[fs.watch] src\fs_event_wrap.cc:90: Assertion `wrap != nullptr' failed.

[dr-js]

• Version: v10.0.0
• Platform: windows 10 (x64) & linux 4.13.0-38-generic (x86_64)
• Subsystem: fs

Calling close() from fs.watch may crash node process.
From my test:

• on Windows 10 will crash every time
• on Linux may crash 20% of the time

The minimal reproducible code: (will not crash on node 8 or 9)

const { watch, mkdirSync, rmdirSync, existsSync } = require('fs')
const { join } = require('path')

const TEST_ROOT = join(__dirname, 'test-watch-gitignore/')

existsSync(TEST_ROOT) || mkdirSync(TEST_ROOT)

const watcher = watch(TEST_ROOT, { persistent: false, recursive: false })

watcher.addListener('error', () => { // TODO: NOTE: crash on windows node 10, every time
  console.log('error ===============')
  setTimeout(() => { // TODO: NOTE: remove this will stop the crash
    console.log('error setTimeout ===============')
    watcher.close()
    console.log('error done ===============')
  }, 10)
})

watcher.addListener('change', () => { // TODO: NOTE: crash on linux node 10, 20% of the time
  console.log('change ===============')
  setTimeout(() => { // TODO: NOTE: remove this will stop the crash
    console.log('change setTimeout ===============')
    watcher.close()
    console.log('change done ===============')
  }, 10)
})

console.log('111 ===============')
rmdirSync(TEST_ROOT)
console.log('222 ===============')
setTimeout(() => {}, 100) // TODO: NOTE: wait for listener to hit
console.log('333 ===============')

The error on Windows:

> node .\test-bug.js
111 ===============
222 ===============
333 ===============
error ===============
error setTimeout ===============
Windows PowerShell[22248]: src\fs_event_wrap.cc:90: Assertion `wrap != nullptr' failed.
 1: node::DecodeWrite
 2: node::DecodeWrite
 3: node::Start
 4: v8::internal::interpreter::BytecodeDecoder::Decode
 5: v8::internal::RegExpImpl::Exec
 6: v8::internal::RegExpImpl::Exec
 7: v8::internal::Object::ToInt32
 8: v8::internal::Object::GetProperty
 9: v8::internal::NativesCollection<0>::GetScriptsSource
10: v8::internal::NativesCollection<0>::GetScriptsSource
11: 00000383BE284281

The error on Linux:

$ node test-bug.js 
111 ===============
222 ===============
333 ===============
change ===============
change ===============
change setTimeout ===============
change done ===============
change setTimeout ===============
node[14950]: ../src/fs_event_wrap.cc:90:static void node::{anonymous}::FSEventWrap::GetInitialized(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `wrap != nullptr' failed.
 1: node::Abort() [node]
 2: 0x87b6c5 [node]
 3: 0x86a60a [node]
 4: v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo*) [node]
 5: 0xad62fa [node]
 6: v8::internal::Builtins::InvokeApiFunction(v8::internal::Isolate*, bool, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*, v8::internal::Handle<v8::internal::HeapObject>) [node]
 7: v8::internal::Object::GetPropertyWithAccessor(v8::internal::LookupIterator*) [node]
 8: v8::internal::Object::GetProperty(v8::internal::LookupIterator*) [node]
 9: v8::internal::LoadIC::Load(v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Name>) [node]
10: v8::internal::Runtime_LoadIC_Miss(int, v8::internal::Object**, v8::internal::Isolate*) [node]
11: 0x12b965e0427d
Aborted (core dumped)

[joyeecheung]

@dr-js I am unable to reproduce this on Ubuntu. Can you provide the core dump appeared in the logs?

[dr-js]

Is this the Ubuntu core dump file?
_usr_bin_node.1000.crash.zip

[joyeecheung]

This may be related to #18897

[joyeecheung]

@dr-js If you are using apport (cat /proc/sys/kernel/core_pattern should display something like |/usr/share/apport/apport %p %s %c %d %P), you can try apport-unpack /path/to/crash /path/to/a/new/directory and look for the core dump in the directory you unpack the crash file to. Or if you enable ulimit -c unlimited (or switch ulimited to a reasonable value for the size of a core dump) you may be able to find the core file in the directory where you run your script.

[joyeecheung]

I can reproduce this on Windows and the crash go away if I comment out this line. Haven't looked into other classes inheriting from HandleWrap yet so I am not sure if it's safe to just remove it. Investigating..

cc @bnoordhuis

node/src/handle_wrap.cc

Line 117 in 2a30bfe

ClearWrap(wrap->object());

[dr-js]

This is the core file with ulimit -c unlimited on Ubuntu: core.zip

[joyeecheung]

Assign to myself so I don't forget

[alexander-akait]

Another PR with same problem webpack/watchpack#80

[cjihrig]

Can someone try to reproduce this on Windows after bd20110#diff-bd3b4db95ebe4ba6bf2b03a3060d9074?

