FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

src: rethrow stack overflow exceptions in async_hooks · nodejs/node@0578e3e · GitHub

/ node Public

Commit 0578e3e

Browse files
mcollina
authored and
RafaelGSS
committed
src: rethrow stack overflow exceptions in async_hooks
When a stack overflow exception occurs during async_hooks callbacks (which use TryCatchScope::kFatal), detect the specific "Maximum call stack size exceeded" RangeError and re-throw it instead of immediately calling FatalException. This allows user code to catch the exception with try-catch blocks instead of requiring uncaughtException handlers. The implementation adds IsStackOverflowError() helper to detect stack overflow RangeErrors and re-throws them in TryCatchScope destructor instead of calling FatalException. This fixes the issue where async_hooks would cause stack overflow exceptions to exit with code 7 (kExceptionInFatalExceptionHandler) instead of being catchable. Fixes: #37989 Ref: https://hackerone.com/reports/3456295 PR-URL: nodejs-private/node-private#773 Refs: https://hackerone.com/reports/3456295 Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> CVE-ID: CVE-2025-59466
1 parent 26be208 commit 0578e3e

10 files changed

Lines changed: 306 additions & 14 deletions

‎src/async_wrap.cc‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,8 @@ static const char* const provider_names[] = {
6868
void AsyncWrap::DestroyAsyncIdsCallback(Environment* env) {
6969
Local<Function> fn = env->async_hooks_destroy_function();
7070

71-
TryCatchScope try_catch(env, TryCatchScope::CatchMode::kFatal);
71+
TryCatchScope try_catch(env,
72+
TryCatchScope::CatchMode::kFatalRethrowStackOverflow);
7273

7374
do {
7475
std::vector<double> destroy_async_id_list;
@@ -97,7 +98,8 @@ void Emit(Environment* env, double async_id, AsyncHooks::Fields type,
9798

9899
HandleScope handle_scope(env->isolate());
99100
Local<Value> async_id_value = Number::New(env->isolate(), async_id);
100-
TryCatchScope try_catch(env, TryCatchScope::CatchMode::kFatal);
101+
TryCatchScope try_catch(env,
102+
TryCatchScope::CatchMode::kFatalRethrowStackOverflow);
101103
USE(fn->Call(env->context(), Undefined(env->isolate()), 1, &async_id_value));
102104
}
103105

@@ -646,7 +648,8 @@ void AsyncWrap::EmitAsyncInit(Environment* env,
646648
object,
647649
};
648650

649-
TryCatchScope try_catch(env, TryCatchScope::CatchMode::kFatal);
651+
TryCatchScope try_catch(env,
652+
TryCatchScope::CatchMode::kFatalRethrowStackOverflow);
650653
USE(init_fn->Call(env->context(), object, arraysize(argv), argv));
651654
}
652655

‎src/debug_utils.cc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -333,7 +333,8 @@ void DumpJavaScriptBacktrace(FILE* fp) {
333333
}
334334

335335
Local<StackTrace> stack;
336-
if (!GetCurrentStackTrace(isolate).ToLocal(&stack)) {
336+
if (!GetCurrentStackTrace(isolate).ToLocal(&stack) ||
337+
stack->GetFrameCount() == 0) {
337338
return;
338339
}
339340

‎src/node_errors.cc‎

Lines changed: 63 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@ static std::string GetErrorSource(Isolate* isolate,
194194
}
195195

196196
static std::atomic<bool> is_in_oom{false};
197-
static std::atomic<bool> is_retrieving_js_stacktrace{false};
197+
static thread_local std::atomic<bool> is_retrieving_js_stacktrace{false};
198198
MaybeLocal<StackTrace> GetCurrentStackTrace(Isolate* isolate, int frame_count) {
199199
if (isolate == nullptr) {
200200
return MaybeLocal<StackTrace>();
@@ -222,9 +222,6 @@ MaybeLocal<StackTrace> GetCurrentStackTrace(Isolate* isolate, int frame_count) {
222222
StackTrace::CurrentStackTrace(isolate, frame_count, options);
223223

224224
is_retrieving_js_stacktrace.store(false);
225-
if (stack->GetFrameCount() == 0) {
226-
return MaybeLocal<StackTrace>();
227-
}
228225

229226
return scope.Escape(stack);
230227
}
@@ -299,7 +296,8 @@ void PrintStackTrace(Isolate* isolate,
299296

