Repository: node
Issue: Fatal error in scavenger
Labels: v8 engine

<!--
Thank you for reporting an issue.

This issue tracker is for bugs and issues found within Node.js core.
If you require more general support please file an issue on our help
repo. https://github.com/nodejs/help


Please fill in as much of the template below as you're able.

Version: output of `node -v`
Platform: output of `uname -a` (UNIX), or version and 32 or 64-bit (Windows)
Subsystem: if known, please specify affected core module name
-->

* **Version**: 14.15.1, but probably from 10.xx all the way up to 14.15.1
* **Platform**: Ubuntu 16.04.1 with Linux Kernel 4.15.0-126-generic
* **Subsystem**:

### What steps will reproduce the bug?
We made this Distributed Computing Framework for Node.js(https://github.com/dcfjs/dcf) with nodeJS 8 and everything was fine. But while trying to upgrade to newer LTS versions of node, the worker process (the node process that is actually doing all the computation that involves reconstructing objects/functions from string) crashes under extensive computation load.

We tried a few versions from 10.xx, 12.xx and 14.xx respectively but all of them crashes with error messages related to the scavenger.

We tried a debug build of nodeJS 14.15.1, the debug build always crashes with the same error message:
\# Fatal error in ../deps/v8/src/heap/scavenger-inl.h, line 376
\# Debug check failed: Heap::InFromPage(object).

The complete error message is attached below.

<!--
Enter details about your bug, preferably a simple code snippet that can be
run using `node` directly without installing third-party dependencies.
-->

### How often does it reproduce? Is there a required condition?
It depends. On nodeJS 14.15.1:
It's more likely while running more worker than the number of CPU cores on the host machine, usually within 10 minutes.
It's less likely while running worker process with parallel scavenger disabled and single-threaded GC (usually I can get away with 20 to 30 minutes under heavy computation load, but eventually one of the workers will crash).

### What is the expected behavior?
Does not crash.

<!--
If possible please provide textual output instead of screenshots.
-->

### What do you see instead?
Full error message from nodeJS 14.15.1 debug build attached below:
```
#
# Fatal error in ../deps/v8/src/heap/scavenger-inl.h, line 376
# Debug check failed: Heap::InFromPage(object).
#
#
#
#FailureMessage Object: 0x7ffd75ba5580
 1: 0xee53d9 node::DumpBacktrace(_IO_FILE*) [/.../nodeSource/node-v14.15.1/node_g]
 2: 0x1076cd7  [/.../nodeSource/node-v14.15.1/node_g]
 3: 0x1076cf7  [/.../nodeSource/node-v14.15.1/node_g]
 4: 0x2a5207a V8_Fatal(char const*, int, char const*, ...) [/.../nodeSource/node-v14.15.1/node_g]
 5: 0x2a520a3  [/.../nodeSource/node-v14.15.1/node_g]
 6: 0x1600f54  [/.../nodeSource/node-v14.15.1/node_g]
 7: 0x1602e37 v8::internal::RootScavengeVisitor::VisitRootPointers(v8::internal::Root, char const*, v8::internal::FullObjectSlot, v8::internal::FullObjectSlot) [/.../nodeSource/node-v14.15.1/node_g]
 8: 0x1561bb1 v8::internal::Heap::IterateRoots(v8::internal::RootVisitor*, v8::base::EnumSet<v8::internal::SkipRoot, int>) [/.../nodeSource/node-v14.15.1/node_g]
 9: 0x1607af6 v8::internal::ScavengerCollector::CollectGarbage() [/.../nodeSource/node-v14.15.1/node_g]
10: 0x1562fd1 v8::internal::Heap::Scavenge() [/.../nodeSource/node-v14.15.1/node_g]
11: 0x1579fd8 v8::internal::Heap::PerformGarbageCollection(v8::internal::GarbageCollector, v8::GCCallbackFlags) [/.../nodeSource/node-v14.15.1/node_g]
12: 0x157a4df v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/.../nodeSource/node-v14.15.1/node_g]
13: 0x15fb26c v8::internal::ScavengeJob::Task::RunInternal() [/.../nodeSource/node-v14.15.1/node_g]
14: 0x13f5f66 non-virtual thunk to v8::internal::CancelableTask::Run() [/.../nodeSource/node-v14.15.1/node_g]
15: 0x10761a7 node::PerIsolatePlatformData::RunForegroundTask(std::unique_ptr<v8::Task, std::default_delete<v8::Task> >) [/.../nodeSource/node-v14.15.1/node_g]
16: 0x10767f5 node::PerIsolatePlatformData::FlushForegroundTasksInternal() [/.../nodeSource/node-v14.15.1/node_g]
17: 0x10752a5 node::PerIsolatePlatformData::FlushTasks(uv_async_s*) [/.../nodeSource/node-v14.15.1/node_g]
18: 0x1e82c60  [/.../nodeSource/node-v14.15.1/node_g]
19: 0x1e9bf05  [/.../nodeSource/node-v14.15.1/node_g]
20: 0x1e83639 uv_run [/.../nodeSource/node-v14.15.1/node_g]
21: 0x101df1a node::NodeMainInstance::Run() [/.../nodeSource/node-v14.15.1/node_g]
22: 0xf4e88f node::Start(int, char**) [/.../nodeSource/node-v14.15.1/node_g]
23: 0x26babc0 main [/.../nodeSource/node-v14.15.1/node_g]
24: 0x7f8428797840 __libc_start_main [/lib/x86_64-linux-gnu/libc.so.6]
25: 0xe91389 _start [/.../nodeSource/node-v14.15.1/node_g]
```

<!--
If possible please provide textual output instead of screenshots.
-->

### Additional information
The test machine is using i7-7820HQ CPU and 32G of memory.
The debug build didn't change any default compilation flag.

<!--
Tell us anything else you think we should know.
-->