Crash in V8 GC on v24.x and earlier

Version

24.10.0

Platform

Darwin HQX-LGM9L426J5 25.2.0 Darwin Kernel Version 25.2.0: Tue Nov 18 21:09:40 PST 2025; root:xnu-12377.61.12~1/RELEASE_ARM64_T6000 arm64

Subsystem

GC, from the looks of it, maybe vm

What steps will reproduce the bug?

It's unfortunately not trivially reproducible. We see this ~1/10 times running our un-cached build runner, primarily while executing tests (which use a combination of worker threads and the vm module)

How often does it reproduce? Is there a required condition?

As stated above, something like 1/10 times.

What is the expected behavior? Why is that the expected behavior?

No segfault.

What do you see instead?

PID 22412 received SIGSEGV for address: 0xe
0   segfault-handler.node               0x0000000109630ee4 _ZL16segfault_handleriP9__siginfoPv + 288
1   libsystem_platform.dylib            0x0000000181a67744 _sigtramp + 56
2   node                                0x00000001029e0280 _ZN2v88internal35ClearStaleLeftTrimmedPointerVisitor17VisitRootPointersENS0_4RootEPKcNS0_14FullObjectSlotES5_ + 80
3   node                                0x00000001029278e4 _ZNK2v88internal13InternalFrame7IterateEPNS0_11RootVisitorE + 240
4   node                                0x000000010292cbf8 _ZN2v88internal7Isolate7IterateEPNS0_11RootVisitorEPNS0_14ThreadLocalTopE + 364
5   node                                0x00000001029e04ac _ZN2v88internal4Heap12IterateRootsEPNS0_11RootVisitorENS_4base7EnumSetINS0_8SkipRootEiEENS1_16IterateRootsModeE + 460
6   node                                0x00000001029fefe4 _ZN2v88internal20MarkCompactCollector9MarkRootsEPNS0_11RootVisitorE + 56
7   node                                0x00000001029fa96c _ZN2v88internal20MarkCompactCollector15MarkLiveObjectsEv + 968
8   node                                0x00000001029fa514 _ZN2v88internal20MarkCompactCollector14CollectGarbageEv + 128
9   node                                0x00000001029d94e8 _ZN2v88internal4Heap11MarkCompactEv + 420
10  node                                0x00000001029d8e50 _ZN2v88internal4Heap24PerformGarbageCollectionENS0_16GarbageCollectorENS0_23GarbageCollectionReasonEPKc + 824
11  node                                0x00000001029eb8c4 _ZZN2v88internal4Heap14CollectGarbageENS0_15AllocationSpaceENS0_23GarbageCollectionReasonENS_15GCCallbackFlagsEENK3$_1clEv + 1188
12  node                                0x00000001029eb408 _ZN4heap4base5Stack24SetMarkerAndCallbackImplIZN2v88internal4Heap14CollectGarbageENS4_15AllocationSpaceENS4_23GarbageCollectionReasonENS3_15GCCallbackFlagsEE3$_1EEvPS1_PvPKv + 40
13  node                                0x00000001033a09e4 PushAllRegistersAndIterateStack + 40
14  node                                0x00000001029d5248 _ZN2v88internal4Heap14CollectGarbageENS0_15AllocationSpaceENS0_23GarbageCollectionReasonENS_15GCCallbackFlagsE + 748
15  node                                0x000000010294d124 _ZN2v88internal10StackGuard16HandleInterruptsENS1_14InterruptLevelE + 504
16  node                                0x0000000102e3a19c _ZN2v88internal25Runtime_StackGuardWithGapEiPmPNS0_7IsolateE + 312
17  node                                0x0000000103491f74 Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit + 84
18  node                                0x00000001033f5934 Builtins_BaselineOutOfLinePrologue + 116
19  ???                                 0x00000003205419b8 0x0 + 13427284408
20  ???                                 0x0000000320541bc0 0x0 + 13427284928
21  ???                                 0x00000003206e4504 0x0 + 13428999428
22  node                                0x00000001033f4bec Builtins_InterpreterEntryTrampoline + 268
23  ???                                 0x000000032048b6f0 0x0 + 13426538224
24  ???                                 0x000000032048c9e4 0x0 + 13426543076
25  ???                                 0x000000032048d328 0x0 + 13426545448
26  ???                                 0x0000000320433be8 0x0 + 13426179048
27  ???                                 0x00000003201fddf8 0x0 + 13423861240
28  ???                                 0x00000003201fe22c 0x0 + 13423862316
29  ???                                 0x00000003201fe474 0x0 + 13423862900
30  ???                                 0x00000003204e32c0 0x0 + 13426897600
31  ???                                 0x00000003204e7dec 0x0 + 13426916844

Additional information

I'm not using native extensions other than the segfault handler installed specifically to capture this trace—the segfault was occuring prior to that.

Beginne mit dem V8-GC-Stack rund um ClearStaleLeftTrimmedPointerVisitor und der im Bericht beschriebenen Verwendung von Node vm und worker-thread. Reproduziere den Absturz mit dem nicht zwischengespeicherten Build-Runner und seiner Test-Workload und verfolge dann den intermittierenden SIGSEGV auf macOS. Das Ziel ist erreicht, wenn der GC-Absturz identifiziert und verhindert wurde, mit einem Regressionstest oder einer zuverlässigen Reproduktion, falls der Payload eine davon unterstützt.