Segfault in TLSWrap in v5.5.0 and master.

[ChALkeR]

Program received signal SIGSEGV, Segmentation fault.
0x000000000152127a in node::TLSWrap::IsAlive (this=0x1eb37f0) at ../src/tls_wrap.cc:521
521       return ssl_ != nullptr && stream_->IsAlive();
(gdb) bt
#0  0x000000000152127a in node::TLSWrap::IsAlive (this=0x1eb37f0) at ../src/tls_wrap.cc:521
#1  0x0000000001522fb6 in node::StreamBase::GetFD<node::TLSWrap> (key=..., args=...) at ../src/stream_base-inl.h:75
#2  0x0000000000c75829 in v8::internal::PropertyCallbackArguments::Call (this=0x7fffffffbf90, f=0x1522f64 <node::StreamBase::GetFD<node::TLSWrap>(v8::Local<v8::String>, v8::PropertyCallbackInfo<v8::Value> const&)>, arg1=...)
    at ../deps/v8/src/arguments.cc:86
#3  0x000000000118752c in v8::internal::Object::GetPropertyWithAccessor (it=0x7fffffffc1d0, language_mode=v8::internal::SLOPPY) at ../deps/v8/src/objects.cc:891
#4  0x00000000011869d0 in v8::internal::Object::GetProperty (it=0x7fffffffc1d0, language_mode=v8::internal::SLOPPY) at ../deps/v8/src/objects.cc:706
#5  0x00000000012d93e8 in v8::internal::GetOwnProperty (isolate=0x1dfbce0, obj=..., name=...) at ../deps/v8/src/runtime/runtime-object.cc:236
#6  0x00000000012d96e5 in v8::internal::__RT_impl_Runtime_GetOwnProperty (args=..., isolate=0x1dfbce0) at ../deps/v8/src/runtime/runtime-object.cc:259
#7  0x00000000012d959f in v8::internal::Runtime_GetOwnProperty (args_length=2, args_object=0x7fffffffc3b0, isolate=0x1dfbce0) at ../deps/v8/src/runtime/runtime-object.cc:253

Edit: updated, line numbers are against current master (1124de2) now.

Current master, v4.2.6, v5.5.0 are affected. Bisect points at 75930bb.

It crashes at tls_wrap.cc#L521.

/cc @indutny

Testcase (looks like a race to me, not guaranteed to reproduce everywhere):

'use strict';

var bhttp = require('bhttp');

