Breakpoint after use of `node-canvas` lets node crash

[luxzeitlos]

• Version: v8.4.0
• Platform: Darwin mycomputer.example.org 15.6.0 Darwin Kernel Version 15.6.0: Thu Jun 23 18:25:34 PDT 2016; root:xnu-3248.60.10~1/RELEASE_X86_64 x86_64

If I have this code:

const Canvas = require("canvas");
console.log('foo');
const canvas = new Canvas(1039, 100);
console.log('done');

and canvas is "canvas": "^1.6.6", and then I run node --inspect=31852 --debug-brk dist/index.js , attach the chrome debugger and I place a breakpoint on the console.log('done'); this will crash with:

Assertion failed: (object->InternalFieldCount() > 0), function Unwrap, file ../../nan/nan_object_wrap.h, line 33.

same is true for debugging with vscode.

However the same code works when running without a breakpoint/debugger. Thats why I assume a bug within node itself.

[joyeecheung]

I can reproduce this with master. I think this is caused by the devtools using the v8 inspector protocol to grab properties (by default these tools usually try to list the value all enumerable properties), the cause probably lies in the injected scripts that wrap the value being inspected. When you run the code with node inspect, which does not list the properties of canvas automatically, it does not crash, until you try to print canvas in the node-inspect repl. Although printing canvas.height works fine, so I guess there could be something wrong with the way _propertyDescriptors searches properties through the prototype chains?

