Segfault compiling Node 14.15.5 from source.

[breisig]

I am compiling Node 14.15.5 using the latest CentOS 8 stream, I am getting the following segfault when compiling Node 14.15.5 from source under Virtualbox 6.1.18. Using the configure options [./configure --prefix=/usr --without-snapshot --without-node-snapshot --enable-lto]

root@localdev node-v14.15.5# make
make -C out BUILDTYPE=Release V=0
  touch 74146d9734f12c82a731201ad46e9d4c682f9a8f.intermediate
  LD_LIBRARY_PATH=/tmp/node-v14.15.5/out/Release/lib.host:/tmp/node-v14.15.5/out/Release/lib.target:$LD_LIBRARY_PATH; export LD_LIBRARY_PATH; cd ../.; mkdir -p /tmp/node-v14.15.5/out/Release/obj/gen/src/node/inspector/protocol; python tools/inspector_protocol/code_generator.py --jinja_dir tools/inspector_protocol --output_base "/tmp/node-v14.15.5/out/Release/obj/gen/src/" --config src/inspector/node_protocol_config.json
  touch 659355aabcc9729f3e83e96cb5da9dbce231b9df.intermediate
  LD_LIBRARY_PATH=/tmp/node-v14.15.5/out/Release/lib.host:/tmp/node-v14.15.5/out/Release/lib.target:$LD_LIBRARY_PATH; export LD_LIBRARY_PATH; cd ../tools/v8_gypfiles; mkdir -p /tmp/node-v14.15.5/out/Release/obj/gen/torque-output-root/torque-generated/../../deps/v8/src/wasm /tmp/node-v14.15.5/out/Release/obj/gen/torque-output-root/torque-generated /tmp/node-v14.15.5/out/Release/obj/gen/torque-output-root/torque-generated/../../deps/v8/src/objects /tmp/node-v14.15.5/out/Release/obj/gen/torque-output-root/torque-generated/../../deps/v8/test/torque /tmp/node-v14.15.5/out/Release/obj/gen/torque-output-root/torque-generated/../../deps/v8/src/builtins /tmp/node-v14.15.5/out/Release/obj/gen/torque-output-root/torque-generated/../../deps/v8/third_party/v8/builtins /tmp/node-v14.15.5/out/Release/obj/gen/torque-output-root/torque-generated/../../deps/v8/src/ic; "/tmp/node-v14.15.5/out/Release/torque" ../../deps/v8/src/builtins/array-copywithin.tq ../../deps/v8/src/builtins/array-every.tq ../../deps/v8/src/builtins/array-filter.tq ../../deps/v8/src/builtins/array-find.tq ../../deps/v8/src/builtins/array-findindex.tq ../../deps/v8/src/builtins/array-foreach.tq ../../deps/v8/src/builtins/array-from.tq ../../deps/v8/src/builtins/array-isarray.tq ../../deps/v8/src/builtins/array-join.tq ../../deps/v8/src/builtins/array-lastindexof.tq ../../deps/v8/src/builtins/array-map.tq ../../deps/v8/src/builtins/array-of.tq ../../deps/v8/src/builtins/array-reduce-right.tq ../../deps/v8/src/builtins/array-reduce.tq ../../deps/v8/src/builtins/array-reverse.tq ../../deps/v8/src/builtins/array-shift.tq ../../deps/v8/src/builtins/array-slice.tq ../../deps/v8/src/builtins/array-some.tq ../../deps/v8/src/builtins/array-splice.tq ../../deps/v8/src/builtins/array-unshift.tq ../../deps/v8/src/builtins/array.tq ../../deps/v8/src/builtins/base.tq ../../deps/v8/src/builtins/bigint.tq ../../deps/v8/src/builtins/boolean.tq ../../deps/v8/src/builtins/builtins-string.tq ../../deps/v8/src/builtins/collections.tq ../../deps/v8/src/builtins/cast.tq ../../deps/v8/src/builtins/convert.tq ../../deps/v8/src/builtins/console.tq ../../deps/v8/src/builtins/data-view.tq ../../deps/v8/src/builtins/finalization-registry.tq ../../deps/v8/src/builtins/frames.tq ../../deps/v8/src/builtins/frame-arguments.tq ../../deps/v8/src/builtins/growable-fixed-array.tq ../../deps/v8/src/builtins/ic-callable.tq ../../deps/v8/src/builtins/ic.tq ../../deps/v8/src/builtins/internal-coverage.tq ../../deps/v8/src/builtins/iterator.tq ../../deps/v8/src/builtins/math.tq ../../deps/v8/src/builtins/number.tq ../../deps/v8/src/builtins/object-fromentries.tq ../../deps/v8/src/builtins/object.tq ../../deps/v8/src/builtins/promise-abstract-operations.tq ../../deps/v8/src/builtins/promise-all.tq ../../deps/v8/src/builtins/promise-all-element-closure.tq ../../deps/v8/src/builtins/promise-any.tq ../../deps/v8/src/builtins/promise-constructor.tq ../../deps/v8/src/builtins/promise-finally.tq ../../deps/v8/src/builtins/promise-misc.tq ../../deps/v8/src/builtins/promise-race.tq ../../deps/v8/src/builtins/promise-reaction-job.tq ../../deps/v8/src/builtins/promise-resolve.tq ../../deps/v8/src/builtins/promise-then.tq ../../deps/v8/src/builtins/promise-jobs.tq ../../deps/v8/src/builtins/proxy-constructor.tq ../../deps/v8/src/builtins/proxy-delete-property.tq ../../deps/v8/src/builtins/proxy-get-property.tq ../../deps/v8/src/builtins/proxy-get-prototype-of.tq ../../deps/v8/src/builtins/proxy-has-property.tq ../../deps/v8/src/builtins/proxy-is-extensible.tq ../../deps/v8/src/builtins/proxy-prevent-extensions.tq ../../deps/v8/src/builtins/proxy-revocable.tq ../../deps/v8/src/builtins/proxy-revoke.tq ../../deps/v8/src/builtins/proxy-set-property.tq ../../deps/v8/src/builtins/proxy-set-prototype-of.tq ../../deps/v8/src/builtins/proxy.tq ../../deps/v8/src/builtins/reflect.tq ../../deps/v8/src/builtins/regexp-exec.tq ../../deps/v8/src/builtins/regexp-match-all.tq ../../deps/v8/src/builtins/regexp-match.tq ../../deps/v8/src/builtins/regexp-replace.tq ../../deps/v8/src/builtins/regexp-search.tq ../../deps/v8/src/builtins/regexp-source.tq ../../deps/v8/src/builtins/regexp-split.tq ../../deps/v8/src/builtins/regexp-test.tq ../../deps/v8/src/builtins/regexp.tq ../../deps/v8/src/builtins/string-endswith.tq ../../deps/v8/src/builtins/string-html.tq ../../deps/v8/src/builtins/string-iterator.tq ../../deps/v8/src/builtins/string-pad.tq ../../deps/v8/src/builtins/string-repeat.tq ../../deps/v8/src/builtins/string-replaceall.tq ../../deps/v8/src/builtins/string-slice.tq ../../deps/v8/src/builtins/string-startswith.tq ../../deps/v8/src/builtins/string-substring.tq ../../deps/v8/src/builtins/string-substr.tq ../../deps/v8/src/builtins/symbol.tq ../../deps/v8/src/builtins/torque-internal.tq ../../deps/v8/src/builtins/typed-array-createtypedarray.tq ../../deps/v8/src/builtins/typed-array-every.tq ../../deps/v8/src/builtins/typed-array-filter.tq ../../deps/v8/src/builtins/typed-array-find.tq ../../deps/v8/src/builtins/typed-array-findindex.tq ../../deps/v8/src/builtins/typed-array-foreach.tq ../../deps/v8/src/builtins/typed-array-from.tq ../../deps/v8/src/builtins/typed-array-of.tq ../../deps/v8/src/builtins/typed-array-reduce.tq ../../deps/v8/src/builtins/typed-array-reduceright.tq ../../deps/v8/src/builtins/typed-array-set.tq ../../deps/v8/src/builtins/typed-array-slice.tq ../../deps/v8/src/builtins/typed-array-some.tq ../../deps/v8/src/builtins/typed-array-sort.tq ../../deps/v8/src/builtins/typed-array-subarray.tq ../../deps/v8/src/builtins/typed-array.tq ../../deps/v8/src/builtins/wasm.tq ../../deps/v8/src/ic/handler-configuration.tq ../../deps/v8/src/objects/allocation-site.tq ../../deps/v8/src/objects/api-callbacks.tq ../../deps/v8/src/objects/arguments.tq ../../deps/v8/src/objects/cell.tq ../../deps/v8/src/objects/code.tq ../../deps/v8/src/objects/contexts.tq ../../deps/v8/src/objects/data-handler.tq ../../deps/v8/src/objects/debug-objects.tq ../../deps/v8/src/objects/descriptor-array.tq ../../deps/v8/src/objects/embedder-data-array.tq ../../deps/v8/src/objects/feedback-cell.tq ../../deps/v8/src/objects/feedback-vector.tq ../../deps/v8/src/objects/fixed-array.tq ../../deps/v8/src/objects/foreign.tq ../../deps/v8/src/objects/free-space.tq ../../deps/v8/src/objects/heap-number.tq ../../deps/v8/src/objects/heap-object.tq ../../deps/v8/src/objects/js-aggregate-error.tq ../../deps/v8/src/objects/js-array-buffer.tq ../../deps/v8/src/objects/js-array.tq ../../deps/v8/src/objects/js-collection-iterator.tq ../../deps/v8/src/objects/js-collection.tq ../../deps/v8/src/objects/js-generator.tq ../../deps/v8/src/objects/js-objects.tq ../../deps/v8/src/objects/js-promise.tq ../../deps/v8/src/objects/js-proxy.tq ../../deps/v8/src/objects/js-regexp-string-iterator.tq ../../deps/v8/src/objects/js-regexp.tq ../../deps/v8/src/objects/js-weak-refs.tq ../../deps/v8/src/objects/literal-objects.tq ../../deps/v8/src/objects/map.tq ../../deps/v8/src/objects/microtask.tq ../../deps/v8/src/objects/module.tq ../../deps/v8/src/objects/name.tq ../../deps/v8/src/objects/oddball.tq ../../deps/v8/src/objects/ordered-hash-table.tq ../../deps/v8/src/objects/primitive-heap-object.tq ../../deps/v8/src/objects/promise.tq ../../deps/v8/src/objects/property-array.tq ../../deps/v8/src/objects/property-cell.tq ../../deps/v8/src/objects/property-descriptor-object.tq ../../deps/v8/src/objects/prototype-info.tq ../../deps/v8/src/objects/regexp-match-info.tq ../../deps/v8/src/objects/scope-info.tq ../../deps/v8/src/objects/script.tq ../../deps/v8/src/objects/shared-function-info.tq ../../deps/v8/src/objects/source-text-module.tq ../../deps/v8/src/objects/stack-frame-info.tq ../../deps/v8/src/objects/string.tq ../../deps/v8/src/objects/struct.tq ../../deps/v8/src/objects/synthetic-module.tq ../../deps/v8/src/objects/template-objects.tq ../../deps/v8/src/objects/template.tq ../../deps/v8/src/wasm/wasm-objects.tq ../../deps/v8/test/torque/test-torque.tq ../../deps/v8/third_party/v8/builtins/array-sort.tq ../../deps/v8/src/objects/intl-objects.tq -o "/tmp/node-v14.15.5/out/Release/obj/gen/torque-output-root/torque-generated" -v8-root ../../deps/v8
/bin/sh: line 1: 45346 Segmentation fault      (core dumped) "/tmp/node-v14.15.5/out/Release/torque" ../../deps/v8/src/builtins/array-copywithin.tq ../../deps/v8/src/builtins/array-every.tq ../../deps/v8/src/builtins/array-filter.tq ../../deps/v8/src/builtins/array-find.tq ../../deps/v8/src/builtins/array-findindex.tq ../../deps/v8/src/builtins/array-foreach.tq ../../deps/v8/src/builtins/array-from.tq ../../deps/v8/src/builtins/array-isarray.tq ../../deps/v8/src/builtins/array-join.tq ../../deps/v8/src/builtins/array-lastindexof.tq ../../deps/v8/src/builtins/array-map.tq ../../deps/v8/src/builtins/array-of.tq ../../deps/v8/src/builtins/array-reduce-right.tq ../../deps/v8/src/builtins/array-reduce.tq ../../deps/v8/src/builtins/array-reverse.tq ../../deps/v8/src/builtins/array-shift.tq ../../deps/v8/src/builtins/array-slice.tq ../../deps/v8/src/builtins/array-some.tq ../../deps/v8/src/builtins/array-splice.tq ../../deps/v8/src/builtins/array-unshift.tq ../../deps/v8/src/builtins/array.tq ../../deps/v8/src/builtins/base.tq ../../deps/v8/src/builtins/bigint.tq ../../deps/v8/src/builtins/boolean.tq ../../deps/v8/src/builtins/builtins-string.tq ../../deps/v8/src/builtins/collections.tq ../../deps/v8/src/builtins/cast.tq ../../deps/v8/src/builtins/convert.tq ../../deps/v8/src/builtins/console.tq ../../deps/v8/src/builtins/data-view.tq ../../deps/v8/src/builtins/finalization-registry.tq ../../deps/v8/src/builtins/frames.tq ../../deps/v8/src/builtins/frame-arguments.tq ../../deps/v8/src/builtins/growable-fixed-array.tq ../../deps/v8/src/builtins/ic-callable.tq ../../deps/v8/src/builtins/ic.tq ../../deps/v8/src/builtins/internal-coverage.tq ../../deps/v8/src/builtins/iterator.tq ../../deps/v8/src/builtins/math.tq ../../deps/v8/src/builtins/number.tq ../../deps/v8/src/builtins/object-fromentries.tq ../../deps/v8/src/builtins/object.tq ../../deps/v8/src/builtins/promise-abstract-operations.tq ../../deps/v8/src/builtins/promise-all.tq ../../deps/v8/src/builtins/promise-all-element-closure.tq ../../deps/v8/src/builtins/promise-any.tq ../../deps/v8/src/builtins/promise-constructor.tq ../../deps/v8/src/builtins/promise-finally.tq ../../deps/v8/src/builtins/promise-misc.tq ../../deps/v8/src/builtins/promise-race.tq ../../deps/v8/src/builtins/promise-reaction-job.tq ../../deps/v8/src/builtins/promise-resolve.tq ../../deps/v8/src/builtins/promise-then.tq ../../deps/v8/src/builtins/promise-jobs.tq ../../deps/v8/src/builtins/proxy-constructor.tq ../../deps/v8/src/builtins/proxy-delete-property.tq ../../deps/v8/src/builtins/proxy-get-property.tq ../../deps/v8/src/builtins/proxy-get-prototype-of.tq ../../deps/v8/src/builtins/proxy-has-property.tq ../../deps/v8/src/builtins/proxy-is-extensible.tq ../../deps/v8/src/builtins/proxy-prevent-extensions.tq ../../deps/v8/src/builtins/proxy-revocable.tq ../../deps/v8/src/builtins/proxy-revoke.tq ../../deps/v8/src/builtins/proxy-set-property.tq ../../deps/v8/src/builtins/proxy-set-prototype-of.tq ../../deps/v8/src/builtins/proxy.tq ../../deps/v8/src/builtins/reflect.tq ../../deps/v8/src/builtins/regexp-exec.tq ../../deps/v8/src/builtins/regexp-match-all.tq ../../deps/v8/src/builtins/regexp-match.tq ../../deps/v8/src/builtins/regexp-replace.tq ../../deps/v8/src/builtins/regexp-search.tq ../../deps/v8/src/builtins/regexp-source.tq ../../deps/v8/src/builtins/regexp-split.tq ../../deps/v8/src/builtins/regexp-test.tq ../../deps/v8/src/builtins/regexp.tq ../../deps/v8/src/builtins/string-endswith.tq ../../deps/v8/src/builtins/string-html.tq ../../deps/v8/src/builtins/string-iterator.tq ../../deps/v8/src/builtins/string-pad.tq ../../deps/v8/src/builtins/string-repeat.tq ../../deps/v8/src/builtins/string-replaceall.tq ../../deps/v8/src/builtins/string-slice.tq ../../deps/v8/src/builtins/string-startswith.tq ../../deps/v8/src/builtins/string-substring.tq ../../deps/v8/src/builtins/string-substr.tq ../../deps/v8/src/builtins/symbol.tq ../../deps/v8/src/builtins/torque-internal.tq ../../deps/v8/src/builtins/typed-array-createtypedarray.tq ../../deps/v8/src/builtins/typed-array-every.tq ../../deps/v8/src/builtins/typed-array-filter.tq ../../deps/v8/src/builtins/typed-array-find.tq ../../deps/v8/src/builtins/typed-array-findindex.tq ../../deps/v8/src/builtins/typed-array-foreach.tq ../../deps/v8/src/builtins/typed-array-from.tq ../../deps/v8/src/builtins/typed-array-of.tq ../../deps/v8/src/builtins/typed-array-reduce.tq ../../deps/v8/src/builtins/typed-array-reduceright.tq ../../deps/v8/src/builtins/typed-array-set.tq ../../deps/v8/src/builtins/typed-array-slice.tq ../../deps/v8/src/builtins/typed-array-some.tq ../../deps/v8/src/builtins/typed-array-sort.tq ../../deps/v8/src/builtins/typed-array-subarray.tq ../../deps/v8/src/builtins/typed-array.tq ../../deps/v8/src/builtins/wasm.tq ../../deps/v8/src/ic/handler-configuration.tq ../../deps/v8/src/objects/allocation-site.tq ../../deps/v8/src/objects/api-callbacks.tq ../../deps/v8/src/objects/arguments.tq ../../deps/v8/src/objects/cell.tq ../../deps/v8/src/objects/code.tq ../../deps/v8/src/objects/contexts.tq ../../deps/v8/src/objects/data-handler.tq ../../deps/v8/src/objects/debug-objects.tq ../../deps/v8/src/objects/descriptor-array.tq ../../deps/v8/src/objects/embedder-data-array.tq ../../deps/v8/src/objects/feedback-cell.tq ../../deps/v8/src/objects/feedback-vector.tq ../../deps/v8/src/objects/fixed-array.tq ../../deps/v8/src/objects/foreign.tq ../../deps/v8/src/objects/free-space.tq ../../deps/v8/src/objects/heap-number.tq ../../deps/v8/src/objects/heap-object.tq ../../deps/v8/src/objects/js-aggregate-error.tq ../../deps/v8/src/objects/js-array-buffer.tq ../../deps/v8/src/objects/js-array.tq ../../deps/v8/src/objects/js-collection-iterator.tq ../../deps/v8/src/objects/js-collection.tq ../../deps/v8/src/objects/js-generator.tq ../../deps/v8/src/objects/js-objects.tq ../../deps/v8/src/objects/js-promise.tq ../../deps/v8/src/objects/js-proxy.tq ../../deps/v8/src/objects/js-regexp-string-iterator.tq ../../deps/v8/src/objects/js-regexp.tq ../../deps/v8/src/objects/js-weak-refs.tq ../../deps/v8/src/objects/literal-objects.tq ../../deps/v8/src/objects/map.tq ../../deps/v8/src/objects/microtask.tq ../../deps/v8/src/objects/module.tq ../../deps/v8/src/objects/name.tq ../../deps/v8/src/objects/oddball.tq ../../deps/v8/src/objects/ordered-hash-table.tq ../../deps/v8/src/objects/primitive-heap-object.tq ../../deps/v8/src/objects/promise.tq ../../deps/v8/src/objects/property-array.tq ../../deps/v8/src/objects/property-cell.tq ../../deps/v8/src/objects/property-descriptor-object.tq ../../deps/v8/src/objects/prototype-info.tq ../../deps/v8/src/objects/regexp-match-info.tq ../../deps/v8/src/objects/scope-info.tq ../../deps/v8/src/objects/script.tq ../../deps/v8/src/objects/shared-function-info.tq ../../deps/v8/src/objects/source-text-module.tq ../../deps/v8/src/objects/stack-frame-info.tq ../../deps/v8/src/objects/string.tq ../../deps/v8/src/objects/struct.tq ../../deps/v8/src/objects/synthetic-module.tq ../../deps/v8/src/objects/template-objects.tq ../../deps/v8/src/objects/template.tq ../../deps/v8/src/wasm/wasm-objects.tq ../../deps/v8/test/torque/test-torque.tq ../../deps/v8/third_party/v8/builtins/array-sort.tq ../../deps/v8/src/objects/intl-objects.tq -o "/tmp/node-v14.15.5/out/Release/obj/gen/torque-output-root/torque-generated" -v8-root ../../deps/v8
make[1]: *** [tools/v8_gypfiles/run_torque.target.mk:17: 659355aabcc9729f3e83e96cb5da9dbce231b9df.intermediate] Error 139
rm 74146d9734f12c82a731201ad46e9d4c682f9a8f.intermediate 659355aabcc9729f3e83e96cb5da9dbce231b9df.intermediate
make: *** [Makefile:104: node] Error 2

When checking dmesg, It shows

[  688.228005] torque[45346]: segfault at 0 ip 0000000000000000 sp 00007fff51986588 error 14 in torque[400000+166000]
[  688.228042] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.

[BethGriggs]

@breisig just to confirm, have you been able to successfully build any previous versions of v14.x with this setup and configuration options? (Do you believe it to be a regression in a recent version?)

[breisig]

Ok, I have narrowed down the segfault. When I installed the latest CentOS 8.3 [and updated to the latest updates as of today], NodeJS compiles without any issues. However, when I compile NodeJS under the latest CentOS 8 Stream (20210204 iso + the latest patches as of today), it segfaults with that error.

[breisig]

It seems if I remove --enable-lto from the configure line, it compiles without any issue on CentOS 8 Stream.

[richardlau]

FWIW I was able to reproduce the crash with --enable-lto on CentOS 8 Stream running under WSL2 when using gcc/g++ 8.4.1 but not with gcc/g++ 10.2.1 (from gcc-toolset-10).

$ gcc --version
gcc (GCC) 8.4.1 20200928 (Red Hat 8.4.1-1)
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$ scl enable gcc-toolset-10 bash
$ gcc --version
gcc (GCC) 10.2.1 20201030 (Red Hat 10.2.1-7)
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$