300297
void PrintCurrentStackTrace(Isolate* isolate, StackTracePrefix prefix) {
301298
Local<StackTrace> stack;
302-
if (GetCurrentStackTrace(isolate).ToLocal(&stack)) {
299+
if (GetCurrentStackTrace(isolate).ToLocal(&stack) &&
300+
stack->GetFrameCount() > 0) {
303301
PrintStackTrace(isolate, stack, prefix);
304302
}
305303
}
@@ -671,13 +669,52 @@ v8::ModifyCodeGenerationFromStringsResult ModifyCodeGenerationFromStrings(
671669
};
672670
}
673671

672+
// Check if an exception is a stack overflow error (RangeError with
673+
// "Maximum call stack size exceeded" message). This is used to handle
674+
// stack overflow specially in TryCatchScope - instead of immediately
675+
// exiting, we can use the red zone to re-throw to user code.
676+
static bool IsStackOverflowError(Isolate* isolate, Local<Value> exception) {
677+
if (!exception->IsNativeError()) return false;
678+
679+
Local<Object> err_obj = exception.As<Object>();
680+
Local<String> constructor_name = err_obj->GetConstructorName();
681+
682+
// Must be a RangeError
683+
Utf8Value name(isolate, constructor_name);
684+
if (name.ToStringView() != "RangeError") return false;
685+
686+
// Check for the specific stack overflow message
687+
Local<Context> context = isolate->GetCurrentContext();
688+
Local<Value> message_val;
689+
if (!err_obj->Get(context, String::NewFromUtf8Literal(isolate, "message"))
690+
.ToLocal(&message_val)) {
691+
return false;
692+
}
693+
694+
if (!message_val->IsString()) return false;
695+
696+
Utf8Value message(isolate, message_val.As<String>());
697+
return message.ToStringView() == "Maximum call stack size exceeded";
698+
}
699+
674700
namespace errors {
675701

676702
TryCatchScope::~TryCatchScope() {
677-
if (HasCaught() && !HasTerminated() && mode_ == CatchMode::kFatal) {
703+
if (HasCaught() && !HasTerminated() && mode_ != CatchMode::kNormal) {
678704
HandleScope scope(env_->isolate());
679705
Local<v8::Value> exception = Exception();
680706
Local<v8::Message> message = Message();
707+
708+
// Special handling for stack overflow errors in async_hooks: instead of
709+
// immediately exiting, re-throw the exception. This allows the exception
710+
// to propagate to user code's try-catch blocks.
711+
if (mode_ == CatchMode::kFatalRethrowStackOverflow &&
712+
IsStackOverflowError(env_->isolate(), exception)) {
713+
ReThrow();
714+
Reset();
715+
return;
716+
}
717+
681718
EnhanceFatalException enhance = CanContinue() ?
682719
EnhanceFatalException::kEnhance : EnhanceFatalException::kDontEnhance;
683720
if (message.IsEmpty())
@@ -1277,8 +1314,26 @@ void TriggerUncaughtException(Isolate* isolate,
12771314
if (env->can_call_into_js()) {
12781315
// We do not expect the global uncaught exception itself to throw any more
12791316
// exceptions. If it does, exit the current Node.js instance.
1280-
errors::TryCatchScope try_catch(env,
1281-
errors::TryCatchScope::CatchMode::kFatal);
1317+
// Special case: if the original error was a stack overflow and calling
1318+
// _fatalException causes another stack overflow, rethrow it to allow
1319+
// user code's try-catch blocks to potentially catch it.
1320+
auto is_stack_overflow = [&] {
1321+
return IsStackOverflowError(env->isolate(), error);
1322+
};
1323+
// Without a JS stack, rethrowing may or may not do anything.
1324+
// TODO(addaleax): In V8, expose a way to check whether there is a JS stack
1325+
// or TryCatch that would capture the rethrown exception.
1326+
auto has_js_stack = [&] {
1327+
HandleScope handle_scope(env->isolate());
1328+
Local<StackTrace> stack;
1329+
return GetCurrentStackTrace(env->isolate(), 1).ToLocal(&stack) &&
1330+
stack->GetFrameCount() > 0;
1331+
};
1332+
errors::TryCatchScope::CatchMode mode =
1333+
is_stack_overflow() && has_js_stack()
1334+
? errors::TryCatchScope::CatchMode::kFatalRethrowStackOverflow
1335+
: errors::TryCatchScope::CatchMode::kFatal;
1336+
errors::TryCatchScope try_catch(env, mode);
12821337
// Explicitly disable verbose exception reporting -
12831338
// if process._fatalException() throws an error, we don't want it to
12841339
// trigger the per-isolate message listener which will call this