var endpoint = 'https://api.npmjs.org/downloads/point/last-month/';
var group = '0,1,2,3,4,5,6,7,8,9,10,11,13,28,34,42,58,66,69,88,99,100,101,102,110,123,200,233,300,301,302,360,400,403,404,422,500,520,531,625,666,824,999,1024,1129,1212,1234,1314,1664,1985,2014,2015,2016,2048,2112,4000,7239,8583,9000,9292,12306,78579,1771278,20151203,540269584,0.0.1,0.workspace,001,001_skt,001_test,007,008-somepackage,009,01,01-simple,0126af95c0e2d9b0a7c78738c4c00a860b04acc8,06_byvoidmodule,0flux,0latency,0model,0s,0x21,0x23,1_modules,1_modules_test,1-1-help-desk-system,1-liners,1-wire-js,1.0.1,1.0.2,100-prisoners,101-es6,101-tomekwi,10119-dep,10119-subdep,10bis,10bisjs,10cartsharing,10er10,10tcl,11-packagemath,11-packagename,11zgit-fs,11znode-meta,11zsimple-mime,11zstack,11zwheat,12-03-2014-michelle-speak,12-3-14_breana-gonzales_speak,123test,1257-server,127-ssh,127.0.0.1,12byvoidmodule,12env,12factor-config,12factor-dotenv,12factor-log,16pixels,17t,18f-contrib-web-design-standards,192.168.0.1,1and1,1batch,1bit,1bit-chart-bars,1broker,1campus_nodedsa,1css,1pass,1password,1password-manager,1password2pass,1pif-to-csv,1pif-to-keepass,1px,1rm,1sc-api,1st_test_yamineo,1stand15th,1t,1vk,2-sat,2-ways-binding-example,2015-cse218-group5-algorithm,201508ajax,2048.io,20lines-chatroom,21828e4e,23andme,23andme-node,23query,24point,255kb-meteor-status-client-side,256colors,27bslash6-module,28.io-angularjs,28.io-nodejs,2b,2captcha,2cca,2ch,2ch-trip,2checkout-node,2co,2co-client,2csv,2d-array,2d-bounds,2d-context,2d-css-matrix-parse,2d-point,2d-polygon-area,2d-polygon-boolean,2d-polygon-contains-polygon,2d-polygon-self-intersections,2d-quadtree,2d-quadtree-js,2dgeometry,2dmap,2dollars,2dpixels-canvas,2dpixels-terminal,2e,2fa,2gis,2gis-api,2gis-project-loader,2gl,2go,2kenizer,2lemetry,2mao_fristbao,2pi-calc,2pi-paging,2pi-player,2pi-scale,2pl,2pl-party,2r-button,2r-image,2r-stepper,2vdom,2way-router,3-3somepack,3-way-merge,3.14,3000-words-list,31i73-class,34322fsdf4sddddaq1,352-phantom,352-uber,352-wascally,360class.jansenhm,360proxy,360safe,360se,37-pieces-of-flair,39ae-blog,39ae-core,39f-callbacks,39f-meta,39f-socket.io,39f-socket.io-auth,39f-socket.io-auth-local,39f-socket.io-auth-sm-redis,3c,3d-camera-core,3d-extensions,3d-preview,3d-print-price-calculator,3d-view,3d-view-controls,3dBinPack,3dcss,3drotate,3ds,3dstojs,3dsub,3duf,3five-shopify-theme,3kenizer,3loc,3m5-coco,3net.js,3p,3pc,3point,3s,3scale,3scale_senico,3scale-lambda,3scale-senico,3taps,3vot,3vot-clay,3vot-cli,3vot-cloud,3vot-cors,3vot-db,3vot-js-salesforce,3vot-model,3vot-salesforce-proxy,3vot-spine-salesforce,3w,3x3-equation-solver,404-pagelet,404project,40xda,42-cent,42-cent-authorizenet,42-cent-base,42-cent-braintree,42-cent-mock,42-cent-model,42-cent-nmi,42-cent-omise,42-cent-payflow,42-cent-paypal,42-cent-rocketgate,42-cent-stripe,42-cent-util,42-cent-virtualmerchant,42-cent-worldpay,42-cli,42am-team,47pages-keystone,4b82,4chan,4chan-downloader,4chan-js,4chan-optimize,4chanjs,4dlcd,4do,4dstudio-localserver,4each,4fe-reactui,4fe-sass-mixins,4front,4front-apphost,4front-cli,4front-ldap-auth,4front-logger,4front-s3-deployments,4game-server,4m,4meFirst-github-example,4p_template,4pm-cli,4q,4screens-permissions,4search,4shared,4sq,4square-venues,5-best-rappers-of-all-time,500-pagelet,500px,500tech-react-select,51degrees,53cal-jp-scraper,53test_package,58replace,5lack,5rolli-story-client,5rolli-time-summarizer,5rolli-workflowy2trello,5to6,5to6-codemod,6-to-library,600px,60fps-scroll-element,60frames-coding-standards,64bigint,6bin,6brain,6lowpan,6pm,6px,6sense,6to5,6to5-browserify,6to5-brunch,6to5-connect,6to5-core,6to5-jest,6to5-library-boilerplate,6to5-loader,6to5-runtime,6to5ify,6xs,70-480-chapter2-3-05d-math_example,73s,7480_math_example,74js,75.weekly,7daysnode,7digital-api,7digital-cli,7f,7geese,7niu,7pass-node-sdk,7z,7z-stream,7zip,7zjs,8-files,80cents,89hi,8art,8bit,8bits,9292ov,99designs-tasks,99designs-tasks-slack-bot,9e-sass-lint,9gag-scraper,9wmuypsg,a,A,a_bad_module,a_mock,a_prompt,a_r_d_e_i-hello,a_simple_module,a_test,a_watcher,a-big-triangle';

bhttp.get(endpoint + group).then(function(x) {
    setImmediate(function() {
        console.log(x);
    })
});

[indutny]

cc @nodejs/crypto

[ChALkeR]

Ok, I merged all my comments into the original post.

