Repository navigation
core dumped when takeHeapSnapshot for http2 server and memory leak #28088
Description
- Version: v12.3.1
- Platform: Darwin Kernel Version 18.5.0: Mon Mar 11 20:40:32 PDT 2019; root:xnu-4903.251.3~3/RELEASE_X86_64 x86_64
- Subsystem: http2
server.js
'use strict';
const http2 = require('http2');
const server = http2.createServer();
server.once('error', err => {
console.log(err);
});
server.on('session', session => {
console.log(session);
});
server.on('stream', (stream, headers) => {
console.log(stream, headers);
});
server.listen(12200, () => {
console.log('server start on %s', 12200);
});client.js
'use strict';
const connect = async () => {
return new Promise(resolve => {
const client = http2.connect('http://localhost:12200', () => {
client.close();
resolve();
});
});
};
(async () => {
while (true) {
await connect();
}
})();execute command:
node --gc-global --trace-gc --inspect server.js
node client.js
then take a snapshot in Chrome DevTools
the server process will take a core dumped.
[1] 49577 segmentation fault (core dumped) node --gc-global --trace-gc --inspect server.js
the dump file bt:
thread #1, stop reason = signal SIGSTOP
- frame #0: 0x00000001000a588b node`node::MemoryRetainerNode::MemoryRetainerNode(node::MemoryTracker*, node::MemoryRetainer const*) + 107
frame #1: 0x00000001000a551f node`node::MemoryTracker::AddNode(node::MemoryRetainer const*, char const*) + 87
frame #2: 0x000000010001a8e7 node`node::MemoryTracker::Track(node::MemoryRetainer const*, char const*) + 147
frame #3: 0x00000001000a450a node`node::http2::Http2Session::Http2Settings::MemoryInfo(node::MemoryTracker*) const + 134
frame #4: 0x000000010001a90b node`node::MemoryTracker::Track(node::MemoryRetainer const*, char const*) + 183
frame #5: 0x000000010003931b node`node::MemoryTracker::TrackField(char const*, node::CleanupHookCallback const&, char const*) + 193
frame #6: 0x000000010003a2ec node`void node::MemoryTracker::TrackField<std::__1::unordered_set<node::CleanupHookCallback, node::CleanupHookCallback::Hash, node::CleanupHookCallback::Equal, std::__1::allocator<node::CleanupHookCallback> >, std::__1::__hash_const_iterator<std::__1::__hash_node<node::CleanupHookCallback, void*>*> >(char const*, std::__1::unordered_set<node::CleanupHookCallback, node::CleanupHookCallback::Hash, node::CleanupHookCallback::Equal, std::__1::allocator<node::CleanupHookCallback> > const&, char const*, char const*, bool) + 146
frame #7: 0x0000000100039598 node`node::Environment::MemoryInfo(node::MemoryTracker*) const + 524
frame #8: 0x000000010001a90b node`node::MemoryTracker::Track(node::MemoryRetainer const*, char const*) + 183
frame #9: 0x000000010003660d node`node::Environment::BuildEmbedderGraph(v8::Isolate*, v8::EmbedderGraph*, void*) + 131
frame #10: 0x000000010074f57c node`v8::internal::HeapProfiler::BuildEmbedderGraph(v8::internal::Isolate*, v8::EmbedderGraph*) + 60
frame #11: 0x00000001007589dc node`v8::internal::NativeObjectsExplorer::IterateAndExtractReferences(v8::internal::HeapSnapshotGenerator*) + 172
frame #12: 0x0000000100759396 node`v8::internal::HeapSnapshotGenerator::GenerateSnapshot() + 230
frame #13: 0x000000010074f5f1 node`v8::internal::HeapProfiler::TakeSnapshot(v8::ActivityControl*, v8::HeapProfiler::ObjectNameResolver*) + 97
frame #14: 0x0000000100940d37 node`v8_inspector::V8HeapProfilerAgentImpl::takeHeapSnapshot(v8_inspector::protocol::Maybe<bool>) + 263
frame #15: 0x00000001009ff74e node`v8_inspector::protocol::HeapProfiler::DispatcherImpl::takeHeapSnapshot(int, v8_inspector::String16 const&, v8_inspector::protocol::ProtocolMessage const&, std::__1::unique_ptr<v8_inspector::protocol::DictionaryValue, std::__1::default_delete<v8_inspector::protocol::DictionaryValue> >, v8_inspector::protocol::ErrorSupport*) + 382
frame #16: 0x00000001009fdd94 node`v8_inspector::protocol::HeapProfiler::DispatcherImpl::dispatch(int, v8_inspector::String16 const&, v8_inspector::protocol::ProtocolMessage const&, std::__1::unique_ptr<v8_inspector::protocol::DictionaryValue, std::__1::default_delete<v8_inspector::protocol::DictionaryValue> >) + 116
frame #17: 0x00000001009db538 node`v8_inspector::protocol::UberDispatcher::dispatch(int, v8_inspector::String16 const&, std::__1::unique_ptr<v8_inspector::protocol::Value, std::__1::default_delete<v8_inspector::protocol::Value> >, v8_inspector::protocol::ProtocolMessage const&) + 584
frame #18: 0x0000000100948c3a node`v8_inspector::V8InspectorSessionImpl::dispatchProtocolMessage(v8_inspector::StringView const&) + 282
frame #19: 0x0000000100107001 node`node::inspector::NodeInspectorClient::dispatchMessageFromFrontend(int, v8_inspector::StringView const&) + 239
frame #20: 0x0000000100106d52 node`node::inspector::(anonymous namespace)::SameThreadInspectorSession::Dispatch(v8_inspector::StringView const&) + 58
Activity
joyeecheung commentedon Jun 7, 2019
I can reproduce it on master. I used the v8 API instead of the devtools for the ease of reproducing.
See stack trace
I also get
Pure virtual function calledsometimes, there may be a use-after-free for the reference fromHttp2SettingstoHttp2Session- something is holding onto theHttp2Settingswhen itsHttp2Sessionis already gone.See stack trace
cc @addaleax @nodejs/http2
http2: refactor ping + settings object lifetime management
http2: refactor ping + settings object lifetime management
http2: refactor ping + settings object lifetime management
smile21 commentedon Jul 10, 2019
Core dump fixed, but Http2Session leak already exist. @addaleax
Please take a snapshot for the http2 server when running the http2 connect/close a little while. (see above sample code)
http2: report memory allocated by nghttp2 to V8
addaleax commentedon Jul 11, 2019
@smile21 I don’t think there’s a real memory leak here, but rather an underestimation of the actual memory usage by the JS engine; #28645 should address that.
http2: report memory allocated by nghttp2 to V8
http2: report memory allocated by nghttp2 to V8
Please ignore this msg (#1)