Repository: node
Issue: Crash on snapshot deserialization during bootstrapping
Labels: v8 engine,snapshot

### Version

v20.10.0

### Platform

Linux sgimeno-N8xxEZ 5.15.0-89-generic #99-Ubuntu SMP Mon Oct 30 20:42:41 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

### Subsystem

src

### What steps will reproduce the bug?

Running `test/parallel/test-domain-error-types.js` under load would rarely cause this. To make the crash happen more consistently I had to run multiple instances in parallel while reducing the gc-interval:
```sh
export NODE_SKIP_FLAG_CHECK=1
for i in $(seq 1 10); do out/Debug/node --gc-interval=10 --stress-compaction test/parallel/test-domain-error-types.js & done
```

### How often does it reproduce? Is there a required condition?

Using the command above, mostly always. It seems having the gc kick in while deserializing the snapshot is causing the crash.

### What is the expected behavior? Why is that the expected behavior?

Not crashing.

### What do you see instead?

Variations of this thread backtraces can be extracted from the coredump
```
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000564aac6d01b7 in std::__atomic_base<long>::store (__m=std::memory_order_relaxed, __i=18264745316681, this=<optimized out>) at /usr/include/c++/11/bits/atomic_base.h:477
477		__atomic_store_n(&_M_i, __i, int(__m));
[Current thread is 1 (Thread 0x7f073bda2880 (LWP 2542886))]

(gdb) thread apply all bt

....

Thread 4 (Thread 0x7f073a59c640 (LWP 2542920)):
#0  v8::internal::PerThreadAssertScopeDebugOnly<(v8::internal::PerThreadAssertType)1, false>::PerThreadAssertScopeDebugOnly (this=0x7f073a59b568) at ../deps/v8/src/common/assert-scope.h:185
#1  v8::internal::CombinationAssertScope<v8::internal::PerThreadAssertScopeDebugOnly<(v8::internal::PerThreadAssertType)1, false> >::CombinationAssertScope (this=0x7f073a59b568) at ../deps/v8/src/common/assert-scope.h:148
#2  v8::internal::CombinationAssertScope<v8::internal::PerThreadAssertScopeDebugOnly<(v8::internal::PerThreadAssertType)0, false>, v8::internal::PerThreadAssertScopeDebugOnly<(v8::internal::PerThreadAssertType)1, false> >::CombinationAssertScope (this=0x7f073a59b560) at ../deps/v8/src/common/assert-scope.h:167
#3  v8::internal::TqRuntimeFromConstexpr_intptr_constexpr_IntegerLiteral_0 (p_i=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/fixed-array-tq-inl.inc:230
#4  0x0000564aac15cf46 in v8::internal::TqRuntimeFieldSliceScopeInfoPositionInfo (p_o=...) at ../deps/v8/src/numbers/integer-literal.h:18
#5  0x0000564aac15d1c7 in v8::internal::TqRuntimeFieldSliceScopeInfoOuterScopeInfo (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:730
#6  v8::internal::TqRuntimeFieldSliceScopeInfoLocalsBlockList (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:789
#7  v8::internal::TqRuntimeFieldSliceScopeInfoModuleInfo (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:850
#8  v8::internal::TqRuntimeFieldSliceScopeInfoModuleVariableCount (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:915
#9  0x0000564aac15d7af in v8::internal::TqRuntimeFieldSliceScopeInfoModuleVariables (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:991
#10 0x0000564aac1707b2 in v8::internal::TorqueGeneratedScopeInfo<v8::internal::ScopeInfo, v8::internal::HeapObject>::AllocatedSize (this=<optimized out>) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:2155
#11 v8::internal::ScopeInfo::BodyDescriptor::SizeOf (raw_object=..., map=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/objects-body-descriptors-inl.inc:32