llnode stack trace

 * thread #1: tid = 0x2d9b52, 0x00007fff8ba79d42 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x00007fff8ba79d42 libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x00007fff8bb675bf libsystem_pthread.dylib`pthread_kill + 90
    frame #2: 0x00007fff8b9df420 libsystem_c.dylib`abort + 129
    frame #3: 0x00007fff8b9a6893 libsystem_c.dylib`__assert_rtn + 320
    frame #4: 0x00000001024d0098 canvas.node`Canvas::GetHeight(v8::Local<v8::String>, Nan::PropertyCallbackInfo<v8::Value> const&) [inlined] Canvas* Nan::ObjectWrap::Unwrap<Canvas>(v8::Local<v8::Object>) at nan_object_wrap.h:33 [opt]
    frame #5: 0x00000001024d0079 canvas.node`Canvas::GetHeight(property=<unavailable>, info=<unavailable>) at Canvas.cc:129 [opt]
    frame #6: 0x00000001024db9e9 canvas.node`Nan::imp::GetterCallbackWrapper(property=<unavailable>, info=0x00007fff5fbfb1c0) at nan_callbacks_12_inl.h:190 [opt]
    frame #7: 0x00000001006add59 node`v8::internal::PropertyCallbackArguments::Call(this=0x00007fff5fbfb218, f=(canvas.node`Nan::imp::GetterCallbackWrapper(v8::Local<v8::Name>, v8::PropertyCallbackInfo<v8::Value> const&) at nan_callbacks_12_inl.h:183), name=<unavailable>)(v8::Local<v8::Name>, v8::PropertyCallbackInfo<v8::Value> const&), v8::internal::Handle<v8::internal::Name>) at api-arguments-inl.h:41 [opt]
    frame #8: 0x000000010072b540 node`v8::internal::Object::GetPropertyWithAccessor(it=<unavailable>) at objects.cc:1402 [opt]
    frame #9: 0x000000010072ac0b node`v8::internal::Object::GetProperty(it=0x00007fff5fbfb3b8) at objects.cc:1049 [opt]
    frame #10: 0x000000010073da5b node`v8::internal::JSReceiver::GetOwnPropertyDescriptor(it=0x00007fff5fbfb3b8, desc=0x00007fff5fbfb438) at objects.cc:7114 [opt]
    frame #11: 0x000000010072b6d2 node`v8::internal::JSReceiver::GetOwnPropertyDescriptor(isolate=<unavailable>, object=<unavailable>, key=<unavailable>, desc=<unavailable>) at objects.cc:7015 [opt]
    frame #12: 0x00000001002b89c4 node`v8::internal::Builtin_Impl_ObjectGetOwnPropertyDescriptor(args=<unavailable>, isolate=0x0000000103000c00) at builtins-object.cc:359 [opt]
    frame #13: 0x0000177a86b0449d
    frame #14: 0x0000177a86bfa0ca <stub>
    frame #15: 0x0000177a86bbf075 process(this=0x00003259ab802311:<undefined>, 0x000023f68922e6f1:<Object: Object>, 0x000004eeac847051:<Array: length=30>, 0x00003259ab802311:<undefined>) at (external):53:172 fn=0x000004eeac846be9
    frame #16: 0x0000177a86b05d7b <adaptor>
    frame #17: 0x0000177a86bfaa62 <stub>
    frame #18: 0x0000177a86bbf075 _propertyDescriptors(this=0x000020809ea71041:<Object: InjectedScript>, 0x000004eeac804cf9:<Object: Canvas>, 0x000004eeac846149:<function: addPropertyIfNeeded at (external):156:44>, 0x00003259ab802421:<false>, 0x00003259ab802311:<undefined>, 0x00003259ab802311:<undefined>) at (external):52:120 fn=0x00002a27bc99f2f1
    frame #19: 0x0000177a86bf9928 <stub>
    frame #20: 0x0000177a86bbf075 _generatePreview(this=0x000004eeac846029:<Object: InjectedScript.RemoteObject>, 0x000004eeac804cf9:<Object: Canvas>, 0x00003259ab802311:<undefined>, 0x00003259ab802311:<undefined>, 0x00003259ab802311:<undefined>, 0x00003259ab802311:<undefined>) at (external):150:74 fn=0x00002a27bc99f639
    frame #21: 0x0000177a86bf9928 <stub>
    frame #22: 0x0000177a86bbf075 InjectedScript.RemoteObject(this=0x000004eeac846029:<Object: InjectedScript.RemoteObject>, 0x000004eeac804cf9:<Object: Canvas>, 0x000004eeac846001:<String: "node-inspect">, 0x00003259ab802311:<undefined>, 0x00003259ab802421:<false>, 0x00003259ab8023b1:<true>, 0x00003259ab802311:<undefined>, 0x00003259ab802311:<undefined>, 0x00003259ab802311:<undefined>, 0x00003259ab802311:<undefined>) at (external):124:77 fn=0x0000174eeee69e41
    frame #23: 0x0000177a86b05783 <constructor>
    frame #24: 0x0000177a86bfbe2e <stub>