[indutny]

Full debug stack trace:

 * thread #1: tid = 0x0000, 0x0000000100bf96d7 node`node::TLSWrap::IsAlive(this=0x00000001032e1980) + 55 at tls_wrap.cc:521, stop reason = signal SIGSTOP
  * frame #0: 0x0000000100bf96d7 node`node::TLSWrap::IsAlive(this=0x00000001032e1980) + 55 at tls_wrap.cc:521
    frame #1: 0x0000000100bfb1ff node`void node::StreamBase::GetFD<node::TLSWrap>(key=(val_ = 0x00007fff5fbfdcd8), args=0x00007fff5fbfd778) + 95 at stream_base-inl.h:75
    frame #2: 0x0000000100284997 node`v8::internal::PropertyCallbackArguments::Call(this=0x00007fff5fbfd8e0, f=(node`void node::StreamBase::GetFD<node::TLSWrap>(v8::Local<v8::String>, v8::PropertyCallbackInfo<v8::Value> const&) at stream_base-inl.h:72), arg1=(val_ = 0x00007fff5fbfdcd8))(v8::Local<v8::Name>, v8::PropertyCallbackInfo<v8::Value> const&), v8::Local<v8::Name>) + 119 at arguments.cc:86
    frame #3: 0x00000001007c1e8d node`v8::internal::Object::GetPropertyWithAccessor(it=0x00007fff5fbfdb30, language_mode=SLOPPY) + 781 at objects.cc:891
    frame #4: 0x00000001007c11ed node`v8::internal::Object::GetProperty(it=0x00007fff5fbfdb30, language_mode=SLOPPY) + 461 at objects.cc:706
    frame #5: 0x000000010093de7c node`v8::internal::GetOwnProperty(isolate=0x0000000102804a00, obj=Handle<v8::internal::JSObject> @ 0x00007fff5fbfdbb8, name=Handle<v8::internal::Name> @ 0x00007fff5fbfdbb0) + 940 at runtime-object.cc:236
    frame #6: 0x0000000100932524 node`v8::internal::__RT_impl_Runtime_GetOwnProperty(args=Arguments @ 0x00007fff5fbfdc38, isolate=0x0000000102804a00) + 308 at runtime-object.cc:259
    frame #7: 0x00000001009323de node`v8::internal::Runtime_GetOwnProperty(args_length=2, args_object=0x00007fff5fbfdce0, isolate=0x0000000102804a00) + 110 at runtime-object.cc:253
    frame #8: 0x000035155950b61b <internal code>
    frame #11: 0x00003515597d3758 formatProperty(this=0x000012a8a0004189:<undefined>, 0x0000398eec282659:<Object: Object>, 0x0000398eec216f39:<Object: TLSWrap>, <Smi: 0>, 0x0000398eec2e70e1:<Object: Object>, 0x000012a8a00dad89:<String: "fd">, 0x000012a8a0004299:<false>) at util.js:600:24 fn=0x0000301a42685b39
    frame #12: 0x00003515597d361d (anonymous)(this=0x000012a8a0004189:<undefined>, 0x000012a8a00dad89:<String: "fd">) at util.js:495:27 fn=0x0000398eec2e7fc1
    frame #13: 0x000035155950f3fd <adaptor>
    frame #16: 0x000035155950f3fd <adaptor>
    frame #17: 0x00003515597d350c formatObject(this=0x000012a8a0004189:<undefined>, 0x0000398eec282659:<Object: Object>, 0x0000398eec216f39:<Object: TLSWrap>, <Smi: 0>, 0x0000398eec2e70e1:<Object: Object>, 0x0000398eec2e70c1:<Array: length=13>) at util.js:494:22 fn=0x0000301a42685941
    frame #18: 0x00003515597c027e formatValue(this=0x000012a8a0004189:<undefined>, 0x0000398eec282659:<Object: Object>, 0x0000398eec216f39:<Object: TLSWrap>, <Smi: 0>) at util.js:208:21 fn=0x0000301a426857d9
    frame #19: 0x00003515597d3c91 formatProperty(this=0x000012a8a0004189:<undefined>, 0x0000398eec282659:<Object: Object>, 0x0000398eec216171:<Object: TLSSocket>, <Smi: 1>, 0x0000398eec2c63c1:<Object: Object>, 0x0000320dc4da1b29:<String: "ssl">, 0x000012a8a0004299:<false>) at util.js:600:24 fn=0x0000301a42685b39
    frame #20: 0x00003515597d361d (anonymous)(this=0x000012a8a0004189:<undefined>, 0x0000320dc4da1b29:<String: "ssl">) at util.js:495:27 fn=0x0000398eec2c7f91