#12 v8::internal::HeapVisitor<int, v8::internal::ConcurrentMarkingVisitor>::VisitScopeInfo (this=0x7f073a59b960, map=..., object=...) at ../deps/v8/src/heap/objects-visiting-inl.h:119
#13 0x0000564aac17aa89 in v8::internal::ConcurrentMarking::RunMajor (this=0x564ab364f4b0, delegate=delegate@entry=0x7f073a59bc50, code_flush_mode=..., mark_compact_epoch=<optimized out>, should_keep_ages_unchanged=<optimized out>) at ../deps/v8/src/heap/concurrent-marking.cc:459
#14 0x0000564aac17babd in v8::internal::ConcurrentMarking::JobTaskMajor::Run (this=0x564ab374d4d0, delegate=0x7f073a59bc50) at ../deps/v8/src/heap/concurrent-marking.cc:306
#15 0x0000564aad49f005 in v8::platform::DefaultJobWorker::Run (this=0x564ab3791630) at ../deps/v8/src/libplatform/default-job.h:147
#16 0x0000564aabb14aaf in node::(anonymous namespace)::PlatformWorkerThread (data=0x564ab35f9590) at ../src/node_platform.cc:43
#17 0x00007f073be3bac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#18 0x00007f073becda40 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thread 3 (Thread 0x7f073b59e640 (LWP 2542916)):
#0  0x0000564aabda6006 in v8::internal::TqRuntimeFromConstexpr_intptr_constexpr_IntegerLiteral_0 (p_i=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/fixed-array-tq-inl.inc:229
#1  0x0000564aabdb6c85 in v8::internal::TqRuntimeFieldSliceScopeInfoContextLocalNames (p_o=...) at ../deps/v8/src/numbers/integer-literal.h:18
#2  v8::internal::TqRuntimeFieldSliceScopeInfoContextLocalNamesHashtable (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:206
#3  0x0000564aac15c518 in v8::internal::TqRuntimeFieldSliceScopeInfoContextLocalInfos (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:265
#4  v8::internal::TqRuntimeFieldSliceScopeInfoSavedClassVariableInfo (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:306
#5  v8::internal::TqRuntimeFieldSliceScopeInfoFunctionVariableInfo (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:367
#6  v8::internal::TqRuntimeFieldSliceScopeInfoInferredFunctionName (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:432
#7  0x0000564aac15ca89 in v8::internal::TqRuntimeFieldSliceScopeInfoPositionInfo (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:533
#8  0x0000564aac15d1c7 in v8::internal::TqRuntimeFieldSliceScopeInfoOuterScopeInfo (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:730
#9  v8::internal::TqRuntimeFieldSliceScopeInfoLocalsBlockList (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:789
#10 v8::internal::TqRuntimeFieldSliceScopeInfoModuleInfo (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:850
#11 v8::internal::TqRuntimeFieldSliceScopeInfoModuleVariableCount (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:915
#12 0x0000564aac15d7af in v8::internal::TqRuntimeFieldSliceScopeInfoModuleVariables (p_o=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:991
#13 0x0000564aac1707b2 in v8::internal::TorqueGeneratedScopeInfo<v8::internal::ScopeInfo, v8::internal::HeapObject>::AllocatedSize (this=<optimized out>) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/scope-info-tq-inl.inc:2155
#14 v8::internal::ScopeInfo::BodyDescriptor::SizeOf (raw_object=..., map=...) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/objects-body-descriptors-inl.inc:32
#15 v8::internal::HeapVisitor<int, v8::internal::ConcurrentMarkingVisitor>::VisitScopeInfo (this=0x7f073b59d960, map=..., object=...) at ../deps/v8/src/heap/objects-visiting-inl.h:119
#16 0x0000564aac17aa89 in v8::internal::ConcurrentMarking::RunMajor (this=0x564ab364f4b0, delegate=delegate@entry=0x7f073b59dc50, code_flush_mode=..., mark_compact_epoch=<optimized out>, should_keep_ages_unchanged=<optimized out>) at ../deps/v8/src/heap/concurrent-marking.cc:459
#17 0x0000564aac17babd in v8::internal::ConcurrentMarking::JobTaskMajor::Run (this=0x564ab374d4d0, delegate=0x7f073b59dc50) at ../deps/v8/src/heap/concurrent-marking.cc:306
#18 0x0000564aad49f005 in v8::platform::DefaultJobWorker::Run (this=0x564ab37455d0) at ../deps/v8/src/libplatform/default-job.h:147
#19 0x0000564aabb14aaf in node::(anonymous namespace)::PlatformWorkerThread (data=0x564ab35f9240) at ../src/node_platform.cc:43
#20 0x00007f073be3bac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#21 0x00007f073becda40 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thread 2 (Thread 0x7f073ad9d640 (LWP 2542918)):
#0  v8::internal::ConcurrentMarking::RunMajor (this=0x564ab364f4b0, delegate=delegate@entry=0x7f073ad9cc50, code_flush_mode=..., mark_compact_epoch=<optimized out>, should_keep_ages_unchanged=<optimized out>) at ../deps/v8/src/heap/concurrent-marking.cc:453
#1  0x0000564aac17babd in v8::internal::ConcurrentMarking::JobTaskMajor::Run (this=0x564ab374d4d0, delegate=0x7f073ad9cc50) at ../deps/v8/src/heap/concurrent-marking.cc:306
#2  0x0000564aad49f005 in v8::platform::DefaultJobWorker::Run (this=0x564ab3745600) at ../deps/v8/src/libplatform/default-job.h:147
#3  0x0000564aabb14aaf in node::(anonymous namespace)::PlatformWorkerThread (data=0x564ab35f93f0) at ../src/node_platform.cc:43
#4  0x00007f073be3bac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#5  0x00007f073becda40 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thread 1 (Thread 0x7f073bda2880 (LWP 2542886)):
#0  0x0000564aac6d01b7 in std::__atomic_base<long>::store (__m=std::memory_order_relaxed, __i=18264745316681, this=<optimized out>) at /usr/include/c++/11/bits/atomic_base.h:477
#1  std::atomic_store_explicit<long> (__m=std::memory_order_relaxed, __i=18264745316681, __a=<optimized out>) at /usr/include/c++/11/atomic:1319
#2  v8::base::Relaxed_Store (value=18264745316681, ptr=<optimized out>) at ../deps/v8/src/base/atomicops.h:316
#3  v8::base::AsAtomicImpl<long>::Relaxed_Store<unsigned long> (new_value=18264745316681, addr=<optimized out>) at ../deps/v8/src/base/atomic-utils.h:110
#4  v8::internal::TaggedField<v8::internal::Object, 0, v8::internal::V8HeapCompressionScheme>::Relaxed_Store (offset=24, value=..., host=...) at ../deps/v8/src/objects/tagged-field-inl.h:153
#5  v8::internal::TaggedField<v8::internal::Object, 0, v8::internal::V8HeapCompressionScheme>::store (value=..., offset=24, host=...) at ../deps/v8/src/objects/tagged-field-inl.h:97
#6  v8::internal::TorqueGeneratedJSCollection<v8::internal::JSCollection, v8::internal::JSObject>::set_table (this=0x7fffb16707a0, value=..., mode=v8::internal::UPDATE_WRITE_BARRIER) at /home/sgimeno/software/node/out/Debug/obj/gen/torque-generated/src/objects/js-collection-tq-inl.inc:21
#7  0x0000564aac6e1374 in v8::internal::HeapObject::RehashBasedOnMap<v8::internal::Isolate> (this=0x7fffb16707d0, isolate=<optimized out>) at ../deps/v8/src/objects/objects.cc:2428
#8  0x0000564aac9d8bea in v8::internal::Deserializer<v8::internal::Isolate>::Rehash (this=this@entry=0x7fffb1670900) at ../deps/v8/src/snapshot/deserializer.h:78
#9  0x0000564aac9d21a0 in v8::internal::ContextDeserializer::Deserialize (this=this@entry=0x7fffb1670900, isolate=isolate@entry=0x564ab3600860, global_proxy=..., global_proxy@entry=..., embedder_fields_deserializer=...) at ../deps/v8/src/snapshot/context-deserializer.cc:53
