javascript - v8 JavaScript 函数执行在 Runtime_TryInstallOptimizedCode 中挂起

Question

将嵌入式 V8 库从 3.28.4 升级到 6.1.534.47(与当前的 node.js 8.9.1 相同)后，我注意到一个奇怪的问题。我有一些代码将事件分派(dispatch)给 JavaScript 代码(基本上归结为调用 v8::Function::Call() )。这运行了数千次，但最终 v8::Function::Call()不归，卡在v8::internal::Runtime_TryInstallOptimizedCode() .

这是堆栈跟踪:

frame #0: 0x0000000104f43cfc libv8.dylib`v8::internal::Runtime_TryInstallOptimizedCode(int, v8::internal::Object**, v8::internal::Isolate*) [inlined] v8::internal::__RT_impl_Runtime_TryInstallOptimizedCode(v8::internal::Arguments, v8::internal::Isolate*) at runtime-compiler.cc:374 [opt]
frame #1: 0x0000000104f43cd5 libv8.dylib`v8::internal::Runtime_TryInstallOptimizedCode(args_length=1, args_object=0x0000700001d1a0f0, isolate=0x000000010182d200) at runtime-compiler.cc:371 [opt]
frame #2: 0x000028715ea040bd
frame #3: 0x000028715ea15b12
frame #4: 0x000028715ea12cf0
frame #5: 0x000028715eadea2d
frame #6: 0x0000000104cb5ba3 libv8.dylib`v8::internal::(anonymous namespace)::Invoke(isolate=0x000000010182d2c8, is_construct=<unavailable>, target=<unavailable>, receiver=<unavailable>, argc=1, args=0x0000700001d1ad10, new_target=<unavailable>, message_handling=<unavailable>) at execution.cc:145 [opt]
frame #7: 0x0000000104cb58cc libv8.dylib`v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) [inlined] v8::internal::(anonymous namespace)::CallInternal(message_handling=kReport) at execution.cc:181 [opt]
frame #8: 0x0000000104cb585d libv8.dylib`v8::internal::Execution::Call(isolate=0x000000010182d200, callable=Handle<v8::internal::Object> @ r12, receiver=<unavailable>, argc=1, argv=0x0000700001d1ad10) at execution.cc:191 [opt]
frame #9: 0x0000000104984d80 libv8.dylib`v8::Function::Call(this=0x000000010281fa50, context=<unavailable>, recv=<unavailable>, argc=1, argv=0x0000700001d1ad10) at api.cc:5343 [opt]
frame #10: 0x0000000104849c01 libPocoJSCored.1.dylib`Poco::JS::Core::JSExecutor::callInContext(this=0x0000000102029a00, jsObject=0x0000000100e64458, method="valueChanged", argc=1, argv=0x0000700

在带有 Clang/Apple LLVM 9.0 的 macOS 10.12 和带有 GCC 7.2 的 Ubuntu 17.10 上观察到了这一点。

有什么想法吗？

Answer 1

这里是 V8 开发人员。请在 bugs.chromium.org/p/v8 上提交错误.

你在用线程做一些有趣的事情吗？

您有可以分享的复制品吗？

如果使用 --trace-opt 运行，挂起前的最后几行输出是什么？

你能在 Debug模式下编译并在调试器中运行以查看它到底卡在哪里吗？ (一个明显的猜测是等待 OptimizingCompileDispatcher::InstallOptimizedFunctions() 中的 output_queue_mutex_，但我不明白该互斥体上的死锁是如何发生的，所以在咆哮之前错误的树，最好确定问题到底是什么。)