) stopped.

[targos]

@nodejs/node-api

[gabrielschulhof]

This may be an indication that V8 is not removing the weak callback once queued, even though we are calling ClearWeak() from the environment teardown-induced finalization loop. We may want to consider the alternative solution mentioned in #37616 (comment) to see if that prevents this problem.

[mhdawson]

This may be related: #38000

[legendecas]

@targos it will be helpful to share the node version that you are testing against. thanks!

@gabrielschulhof the tricky thing is that the ClearWeak() is expected to be called during the first pass callback. So that is the API contract that ClearWeak() will not clear the second pass callback. I've submitted an issue to v8 to discuss this https://bugs.chromium.org/p/v8/issues/detail?id=11608 . And as a fix from node when the cancellation of second pass callback is not available, I've submitted #38000 to address the issue.

[targos]

@legendecas I'm testing with the master branch.

[targos]

Saw it crash in a GitHub workflow too: https://github.com/nodejs/node/runs/2338974533

[richardlau]

The GitHub Actions build-tarball workflow has been consistently failing due to this test crashing after 78343bb / #37263: https://github.com/nodejs/node/actions/workflows/build-tarball.yml?query=branch%3Amaster

[BethGriggs]

Does it make sense to temporarily revert 78343bb / #37263 to see if that brings us back to passing actions runs?

cc: @ExE-Boss, @aduh95

[jasnell]

It looks like #38250 may fix this.