‎src/node_errors.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,7 @@ namespace errors {
328328

329329
class TryCatchScope : public v8::TryCatch {
330330
public:
331-
enum class CatchMode { kNormal, kFatal };
331+
enum class CatchMode { kNormal, kFatal, kFatalRethrowStackOverflow };
332332

333333
explicit TryCatchScope(Environment* env, CatchMode mode = CatchMode::kNormal)
334334
: v8::TryCatch(env->isolate()), env_(env), mode_(mode) {}

‎src/node_report.cc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -474,7 +474,8 @@ static void PrintJavaScriptStack(JSONWriter* writer,
474474
std::string_view trigger) {
475475
HandleScope scope(isolate);
476476
Local<v8::StackTrace> stack;
477-
if (!GetCurrentStackTrace(isolate, MAX_FRAME_COUNT).ToLocal(&stack)) {
477+
if (!GetCurrentStackTrace(isolate, MAX_FRAME_COUNT).ToLocal(&stack) ||
478+
stack->GetFrameCount() == 0) {
478479
PrintEmptyJavaScriptStack(writer);
479480
return;
480481
}

‎test/parallel/test-async-hooks-stack-overflow-nested-async.js‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
'use strict';
2+
3+
// This test verifies that stack overflow during deeply nested async operations
4+
// with async_hooks enabled can be caught by try-catch. This simulates real-world
5+
// scenarios like processing deeply nested JSON structures where each level
6+
// creates async operations (e.g., database calls, API requests).
7+
8+
require('../common');
9+
const assert = require('assert');
10+
const { spawnSync } = require('child_process');
11+
12+
if (process.argv[2] === 'child') {
13+
const { createHook } = require('async_hooks');
14+
15+
// Enable async_hooks with all callbacks (simulates APM tools)
16+
createHook({
17+
init() {},
18+
before() {},
19+
after() {},
20+
destroy() {},
21+
promiseResolve() {},
22+
}).enable();
23+
24+
// Simulate an async operation (like a database call or API request)
25+
async function fetchThing(id) {
26+
return { id, data: `data-${id}` };
27+
}
28+
29+
// Recursively process deeply nested data structure
30+
// This will cause stack overflow when the nesting is deep enough
31+
function processData(data, depth = 0) {
32+
if (Array.isArray(data)) {
33+
for (const item of data) {
34+
// Create a promise to trigger async_hooks init callback
35+
fetchThing(depth);
36+
processData(item, depth + 1);
37+
}
38+
}
39+
}
40+
41+
// Create deeply nested array structure iteratively (to avoid stack overflow
42+
// during creation)
43+
function createNestedArray(depth) {
44+
let result = 'leaf';
45+
for (let i = 0; i < depth; i++) {
46+
result = [result];
47+
}
48+
return result;
49+
}
50+
51+
// Create a very deep nesting that will cause stack overflow during processing
52+
const deeplyNested = createNestedArray(50000);
53+
54+
try {
55+
processData(deeplyNested);
56+
// Should not complete successfully - the nesting is too deep
57+
console.log('UNEXPECTED: Processing completed without error');
58+
process.exit(1);
59+
} catch (err) {
60+
assert.strictEqual(err.name, 'RangeError');
61+
assert.match(err.message, /Maximum call stack size exceeded/);
62+
console.log('SUCCESS: try-catch caught the stack overflow in nested async');
63+
process.exit(0);
64+
}
65+
} else {
66+
// Parent process - spawn the child and check exit code
67+
const result = spawnSync(
68+
process.execPath,
69+
[__filename, 'child'],
70+
{ encoding: 'utf8', timeout: 30000 }
71+
);
72+
73+
// Should exit successfully (try-catch worked)
74+
assert.strictEqual(result.status, 0,
75+
`Expected exit code 0, got ${result.status}.\n` +
76+
`stdout: ${result.stdout}\n` +
77+
`stderr: ${result.stderr}`);
78+
// Verify the error was handled by try-catch
79+
assert.match(result.stdout, /SUCCESS: try-catch caught the stack overflow/);
80+
}