[dr-js]

@cjihrig with v11.0.0-nightly201805051cf7ef6433 and v10.0.1-nightly20180505ff148b987d the output is the same except the last line

> node -v
v11.0.0-nightly201805051cf7ef6433

> node .\test.js
111 ===============
222 ===============
333 ===============
error ===============
error setTimeout ===============
Windows PowerShell[1880]: src\fs_event_wrap.cc:90: Assertion `wrap != nullptr' failed.
 1: node::DecodeWrite
 2: node::DecodeWrite
 3: node::Start
 4: v8::internal::interpreter::BytecodeDecoder::Decode
 5: v8::internal::RegExpImpl::Exec
 6: v8::internal::RegExpImpl::Exec
 7: v8::internal::Object::ToInt32
 8: v8::internal::Object::GetProperty
 9: v8::internal::NativesCollection<0>::GetScriptsSource
10: v8::internal::NativesCollection<0>::GetScriptsSource
11: 0000036189004281

> node -v
v10.0.1-nightly20180505ff148b987d

> node .\test.js
111 ===============
222 ===============
333 ===============
error ===============
error setTimeout ===============
Windows PowerShell[1592]: src\fs_event_wrap.cc:90: Assertion `wrap != nullptr' failed.
 1: node::DecodeWrite
 2: node::DecodeWrite
 3: node::Start
 4: v8::internal::interpreter::BytecodeDecoder::Decode
 5: v8::internal::RegExpImpl::Exec
 6: v8::internal::RegExpImpl::Exec
 7: v8::internal::Object::ToInt32
 8: v8::internal::Object::GetProperty
 9: v8::internal::NativesCollection<0>::GetScriptsSource
10: v8::internal::NativesCollection<0>::GetScriptsSource
11: 0000020DC9204281

[dr-js]

v11.0.0-nightly201805051cf7ef6433 core dump core.tar.gz from 4.13.0-39-generic #44~16.04.1-Ubuntu SMP Thu Apr 5 16:43:10 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

$ node-v11.0.0-nightly201805051cf7ef6433-linux-x64/bin/node test.js 
111 ===============
222 ===============
333 ===============
change ===============
change ===============
change setTimeout ===============
change done ===============
change setTimeout ===============
node-v11.0.0-nightly201805051cf7ef6433-linux-x64/bin/node[22633]: ../src/fs_event_wrap.cc:90:static void node::{anonymous}::FSEventWrap::GetInitialized(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `wrap != nullptr' failed.
 1: node::Abort() [node-v11.0.0-nightly201805051cf7ef6433-linux-x64/bin/node]
 2: 0x8772b5 [node-v11.0.0-nightly201805051cf7ef6433-linux-x64/bin/node]
 3: 0x86608a [node-v11.0.0-nightly201805051cf7ef6433-linux-x64/bin/node]
 4: v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo*) [node-v11.0.0-nightly201805051cf7ef6433-linux-x64/bin/node]
 5: 0xaceada [node-v11.0.0-nightly201805051cf7ef6433-linux-x64/bin/node]
 6: v8::internal::Builtins::InvokeApiFunction(v8::internal::Isolate*, bool, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*, v8::internal::Handle<v8::internal::HeapObject>) [node-v11.0.0-nightly201805051cf7ef6433-linux-x64/bin/node]
 7: v8::internal::Object::GetPropertyWithAccessor(v8::internal::LookupIterator*) [node-v11.0.0-nightly201805051cf7ef6433-linux-x64/bin/node]
 8: v8::internal::Object::GetProperty(v8::internal::LookupIterator*) [node-v11.0.0-nightly201805051cf7ef6433-linux-x64/bin/node]
 9: v8::internal::LoadIC::Load(v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Name>) [node-v11.0.0-nightly201805051cf7ef6433-linux-x64/bin/node]
10: v8::internal::Runtime_LoadIC_Miss(int, v8::internal::Object**, v8::internal::Isolate*) [node-v11.0.0-nightly201805051cf7ef6433-linux-x64/bin/node]
11: 0x313eb8b8427d
Aborted (core dumped)

[dr-js]

and updated core.tar.gz from v10.1.0

$ uname -srvmpio
Linux 4.13.0-41-generic #46~16.04.1-Ubuntu SMP Thu May 3 10:06:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

$ node -v
v10.1.0

$ node test.js 
111 ===============
222 ===============
333 ===============
change ===============
change ===============
change setTimeout ===============
change done ===============
change setTimeout ===============
node[1717]: ../src/fs_event_wrap.cc:90:static void node::{anonymous}::FSEventWrap::GetInitialized(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `wrap != nullptr' failed.
 1: node::Abort() [node]
 2: 0x876c55 [node]
 3: 0x86601a [node]
 4: v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo*) [node]
 5: 0xacda3a [node]
 6: v8::internal::Builtins::InvokeApiFunction(v8::internal::Isolate*, bool, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*, v8::internal::Handle<v8::internal::HeapObject>) [node]
 7: v8::internal::Object::GetPropertyWithAccessor(v8::internal::LookupIterator*) [node]
 8: v8::internal::Object::GetProperty(v8::internal::LookupIterator*) [node]
 9: v8::internal::LoadIC::Load(v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Name>) [node]
10: v8::internal::Runtime_LoadIC_Miss(int, v8::internal::Object**, v8::internal::Isolate*) [node]
11: 0x275bd780427d
Aborted (core dumped)