    frame #21: 0x000035155950f3fd <adaptor>
    frame #24: 0x000035155950f3fd <adaptor>
    frame #25: 0x00003515597d350c formatObject(this=0x000012a8a0004189:<undefined>, 0x0000398eec282659:<Object: Object>, 0x0000398eec216171:<Object: TLSSocket>, <Smi: 1>, 0x0000398eec2c63c1:<Object: Object>, 0x0000398eec2c63a1:<Array: length=43>) at util.js:494:22 fn=0x0000301a42685941
    frame #26: 0x00003515597c027e formatValue(this=0x000012a8a0004189:<undefined>, 0x0000398eec282659:<Object: Object>, 0x0000398eec216171:<Object: TLSSocket>, <Smi: 1>) at util.js:208:21 fn=0x0000301a426857d9
    frame #27: 0x00003515597d3c91 formatProperty(this=0x000012a8a0004189:<undefined>, 0x0000398eec282659:<Object: Object>, 0x0000398eec235741:<Object: IncomingMessage>, <Smi: 2>, 0x0000398eec283391:<Object: Object>, 0x0000320dc4d50ed1:<String: "socket">, 0x000012a8a0004299:<false>) at util.js:600:24 fn=0x0000301a42685b39
    frame #28: 0x00003515597d361d (anonymous)(this=0x000012a8a0004189:<undefined>, 0x0000320dc4d50ed1:<String: "socket">) at util.js:495:27 fn=0x0000398eec2b7899
    frame #29: 0x000035155950f3fd <adaptor>
    frame #32: 0x000035155950f3fd <adaptor>
    frame #33: 0x00003515597d350c formatObject(this=0x000012a8a0004189:<undefined>, 0x0000398eec282659:<Object: Object>, 0x0000398eec235741:<Object: IncomingMessage>, <Smi: 2>, 0x0000398eec283391:<Object: Object>, 0x0000398eec283371:<Array: length=32>) at util.js:494:22 fn=0x0000301a42685941
    frame #34: 0x00003515597c027e formatValue(this=0x000012a8a0004189:<undefined>, 0x0000398eec282659:<Object: Object>, 0x0000398eec235741:<Object: IncomingMessage>, <Smi: 2>) at util.js:208:21 fn=0x0000301a426857d9
    frame #35: 0x00003515596d693f inspect(this=0x000012a8a0004189:<undefined>, 0x0000398eec235741:<Object: IncomingMessage>, 0x000012a8a0004189:<undefined>) at util.js:86:17 fn=0x0000301a426855e1
    frame #36: 0x000035155950f3fd <adaptor>
    frame #37: 0x00003515597bd749 exports.format(this=0x000018658de39851:<Object: Console>, 0x0000398eec235741:<Object: IncomingMessage>) at util.js:12:26 fn=0x000029fc2e2fe9b1
    frame #38: 0x0000351559536203 <internal>
    frame #39: 0x000035155968e6be Console.log(this=0x000018658de39851:<Object: Console>) at console.js:34:33 fn=0x0000320dc4de2e41
    frame #40: 0x000035155950f3fd <adaptor>
    frame #41: 0x00003515595370e4 <internal>
    frame #42: 0x000035155951a922 <entry>
    frame #43: 0x000000010063d83f node`v8::internal::(anonymous namespace)::Invoke(isolate=0x0000000102804a00, is_construct=false, target=Handle<v8::internal::Object> @ 0x00007fff5fbfea40, receiver=Handle<v8::internal::Object> @ 0x00007fff5fbfea38, argc=1, args=0x00007fff5fbfed00, new_target=Handle<v8::internal::Object> @ 0x00007fff5fbfea30) + 607 at execution.cc:98
    frame #44: 0x000000010063d45e node`v8::internal::Execution::Call(isolate=0x0000000102804a00, callable=Handle<v8::internal::Object> @ 0x00007fff5fbfeb98, receiver=Handle<v8::internal::Object> @ 0x00007fff5fbfeb90, argc=1, argv=0x00007fff5fbfed00) + 1294 at execution.cc:167
    frame #45: 0x00000001009163f7 node`v8::internal::__RT_impl_Runtime_Apply(args=Arguments @ 0x00007fff5fbfece8, isolate=0x0000000102804a00) + 1639 at runtime-function.cc:562
    frame #46: 0x0000000100915d7e node`v8::internal::Runtime_Apply(args_length=5, args_object=0x00007fff5fbfee00, isolate=0x0000000102804a00) + 110 at runtime-function.cc:531
    frame #47: 0x000035155950b61b <internal code>
    frame #49: 0x000035155950f3fd <adaptor>
    frame #50: 0x00003515597bd591 (anonymous)(this=0x0000398eec2815b9:<Object: Immediate>) at /Users/findutnyy/Code/indutny/node/1.js:8:26 fn=0x0000398eec2814d9
    frame #51: 0x0000351559750faa processImmediate(this=0x000029fc2e209409:<Object: process>) at timers.js:375:26 fn=0x0000301a426866a1
    frame #52: 0x00003515595370e4 <internal>
    frame #53: 0x000035155951a922 <entry>
    frame #54: 0x000000010063d83f node`v8::internal::(anonymous namespace)::Invoke(isolate=0x0000000102804a00, is_construct=false, target=Handle<v8::internal::Object> @ 0x00007fff5fbff0b0, receiver=Handle<v8::internal::Object> @ 0x00007fff5fbff0a8, argc=0, args=0x0000000000000000, new_target=Handle<v8::internal::Object> @ 0x00007fff5fbff0a0) + 607 at execution.cc:98
    frame #55: 0x000000010063d45e node`v8::internal::Execution::Call(isolate=0x0000000102804a00, callable=Handle<v8::internal::Object> @ 0x00007fff5fbff208, receiver=Handle<v8::internal::Object> @ 0x00007fff5fbff200, argc=0, argv=0x0000000000000000) + 1294 at execution.cc:167
    frame #56: 0x0000000100248928 node`v8::Function::Call(this=0x000000010284ac10, context=(val_ = 0x000000010284ac30), recv=(val_ = 0x00000001038066a0), argc=0, argv=0x0000000000000000) + 472 at api.cc:4401
    frame #57: 0x0000000100248a81 node`v8::Function::Call(this=0x000000010284ac10, recv=(val_ = 0x00000001038066a0), argc=0, argv=0x0000000000000000) + 113 at api.cc:4410
    frame #58: 0x0000000100b679b4 node`node::MakeCallback(env=0x0000000103800000, recv=(val_ = 0x00000001038066a0), callback=(val_ = 0x000000010284ac10), argc=0, argv=0x0000000000000000) + 1300 at node.cc:1182
    frame #59: 0x0000000100b67e9f node`node::MakeCallback(env=0x0000000103800000, recv=(val_ = 0x00000001038066a0), symbol=(val_ = 0x0000000103800c28), argc=0, argv=0x0000000000000000) + 207 at node.cc:1231
    frame #60: 0x0000000100b74c25 node`node::CheckImmediate(handle=0x0000000103800010) + 133 at node.cc:209
    frame #61: 0x0000000100c3bbb9 node`uv__run_check(loop=0x00000001013b4c40) + 361 at loop-watcher.c:67
    frame #62: 0x0000000100c33028 node`uv_run(loop=0x00000001013b4c40, mode=UV_RUN_ONCE) + 216 at core.c:352
    frame #63: 0x0000000100b7357e node`node::StartNodeInstance(arg=0x00007fff5fbff8e0) + 638 at node.cc:4157
    frame #64: 0x0000000100b72ee3 node`node::Start(argc=2, argv=0x0000000102506e50) + 259 at node.cc:4233
    frame #65: 0x0000000100ba9aab node`main(argc=2, argv=0x00007fff5fbff990) + 75 at node_main.cc:45
    frame #66: 0x0000000100001234 node`start + 52

[indutny]

@ChALkeR may I ask you to give a try to this fix?

diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
index a888dc1..c12b2a8 100644
--- a/lib/_tls_wrap.js
+++ b/lib/_tls_wrap.js
@@ -299,6 +299,8 @@ proxiedMethods.forEach(function(name) {
 });

 tls_wrap.TLSWrap.prototype.close = function closeProxy(cb) {
+  if (this.owner)
+    this.owner.ssl = null;
   if (this._parentWrap && this._parentWrap._handle === this._parent) {
     this._parentWrap.once('close', cb);
     return this._parentWrap.destroy();

[ChALkeR]

@indutny Will test that soon, sorry.

[ChALkeR]

@indutny The fix works for me in both the small (published above) and the original testcase, thanks!