‎test/parallel/test-async-hooks-stack-overflow-try-catch.js‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
'use strict';
2+
3+
// This test verifies that when a stack overflow occurs with async_hooks
4+
// enabled, the exception can be caught by try-catch blocks in user code.
5+
6+
require('../common');
7+
const assert = require('assert');
8+
const { spawnSync } = require('child_process');
9+
10+
if (process.argv[2] === 'child') {
11+
const { createHook } = require('async_hooks');
12+
13+
createHook({ init() {} }).enable();
14+
15+
function recursive(depth = 0) {
16+
// Create a promise to trigger async_hooks init callback
17+
new Promise(() => {});
18+
return recursive(depth + 1);
19+
}
20+
21+
try {
22+
recursive();
23+
// Should not reach here
24+
process.exit(1);
25+
} catch (err) {
26+
assert.strictEqual(err.name, 'RangeError');
27+
assert.match(err.message, /Maximum call stack size exceeded/);
28+
console.log('SUCCESS: try-catch caught the stack overflow');
29+
process.exit(0);
30+
}
31+
32+
// Should not reach here
33+
process.exit(2);
34+
} else {
35+
// Parent process - spawn the child and check exit code
36+
const result = spawnSync(
37+
process.execPath,
38+
[__filename, 'child'],
39+
{ encoding: 'utf8', timeout: 30000 }
40+
);
41+
42+
assert.strictEqual(result.status, 0,
43+
`Expected exit code 0 (try-catch worked), got ${result.status}.\n` +
44+
`stdout: ${result.stdout}\n` +
45+
`stderr: ${result.stderr}`);
46+
assert.match(result.stdout, /SUCCESS: try-catch caught the stack overflow/);
47+
}

‎test/parallel/test-async-hooks-stack-overflow.js‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
'use strict';
2+
3+
// This test verifies that when a stack overflow occurs with async_hooks
4+
// enabled, the uncaughtException handler is still called instead of the
5+
// process crashing with exit code 7.
6+
7+
const common = require('../common');
8+
const assert = require('assert');
9+
const { spawnSync } = require('child_process');
10+
11+
if (process.argv[2] === 'child') {
12+
const { createHook } = require('async_hooks');
13+
14+
let handlerCalled = false;
15+
16+
function recursive() {
17+
// Create a promise to trigger async_hooks init callback
18+
new Promise(() => {});
19+
return recursive();
20+
}
21+
22+
createHook({ init() {} }).enable();
23+
24+
process.on('uncaughtException', common.mustCall((err) => {
25+
assert.strictEqual(err.name, 'RangeError');
26+
assert.match(err.message, /Maximum call stack size exceeded/);
27+
// Ensure handler is only called once
28+
assert.strictEqual(handlerCalled, false);
29+
handlerCalled = true;
30+
}));
31+
32+
setImmediate(recursive);
33+
} else {
34+
// Parent process - spawn the child and check exit code
35+
const result = spawnSync(
36+
process.execPath,
37+
[__filename, 'child'],
38+
{ encoding: 'utf8', timeout: 30000 }
39+
);
40+
41+
// Should exit with code 0 (handler was called and handled the exception)
42+
// Previously would exit with code 7 (kExceptionInFatalExceptionHandler)
43+
assert.strictEqual(result.status, 0,
44+
`Expected exit code 0, got ${result.status}.\n` +
45+
`stdout: ${result.stdout}\n` +
46+
`stderr: ${result.stderr}`);
47+
}

‎test/parallel/test-uncaught-exception-handler-stack-overflow-on-stack-overflow.js‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
'use strict';
2+
3+
// This test verifies that when the uncaughtException handler itself causes
4+
// a stack overflow, the process exits with a non-zero exit code.
5+
// This is important to ensure we don't silently swallow errors.
6+
7+
require('../common');
8+
const assert = require('assert');
9+
const { spawnSync } = require('child_process');
10+
11+
if (process.argv[2] === 'child') {
12+
function f() { f(); }
13+
process.on('uncaughtException', f);
14+
f();
15+
} else {
16+
// Parent process - spawn the child and check exit code
17+
const result = spawnSync(
18+
process.execPath,
19+
[__filename, 'child'],
20+
{ encoding: 'utf8', timeout: 30000 }
21+
);
22+
23+
// Should exit with non-zero exit code since the uncaughtException handler
24+
// itself caused a stack overflow.
25+
assert.notStrictEqual(result.status, 0,
26+
`Expected non-zero exit code, got ${result.status}.\n` +
27+
`stdout: ${result.stdout}\n` +
28+
`stderr: ${result.stderr}`);
29+
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL