Fatal error when comparing long strings

[jdmnd]

• Version: v7.9.0
• Platform: Darwin 15.6.0 Darwin Kernel Version 15.6.0: Mon Jan 9 23:07:29 PST 2017; root:xnu-3248.60.11.2.1~1/RELEASE_X86_64 x86_64
• Subsystem: ?

The following code snippet causes node to crash:

('a'.repeat(268435441)) === ('a'.repeat(268435441))

Note: The crash appears to only affect strings of length exactly 268435441 (2^28 - 15)

Output:

#
# Fatal error in ../deps/v8/src/handles.h, line 210
# Check failed: (location_) != nullptr.
#

==== C stack trace ===============================

    0   node                                0x0000000100bcb703 v8::base::debug::StackTrace::StackTrace() + 19
    1   node                                0x0000000100bc8889 V8_Fatal + 233
    2   node                                0x0000000100679c6f v8::internal::String::SlowFlatten(v8::internal::Handle<v8::internal::ConsString>, v8::internal::PretenureFlag) + 1039
    3   node                                0x000000010069ed06 v8::internal::String::SlowEquals(v8::internal::Handle<v8::internal::String>, v8::internal::Handle<v8::internal::String>) + 678
    4   node                                0x00000001008848d1 v8::internal::Runtime_StringEqual(int, v8::internal::Object**, v8::internal::Isolate*) + 337
    5   ???                                 0x00001c377a3063a7 0x0 + 31024598770599
Illegal instruction: 4

[mscdex]

/cc @nodejs/v8

[vsemozhetbyt]

@jdmnd @mscdex See #9489 and #10687

[bmeurer]

Doesn't reproduce on latest V8, probably fixed since then.

[mscdex]

@vsemozhetbyt Getting an 'illegal instruction' error is different than the errors received in those two linked issues. At least in both of those cases, the error can be caught. This error cannot be caught.

[TimothyGu]

I can reproduce this on v7.9.0, but not on master.

[bmeurer]

Reproduces on V8 5.5. The string created by S.p.repeat has an invalid length, which crashes in flattening. Somehow S.p.repeat should already throw, but doesn't.

[bmeurer]

Manually bisected to crrev.com/2653623002, you'll probably need to merge that.

[hashseed]

The V8 fix landed in 5.8.

[targos]

The fix just landed on v7.x-staging and should be in the next 7.x release.