    frame #25: 0x0000177a86bbf075 _wrapObject(this=0x000020809ea71041:<Object: InjectedScript>, 0x000004eeac804cf9:<Object: Canvas>, 0x000004eeac846001:<String: "node-inspect">, 0x00003259ab802421:<false>, 0x00003259ab8023b1:<true>, 0x00003259ab802311:<undefined>, 0x00003259ab802311:<undefined>, 0x00003259ab802311:<undefined>, 0x00003259ab802311:<undefined>) at (external):38:92 fn=0x00002a27bc99efa9
    frame #26: 0x0000177a86b05d7b <adaptor>
    frame #27: 0x0000177a86bf9928 <stub>
    frame #28: 0x0000177a86bbf075 wrapObject(this=0x000020809ea71041:<Object: InjectedScript>, 0x000004eeac804cf9:<Object: Canvas>, 0x000004eeac846001:<String: "node-inspect">, 0x00003259ab802421:<false>, 0x00003259ab8023b1:<true>) at (external):31:113 fn=0x00002a27bc99ef61
    frame #29: 0x0000177a86bbe339 <internal>
    frame #30: 0x0000177a86b0412d <entry>
    frame #31: 0x00000001005db991 node`v8::internal::(anonymous namespace)::Invoke(isolate=0x00000000000000d4, is_construct=<unavailable>, target=<unavailable>, receiver=<unavailable>, argc=4, args=<unavailable>, new_target=<unavailable>, message_handling=<unavailable>) at execution.cc:145 [opt]
    frame #32: 0x00000001005db679 node`v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) [inlined] v8::internal::(anonymous namespace)::CallInternal(message_handling=kReport) at execution.cc:181 [opt]
    frame #33: 0x00000001005db5f0 node`v8::internal::Execution::Call(isolate=0x0000000103000c00, callable=Handle<v8::internal::Object> @ r12, receiver=<unavailable>, argc=4, argv=<unavailable>) at execution.cc:191 [opt]
    frame #34: 0x0000000100205098 node`v8::Function::Call(this=0x0000000103049980, context=<unavailable>, recv=<unavailable>, argc=4, argv=0x000000010271a690) at api.cc:5279 [opt]
    frame #35: 0x00000001001c01ba node`v8_inspector::V8FunctionCall::callWithoutExceptionHandling(this=0x00007fff5fbfbfc8) at v8-function-call.cc:102 [opt]
    frame #36: 0x00000001001c0034 node`v8_inspector::V8FunctionCall::call(this=0x00007fff5fbfbfc8, hadException=0x00007fff5fbfc000, reportExceptions=true) at v8-function-call.cc:72 [opt]
    frame #37: 0x000000010018b9a2 node`v8_inspector::InjectedScript::wrapValue(this=<unavailable>, value=(val_ = 0x0000000103049948), groupName=0x00007fff5fbfc340, forceValueType=<unavailable>, generatePreview=<unavailable>, result=<unavailable>) const at injected-script.cc:240 [opt]
    frame #38: 0x000000010018b66e node`v8_inspector::InjectedScript::wrapObject(this=0x000000010260b510, value=<unavailable>, groupName=<unavailable>, forceValueType=false, generatePreview=true, result=0x0000000000000000) const at injected-script.cc:178 [opt]
    frame #39: 0x000000010018d2dd node`v8_inspector::InjectedScript::wrapEvaluateResult(this=0x000000010260b510, maybeResultValue=<unavailable>, tryCatch=0x00007fff5fbfc278, objectGroup=0x00007fff5fbfc340, returnByValue=false, generatePreview=<unavailable>, result=<unavailable>, exceptionDetails=<unavailable>) at injected-script.cc:388 [opt]
    frame #40: 0x00000001001b6be4 node`v8_inspector::V8DebuggerAgentImpl::evaluateOnCallFrame(this=<unavailable>, callFrameId=<unavailable>, expression=<unavailable>, objectGroup=<unavailable>, includeCommandLineAPI=<unavailable>, silent=<unavailable>, returnByValue=<unavailable>, generatePreview=<unavailable>, throwOnSideEffect=<unavailable>, result=<unavailable>, exceptionDetails=<unavailable>) at v8-debugger-agent-impl.cc:799 [opt]
    frame #41: 0x000000010015c195 node`v8_inspector::protocol::Debugger::DispatcherImpl::evaluateOnCallFrame(this=<unavailable>, callId=<unavailable>, requestMessageObject=<unavailable>, errors=<unavailable>) at Debugger.cpp:1450 [opt]
    frame #42: 0x0000000100157254 node`v8_inspector::protocol::Debugger::DispatcherImpl::dispatch(this=<unavailable>, callId=19, method=0x00007fff5fbfc720, messageObject=unique_ptr<v8_inspector::protocol::DictionaryValue, std::__1::default_delete<v8_inspector::protocol::DictionaryValue> > @ 0x00007fff5fbfc6d8) at Debugger.cpp:890 [opt]
    frame #43: 0x000000010013fff9 node`v8_inspector::protocol::UberDispatcher::dispatch(this=0x0000000102600540, parsedMessage=<unavailable>) at Protocol.cpp:813 [opt]
