Certain values of --max_old_space_size cause segmentation fault

[sevastos]

iojs --max_old_space_size=4096 simple.js
[1]    18001 segmentation fault (core dumped)  iojs --max_old_space_size=4096 simple.js

There is a pattern on values that causes segfault: 2^n + 0...3 where n >= 12
e.g: 4096,4097,4098,4099,8192,8193,8194,8195 etc...
The rest values work fine.

Issue present on v0.11.15, v1.0.4 but works fine on v0.10.36.

It's funny because the first value I tried were 4096, 8192 and I would expect most to do the same.

Some info from gdb:

➜  gdb --args iojs --max_old_space_size=4096 simple.js
GNU gdb (Ubuntu/Linaro 7.4-2012.04-0ubuntu2.1) 7.4-2012.04
[...]
This GDB was configured as "x86_64-linux-gnu".
[...]
Reading symbols from /home/uvv/.nvm/versions/io.js/v1.0.4/bin/iojs...done.
(gdb) run
Starting program: /home/uvv/.nvm/versions/io.js/v1.0.4/bin/iojs --max_old_space_size=4096 simple.js
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ffff6bd2700 (LWP 20376)]
[New Thread 0x7ffff63d1700 (LWP 20377)]
[New Thread 0x7ffff5bd0700 (LWP 20378)]
[New Thread 0x7ffff53cf700 (LWP 20379)]

Program received signal SIGSEGV, Segmentation fault.
0x000000000097d9c0 in v8::internal::Heap::ClearJSFunctionResultCaches() ()
(gdb) c
Continuing.
[Thread 0x7ffff53cf700 (LWP 20379) exited]
[Thread 0x7ffff5bd0700 (LWP 20378) exited]
[Thread 0x7ffff63d1700 (LWP 20377) exited]
[Thread 0x7ffff6bd2700 (LWP 20376) exited]

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.

[brendanashworth]

I can confirm this also happens on OSX 10.9.5, running with 4GB of RAM. It works fine though at levels above 4GB (unless they follow that pattern) so I'm fairly sure this isn't the case. Looks like its a V8 bug though, if I could throw a guess.

Edit: oop. Could a 1.7GB limit on 64 bit machines have anything to do with it?

[bnoordhuis]

I looked at this briefly earlier today. I'm not 100% sure but it might be caused by something trivial like signed/unsigned overflow. I'll take a closer look.

[bnoordhuis]

It was indeed integer math overflow: the result of 4096 * MB doesn't fit in an int. Proposed fix: https://codereview.chromium.org/890563003/

[sevastos]

Nice, thanks :)

[Fishrock123]

Looks like the fix landed upstream. Should land down here when the next v8 update gets pulled, I think.