Node crashes on large number of SharedArrayBuffer

[denyaalt]

Version

v20.12.0

Platform

Linux 6.1.0-17-amd64 Debian 6.1.69-1

Subsystem

No response

What steps will reproduce the bug?

for(var arr=[],k=0; k<20000; k++) {var obj={};
{
    obj.s1=new SharedArrayBuffer(1,{maxByteLength:1024*1024*1024});
    obj.s2=new SharedArrayBuffer(1,{maxByteLength:1024*1024*1024});
    obj.s3=new SharedArrayBuffer(1,{maxByteLength:1024*1024*1024});
    arr.push(obj);
}}

How often does it reproduce? Is there a required condition?

No response

What is the expected behavior? Why is that the expected behavior?

No response

What do you see instead?

<--- Last few GCs --->

[445220:0x62060e0]       43 ms: Scavenge 5.0 (6.2) -> 4.8 (8.5) MB, 0.44 / 0.00 ms  (average mu = 1.000, current mu = 1.000) allocation failure;
[445220:0x62060e0]       73 ms: Scavenge 6.1 (8.5) -> 5.8 (9.0) MB, 0.54 / 0.00 ms  (average mu = 1.000, current mu = 1.000) allocation failure;
[445220:0x62060e0]       92 ms: Scavenge 6.6 (9.0) -> 6.5 (14.7) MB, 1.45 / 0.00 ms  (average mu = 1.000, current mu = 1.000) allocation failure;

<--- JS stacktrace --->

FATAL ERROR: MarkCompactCollector: young object promotion failed Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

<--- Last few GCs --->

[445220:0x62060e0]       43 ms: Scavenge 5.0 (6.2) -> 4.8 (8.5) MB, 0.44 / 0.00 ms  (average mu = 1.000, current mu = 1.000) allocation failure;
[445220:0x62060e0]       73 ms: Scavenge 6.1 (8.5) -> 5.8 (9.0) MB, 0.54 / 0.00 ms  (average mu = 1.000, current mu = 1.000) allocation failure;
[445220:0x62060e0]       92 ms: Scavenge 6.6 (9.0) -> 6.5 (14.7) MB, 1.45 / 0.00 ms  (average mu = 1.000, current mu = 1.000) allocation failure;

<--- JS stacktrace --->

FATAL ERROR: MarkCompactCollector: young object promotion failed Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

<--- Last few GCs --->

[445220:0x62060e0]       43 ms: Scavenge 5.0 (6.2) -> 4.8 (8.5) MB, 0.44 / 0.00 ms  (average mu = 1.000, current mu = 1.000) allocation failure;
[445220:0x62060e0]       73 ms: Scavenge 6.1 (8.5) -> 5.8 (9.0) MB, 0.54 / 0.00 ms  (average mu = 1.000, current mu = 1.000) allocation failure;
[445220:0x62060e0]       92 ms: Scavenge 6.6 (9.0) -> 6.5 (14.7) MB, 1.45 / 0.00 ms  (average mu = 1.000, current mu = 1.000) allocation failure;

<--- JS stacktrace --->

FATAL ERROR: MarkCompactCollector: young object promotion failed Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

<--- Last few GCs --->

[445220:0x62060e0]       43 ms: Scavenge 5.0 (6.2) -> 4.8 (8.5) MB, 0.44 / 0.00 ms  (average mu = 1.000, current mu = 1.000) allocation failure;
[445220:0x62060e0]       73 ms: Scavenge 6.1 (8.5) -> 5.8 (9.0) MB, 0.54 / 0.00 ms  (average mu = 1.000, current mu = 1.000) allocation failure;
[445220:0x62060e0]       92 ms: Scavenge 6.6 (9.0) -> 6.5 (14.7) MB, 1.45 / 0.00 ms  (average mu = 1.000, current mu = 1.000) allocation failure;

<--- JS stacktrace --->

FATAL ERROR: MarkCompactCollector: young object promotion failed Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0xb84bd6 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [node]
 2: 0xefead0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [node]
 3: 0xefedb7 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [node]
 4: 0x11107c5  [node]
 5: 0x114d454 v8::internal::EvacuateNewSpaceVisitor::Visit(v8::internal::HeapObject, int) [node]
 6: 0x115b186 v8::internal::Evacuator::RawEvacuatePage(v8::internal::MemoryChunk*, long*) [node]
 7: 0x115b8f3 v8::internal::Evacuator::EvacuatePage(v8::internal::MemoryChunk*) [node]
 8: 0x115bd6f v8::internal::PageEvacuationJob::Run(v8::JobDelegate*) [node]
 9: 0x1d75768 v8::platform::DefaultJobWorker::Run() [node]
10: 0xd49291  [node]
11: 0x7f18607c9134  [/lib/x86_64-linux-gnu/libc.so.6]
12: 0x7f18608497dc  [/lib/x86_64-linux-gnu/libc.so.6]
Aborted

Additional information

Hi, Immediately after startup, the node crashes due to memory failure. If SharedArrayBuffer is not added as a property of the object, then the error does not occur. How to avoid the error and why does it occur? Thanks.

[benjamingr]

How to avoid the error and why does it occur?

Your Node process is running out of memory, if your system has enough memory you can increase the heap size with command line flags.

If SharedArrayBuffer is not added as a property of the object, then the error does not occur.

That's because then Node can collect the memory (release it).

[denyaalt]

I create a SharedArrayBuffer of 1 byte in size, a total of 60kB should be allocated. This is an internal node bug; it reserves memory in the amount of maxByteLength for each SharedArrayBuffer instance. Why do we need maxByteLength then, if the memory is already reserved?

[RedYetiDev]

Hi @denyaalt!

As @benjamingr stated, the error that is occuring is that your system has run out of memory. IIRC (and IIUC), SharedArrayBuffer will allocate the maximum amount of memory needed, in case it ends up needing that memory. (Although I might be wrong).

I'm optimistically adding workaround provided, but if you disagree, let me know and I'll remove it.