    frame #44: 0x00000001001cc839 node`v8_inspector::V8InspectorSessionImpl::dispatchProtocolMessage(this=<unavailable>, message=<unavailable>) at v8-inspector-session-impl.cc:342 [opt]
    frame #45: 0x0000000100abe208 node`node::inspector::InspectorIo::DispatchMessages(this=0x000000010270b080) at inspector_io.cc:412 [opt]
    frame #46: 0x0000000100a8b455 node`node::NodePlatform::FlushForegroundTasksInternal(this=<unavailable>) at node_platform.cc:94 [opt]
    frame #47: 0x0000000100abcf83 node`node::inspector::NodeInspectorClient::runMessageLoopOnPause(this=0x000000010270ab30, context_group_id=<unavailable>) at inspector_agent.cc:519 [opt]
    frame #48: 0x00000001001a7339 node`v8_inspector::V8Debugger::handleProgramBreak(this=0x000000010270aca0, pausedContext=<unavailable>, executionState=<unavailable>, exception=<unavailable>, hitBreakpointNumbers=<unavailable>, isPromiseRejection=<unavailable>, isUncaught=<unavailable>) at v8-debugger.cc:643 [opt]
    frame #49: 0x00000001001a7605 node`v8_inspector::V8Debugger::BreakProgramRequested(this=0x000000010270aca0, pausedContext=(val_ = 0x00000001030497c8), execState=(val_ = 0x00000001030497c0), breakPointsHit=<unavailable>) at v8-debugger.cc:688 [opt]
    frame #50: 0x000000010057d982 node`v8::internal::Debug::OnDebugBreak(this=0x0000000102705750, break_points_hit=Handle<v8::internal::Object> @ r15) at debug.cc:1865 [opt]
    frame #51: 0x000000010057d591 node`v8::internal::Debug::Break(this=0x0000000102705750, frame=<unavailable>) at debug.cc:574 [opt]
    frame #52: 0x0000000100873303 node`v8::internal::Runtime_DebugBreakOnBytecode(int, v8::internal::Object**, v8::internal::Isolate*) [inlined] v8::internal::__RT_impl_Runtime_DebugBreakOnBytecode(v8::internal::Arguments, v8::internal::Isolate*) at runtime-debug.cc:51 [opt]
    frame #53: 0x000000010087329a node`v8::internal::Runtime_DebugBreakOnBytecode(args_length=<unavailable>, args_object=0x00007fff5fbfd010, isolate=0x0000000103000c00) at runtime-debug.cc:41 [opt]
    frame #54: 0x0000177a86b046fd <exit>
    frame #55: 0x0000177a86c0ad2c <stub>
    frame #56: 0x0000177a86bbf075 (anonymous)(this=0x000020809ea70c79:<Object: Object>, 0x000020809ea70c79:<Object: Object>, 0x000020809ea70bc1:<function: require at (external).js:8:19>, 0x000020809ea70b31:<Object: Module>, 0x0000174eeee4df01:<String: "/Users/joyee/pro...">, 0x000020809ea70c51:<String: "/Users/joyee/pro...">) at /Users/joyee/projects/node-test/15099/index.js:1:10 fn=0x000020809ea70c09
    frame #57: 0x0000177a86bbe339 <internal>
    frame #58: 0x0000177a86b0412d <entry>
    frame #59: 0x00000001005db991 node`v8::internal::(anonymous namespace)::Invoke(isolate=0x0000000000000067, is_construct=<unavailable>, target=<unavailable>, receiver=<unavailable>, argc=5, args=<unavailable>, new_target=<unavailable>, message_handling=<unavailable>) at execution.cc:145 [opt]
    frame #60: 0x00000001005db679 node`v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) [inlined] v8::internal::(anonymous namespace)::CallInternal(message_handling=kReport) at execution.cc:181 [opt]
    frame #61: 0x00000001005db5f0 node`v8::internal::Execution::Call(isolate=0x0000000103000c00, callable=Handle<v8::internal::Object> @ r12, receiver=<unavailable>, argc=5, argv=<unavailable>) at execution.cc:191 [opt]
    frame #62: 0x0000000100205098 node`v8::Function::Call(this=0x00007fff5fbfd658, context=<unavailable>, recv=<unavailable>, argc=5, argv=0x0000000102609940) at api.cc:5279 [opt]
    frame #63: 0x0000000100abc2a3 node`node::inspector::(anonymous namespace)::CallAndPauseOnStart(args=0x00007fff5fbfd430) at inspector_agent.cc:384 [opt]
    frame #64: 0x000000010021f250 node`v8::internal::FunctionCallbackArguments::Call(this=0x00007fff5fbfd498, f=(node`node::inspector::(anonymous namespace)::CallAndPauseOnStart(v8::FunctionCallbackInfo<v8::Value> const&) at inspector_agent.cc:373))(v8::FunctionCallbackInfo<v8::Value> const&)) at api-arguments.cc:25 [opt]