#10 0x0000564aac9d24c9 in v8::internal::ContextDeserializer::DeserializeContext (isolate=isolate@entry=0x564ab3600860, data=data@entry=0x7fffb1670b40, can_rehash=<optimized out>, global_proxy=global_proxy@entry=..., embedder_fields_deserializer=...) at ../deps/v8/src/snapshot/context-deserializer.cc:22
#11 0x0000564aaca0bbe7 in v8::internal::Snapshot::NewContextFromSnapshot (isolate=isolate@entry=0x564ab3600860, global_proxy=..., global_proxy@entry=..., context_index=context_index@entry=3, embedder_fields_deserializer=...) at ../deps/v8/src/snapshot/snapshot.cc:208
#12 0x0000564aac3aaf21 in v8::internal::Genesis::Genesis (this=0x7fffb1670cc0, isolate=0x564ab3600860, maybe_global_proxy=..., global_proxy_template=..., context_snapshot_index=3, embedder_fields_deserializer=..., microtask_queue=0x0) at ../deps/v8/src/init/bootstrapper.cc:6661
#13 0x0000564aac3addd4 in v8::internal::Bootstrapper::CreateEnvironment (this=0x564ab361a220, maybe_global_proxy=..., maybe_global_proxy@entry=..., global_proxy_template=..., global_proxy_template@entry=..., extensions=extensions@entry=0x7fffb1670e00, context_snapshot_index=context_snapshot_index@entry=3, embedder_fields_deserializer=..., microtask_queue=microtask_queue@entry=0x0) at ../deps/v8/src/init/bootstrapper.cc:338
#14 0x0000564aabde6745 in v8::InvokeBootstrapper<v8::internal::Context>::Invoke (microtask_queue=0x0, embedder_fields_deserializer=..., context_snapshot_index=3, extensions=0x7fffb1670e00, global_proxy_template=..., maybe_global_proxy=..., i_isolate=0x564ab3600860, this=<synthetic pointer>) at ../deps/v8/src/api/api.cc:6624
#15 v8::CreateEnvironment<v8::internal::Context> (microtask_queue=0x0, embedder_fields_deserializer=..., context_snapshot_index=3, maybe_global_proxy=..., maybe_global_template=..., extensions=0x7fffb1670e00, i_isolate=0x564ab3600860) at ../deps/v8/src/api/api.cc:6728
#16 v8::NewContext (external_isolate=external_isolate@entry=0x564ab3600860, extensions=0x7fffb1670e00, extensions@entry=0x0, global_template=..., global_template@entry=..., global_object=..., global_object@entry=..., context_snapshot_index=context_snapshot_index@entry=3, embedder_fields_deserializer=..., microtask_queue=microtask_queue@entry=0x0) at ../deps/v8/src/api/api.cc:6769
#17 0x0000564aabde7324 in v8::Context::FromSnapshot (external_isolate=0x564ab3600860, context_snapshot_index=<optimized out>, embedder_fields_deserializer=..., extensions=0x0, global_object=..., microtask_queue=0x0) at ../deps/v8/src/api/api.cc:6804
#18 0x0000564aab88532f in node::CreateEnvironment (isolate_data=0x564ab365adc0, context=..., args=std::vector of length 2, capacity 2 = {...}, exec_args=std::vector of length 2, capacity 2 = {...}, flags=node::EnvironmentFlags::kDefaultFlags, thread_id=..., inspector_parent_handle=std::unique_ptr<node::InspectorParentHandle> = {...}) at ../src/api/environment.cc:452
#19 0x0000564aababeef6 in node::NodeMainInstance::CreateMainEnvironment (this=0x7fffb1671130, exit_code=0x7fffb1671084) at ../src/node_main_instance.cc:136
#20 0x0000564aababebbf in node::NodeMainInstance::Run (this=0x7fffb1671130) at ../src/node_main_instance.cc:84
#21 0x0000564aab9b37ec in node::StartInternal (argc=4, argv=0x564ab359d6f0) at ../src/node.cc:1387
#22 0x0000564aab9b38be in node::Start (argc=4, argv=0x7fffb1671368) at ../src/node.cc:1394
#23 0x0000564aad485b64 in main (argc=4, argv=0x7fffb1671368) at ../src/node_main.cc:97
```

### Additional information

_No response_