Details
-
Bug
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
0.17.0, 0.18.0, 0.18.1, 0.19.0
-
None
Description
Large messages cause Thrift client to crash when using TFramedTransport.
Crash is caused by array overflow of residual variable in receiver function.
Stack trace for Node.js v21.7.1
(pinpoints the cause as it is using new version of V8)
<redacted>/thrift/lib/nodejs/lib/thrift/framed_transport.js:43 residual.push(data[i]) ^ RangeError: Invalid array length at Array.push (<anonymous>) at <redacted>/thrift/lib/nodejs/lib/thrift/framed_transport.js:43:16 <redacted>
Stack trace for Node.js LTS v20.11.1
# # Fatal error in , line 0 # Fatal JavaScript invalid size error 169220804 (see crbug.com/1201626) # # # #FailureMessage Object: 0x16f48a0f8 ----- Native stack trace ----- 1: 0x100aad340 node::NodePlatform::GetStackTracePrinter()::$_3::__invoke() [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 2: 0x101b309ac V8_Fatal(char const*, <redacted>) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 3: 0x100d71334 v8::internal::FactoryBase<v8::internal::Factory>::NewFixedArrayWithFiller(v8::internal::Handle<v8::internal::Map>, int, v8::internal::Handle<v8::internal::Oddball>, v8::internal::AllocationType) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 4: 0x100f0cf68 v8::internal::(anonymous namespace)::ElementsAccessorBase<v8::internal::(anonymous namespace)::FastPackedSmiElementsAccessor, v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)0>>::GrowCapacity(v8::internal::Handle<v8::internal::JSObject>, unsigned int) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 5: 0x101158600 v8::internal::Runtime_GrowArrayElements(int, unsigned long*, v8::internal::Isolate*) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 6: 0x1014c4c44 Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 7: 0x1064cfe9c 8: 0x1064aac88 9: 0x10143c3e4 Builtins_InterpreterEntryTrampoline [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 10: 0x1064aac88 11: 0x10143c3e4 Builtins_InterpreterEntryTrampoline [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 12: 0x10143c3e4 Builtins_InterpreterEntryTrampoline [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 13: 0x10143a50c Builtins_JSEntryTrampoline [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 14: 0x10143a1f4 Builtins_JSEntry [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 15: 0x100d104f8 v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 16: 0x100d0f944 v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 17: 0x100bea214 v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 18: 0x100978fd8 node::InternalMakeCallback(node::Environment*, v8::Local<v8::Object>, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 19: 0x100979304 node::MakeCallback(v8::Isolate*, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 20: 0x1009ee554 node::Environment::CheckImmediate(uv_check_s*) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 21: 0x1014209e0 uv__run_check [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 22: 0x10141a700 uv_run [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 23: 0x100979754 node::SpinEventLoopInternal(node::Environment*) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 24: 0x100a89c6c node::NodeMainInstance::Run(node::ExitCode*, node::Environment*) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 25: 0x100a89a08 node::NodeMainInstance::Run() [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 26: 0x100a13718 node::Start(int, char**) [<redacted>/.nvm/versions/node/v20.11.1/bin/node] 27: 0x1a61dff28 start [/usr/lib/dyld]
Attachments
Issue Links
- links to