    frame #65: 0x0000000100285b32 node`v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(isolate=0x0000000103000c00, function=<unavailable>, new_target=<unavailable>, fun_data=<unavailable>, receiver=<unavailable>, args=BuiltinArguments @ 0x00007fff5fbfd550) at builtins-api.cc:112 [opt]
    frame #66: 0x000000010028500f node`v8::internal::Builtin_Impl_HandleApiCall(args=<unavailable>, isolate=0x0000000103000c00) at builtins-api.cc:142 [opt]
    frame #67: 0x0000177a86b046fd <exit>
    frame #68: 0x0000177a86bfa245 <stub>
    frame #69: 0x0000177a86bbf075 Module._compile(this=0x000020809ea70b31:<Object: Module>, 0x000020809ea70da1:<String: "const Canvas = r...">, 0x0000174eeee4df01:<String: "/Users/joyee/pro...">) at module.js:506:37 fn=0x00003831c7e52f61
    frame #70: 0x0000177a86bfa0ca <stub>
    frame #71: 0x0000177a86bbf075 Module._extensions..js(this=0x000020809ea32991:<Object: Object>, 0x000020809ea70b31:<Object: Module>, 0x0000174eeee4df01:<String: "/Users/joyee/pro...">) at module.js:558:37 fn=0x00003831c7e52fa9
    frame #72: 0x0000177a86bfa0ca <stub>
    frame #73: 0x0000177a86bbf075 Module.load(this=0x000020809ea70b31:<Object: Module>, 0x0000174eeee4df01:<String: "/Users/joyee/pro...">) at module.js:474:33 fn=0x00003831c7e52ed1
    frame #74: 0x0000177a86bf9f5c <stub>
    frame #75: 0x0000177a86bbf075 tryModuleLoad(this=0x00003259ab802311:<undefined>, 0x000020809ea70b31:<Object: Module>, 0x0000174eeee4df01:<String: "/Users/joyee/pro...">) at module.js:443:23 fn=0x000030b1b60fdf31
    frame #76: 0x0000177a86bfaa62 <stub>
    frame #77: 0x0000177a86bbf075 Module._load(this=0x000030b1b60ec329:<function: Module at module.js:55:16>, 0x0000174eeee4df01:<String: "/Users/joyee/pro...">, 0x00003259ab802201:<null>, 0x00003259ab8023b1:<true>) at module.js:410:24 fn=0x00003831c7e52e11
    frame #78: 0x0000177a86bf9928 <stub>
    frame #79: 0x0000177a86bbf075 Module.runMain(this=0x000030b1b60ec329:<function: Module at module.js:55:16>) at module.js:583:26 fn=0x00003831c7e53081
    frame #80: 0x0000177a86c17609 <stub>
    frame #81: 0x0000177a86bbf075 startup(this=0x00003259ab802311:<undefined>) at bootstrap_node.js:1:10 fn=0x00003831c7e62131
    frame #82: 0x0000177a86bfa7c1 <stub>
    frame #83: 0x0000177a86bbf075 (anonymous)(this=0x00003259ab802201:<null>, 0x00003831c7e212a1:<Object: process>) at bootstrap_node.js:1:10 fn=0x00003831c7e62201
    frame #84: 0x0000177a86bbe339 <internal>
    frame #85: 0x0000177a86b0412d <entry>
    frame #86: 0x00000001005db991 node`v8::internal::(anonymous namespace)::Invoke(isolate=0x00000000000001d5, is_construct=<unavailable>, target=<unavailable>, receiver=<unavailable>, argc=1, args=<unavailable>, new_target=<unavailable>, message_handling=<unavailable>) at execution.cc:145 [opt]
    frame #87: 0x00000001005db679 node`v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) [inlined] v8::internal::(anonymous namespace)::CallInternal(message_handling=kReport) at execution.cc:181 [opt]
    frame #88: 0x00000001005db5f0 node`v8::internal::Execution::Call(isolate=0x0000000103000c00, callable=Handle<v8::internal::Object> @ r12, receiver=<unavailable>, argc=1, argv=<unavailable>) at execution.cc:191 [opt]
    frame #89: 0x0000000100205098 node`v8::Function::Call(this=0x00000001030496c0, context=<unavailable>, recv=<unavailable>, argc=1, argv=0x00007fff5fbfdf60) at api.cc:5279 [opt]
    frame #90: 0x0000000100a4d175 node`node::LoadEnvironment(env=0x00007fff5fbfe000) at node.cc:3629 [opt]
    frame #91: 0x0000000100a548a7 node`node::Start(isolate=0x0000000103000c00, isolate_data=<unavailable>, argc=2, argv=0x00000001027044a0, exec_argc=<unavailable>, exec_argv=0x0000000103800000) at node.cc:4550 [opt]
    frame #92: 0x0000000100a4ebd8 node`node::Start(event_loop=0x000000010167d990, argc=2, argv=<unavailable>, exec_argc=<unavailable>, exec_argv=<unavailable>) at node.cc:4627 [opt]
    frame #93: 0x0000000100a4e842 node`node::Start(argc=<unavailable>, argv=<unavailable>) at node.cc:4684 [opt]
    frame #94: 0x0000000100001834 node`start + 52

