FATAL ERROR: v8::FromJust Maybe value is Nothing

[markuskremer]

People coming here from search engines, read #6899 (comment)

---

• Version: 4.2.2, 4.4.0, 6.2.0
• Platform: 4.2.0-35-generic Working with nvm, nvmw and similar installation managers #40-Ubuntu SMP x86_64 x86_64 x86_64 GNU/Linux
• Subsystem: ubuntu 15.10

segmentation fault when simple mqtt client tries to send 40kb data to broker.
4.x versions of node crash with "console.log is not a function"
Program does not crash when i remove the // before the first console.log.
Seems to work under 32 bit.

steps to reproduce:

$ npm install mqtt mosca
$ node_modules/.bin/mosca &
...
$ node crash.js 
FATAL ERROR: v8::FromJust Maybe value is Nothing.
Aborted (core dumped)

$ cat crash.js
var mqtt    = require('mqtt');
var client  = mqtt.connect('mqtt://localhost');
var todo=5000;

client.on('connect', function () {
//  console.log("WTF");
  client.subscribe('config/#');
  pubs();
});

function pubs()
{
  if(todo>0)
{
  todo-=1;
 client.publish('c/'+todo, '' ,pubs);
} else
{
  console.log("END");
  client.end();
}
}

[markuskremer]

Reproduced on 32 bit 0.12.7 nodejs
Instead of SEGV, console.log is undefined.

• Version: 0.12.7
• Platform: Linux 3.2.41-042stab111.12 SMP Thu Sep 17 11:38:20 MSK 2015 i686 GNU/Linux
• Subsystem: debian 7

$ node --version
v0.12.7
$ grep  PRETTY /etc/os-release
PRETTY_NAME="Debian GNU/Linux 7 (wheezy)"
$ uname -a
Linux  3.2.41-042stab111.12 #1 SMP Thu Sep 17 11:38:20 MSK 2015 i686 GNU/Linux
$ node crash.js
/home/markus/c/crash.js:21
  console.log("END");
          ^
TypeError: undefined is not a function
    at pubs (/home/markus/c/crash.js:21:11)
    at sendPacket (/home/markus/c/node_modules/mqtt/lib/client.js:41:7)
    at MqttClient._sendPacket (/home/markus/c/node_modules/mqtt/lib/client.js:628:7)
    at MqttClient.publish (/home/markus/c/node_modules/mqtt/lib/client.js:366:12)
    at pubs (/home/markus/c/crash.js:18:9)

[addaleax]

debug build stack trace:

#0  0x00007ffff6b79418 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007ffff6b7b01a in __GI_abort () at abort.c:89
#2  0x0000000001aaccb3 in node::OnFatalError (location=0x1dc0646 "v8::FromJust", message=0x1dc062e "Maybe value is Nothing.") at ../src/node.cc:2392
#3  0x000000000104bb41 in v8::Utils::ReportApiFailure (location=0x1dc0646 "v8::FromJust", message=0x1dc062e "Maybe value is Nothing.")
    at ../deps/v8/src/api.cc:307
#4  0x0000000001046de9 in v8::Utils::ApiCheck (condition=false, location=0x1dc0646 "v8::FromJust", message=0x1dc062e "Maybe value is Nothing.")
    at ../deps/v8/src/api.h:184
#5  0x000000000104cd84 in v8::V8::FromJustIsNothing () at ../deps/v8/src/api.cc:653
#6  0x00000000014ac433 in v8::Maybe<int>::FromJust (this=0x7ffffff08d70) at ../deps/v8/include/v8.h:6530
#7  0x0000000001aa907f in node::AppendExceptionLine (env=0x2a2d020, er=..., message=...) at ../src/node.cc:1524
#8  0x0000000001ad90e0 in node::ContextifyScript::DecorateErrorStack (env=0x2a2d020, try_catch=...) at ../src/node_contextify.cc:627
#9  0x0000000001ad8912 in node::ContextifyScript::New (args=...) at ../src/node_contextify.cc:511
#10 0x0000000001092eab in v8::internal::FunctionCallbackArguments::Call (this=0x7ffffff09e20, 
    f=0x1ad84c8 <node::ContextifyScript::New(v8::FunctionCallbackInfo<v8::Value> const&)>) at ../deps/v8/src/arguments.cc:33
#11 0x000000000112afd5 in v8::internal::(anonymous namespace)::HandleApiCallHelper<true> (isolate=0x29efe60, args=...) at ../deps/v8/src/builtins.cc:3915
#12 0x000000000111be85 in v8::internal::Builtin_Impl_HandleApiCallConstruct (args=..., isolate=0x29efe60) at ../deps/v8/src/builtins.cc:3948
#13 0x000000000111bde4 in v8::internal::Builtin_HandleApiCallConstruct (args_length=4, args_object=0x7ffffff09ff8, isolate=0x29efe60)
    at ../deps/v8/src/builtins.cc:3945

[targos]

@addaleax I'd like to investigate further. How did you reproduce the crash ?
The OP's testcase does nothing when I execute it

[addaleax]

@targos Hm, I’m looking into it too, and for me (x64, Linux) it reproduces it exactly as described above…

[targos]

So, the Nothing is returned from Message::GetStartColumn
It can only happen when the execution of the JSFunction message_get_column_number throws an exception.
The function is defined here:

node/deps/v8/src/js/messages.js

Lines 208 to 215 in 7c3e920

	//Returns the offset of the given position within the containing line.
	function GetColumnNumber(message) {
	var script = %MessageGetScript(message);
	var start_position = %MessageGetStartPosition(message);
	var location = script.locationFromPosition(start_position, true);
	if (location == null) return -1;
	return location.column;
	}

[addaleax]

Minimal reproduction:

function a() {
  try {
    a();
  } catch (e) {
    console.log(e);
  }
}

a();

I think what’s going on is that once the RangeError is thrown, there’s not enough stack space left for lazily compiling the console module… I am not entirely sure what to do about that.

[addaleax]

PR: #6907