[joyeecheung]

cc @nodejs/v8-inspector

[TimothyGu]

height is defined as a getter on the C++ side, which checks the validity of the this value for being a valid instance of the Canvas class. However, when it encounters an invalid this, it ABORT()s, as seen here. I think this is because the Inspector wrapper calls the height's getter on the prototype, which of course does not have the internal slot and thus is not a valid Canvas instance.

So no, I don't think this is a bug in Node.js, V8, or the Chrome Inspector, but in node-canvas's Canvas.prototype.height getter for not being as robust as it can be. In Node.js we usually wrap the C++ handle in another JS-defined object for precisely reasons like this.

[joyeecheung]

@TimothyGu Hmm, wait, I remember the Devtools usually does not call getters and display place holders for properties like this, because getters can trigger all kinds of side effects that are not really what a debugger is supposed to trigger. If the inspector is only generating a preview, to me it is not supposed to call the getter, and just return something indicating that the property has a getter.

[TimothyGu]

@joyeecheung The getter is defined as an interceptor in C++, so Dev Tools (which operates in JS) can't tell whether it's an accessor property.

[zbjornson]

Automattic/node-canvas#855 is the current bug in node-canvas for this. I finally got around to finishing the fix for it this morning (Automattic/node-canvas#808).

@TimothyGu or anyone else: in that change, I'm creating a new v8::AccessorSignature for every accessor. Do you know if that's bad, should I be using a single v8::AccessorSignature instance for all of the accessors on a class? Not sure what the effective lifecycle of that object would be.

[bnoordhuis]

@zbjornson The AccessorSignature is really just the reinterpret_casted FunctionTemplate. It doesn't use memory as such.

[zbjornson]

Perfect, thanks!