Sitelet https://github.com/nodejs/node/issues/43681
Skip to content

await Promise.resolve("import('./mod.mjs')").then(eval) rejects/segfaults in REPL #43681

Closed
Closed
await Promise.resolve("import('./mod.mjs')").then(eval) rejects/segfaults in REPL#43681
Labels
confirmed-bugIssues and PRs for confirmed bugs.replIssues and PRs related to the REPL subsystem.

Description

@nicolo-ribaudo
nicolo-ribaudo
opened on Jul 4, 2022

Version

v18.4.0

Platform

Linux nic-XPS-15-9570 5.15.0-40-generic #43-Ubuntu SMP Wed Jun 15 12:54:21 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

modules

What steps will reproduce the bug?

Have an empty mod.mjs file, and a main.mjs file with the following contents:

console.log(1, await import("./mod.mjs"));
console.log(2, await eval(`import("./mod.mjs")`));
console.log(3, await (0, eval)(`import("./mod.mjs")`));
console.log(4, await Promise.resolve(`import("./mod.mjs")`).then(s => eval(s)));
console.log(5, await Promise.resolve(`import("./mod.mjs")`).then(s => (0,eval)(s)));
console.log(6, await Promise.resolve(`import("./mod.mjs")`).then(eval));

If you run node main.mjs, it works.

However, if you open the REPL and copy-paste-run the first five lines one by one. Now kill the REPL, restart it, and run the sixth line: it throws

Uncaught TypeError: Invalid host defined options
    at eval (eval at processTicksAndRejections (node:internal/process/task_queues:95:5), <anonymous>:1:1)
    at eval (<anonymous>)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async REPL2:1:39

If you don't restart the REPL before running the sixth line, it almost always crashes with a segfault:

[1]    85373 segmentation fault (core dumped)  node

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior?

I assume that the last line should work in the REPL, because it works in a file and because all the other lines work in the REPL.
Even if the error is expected for some reason, it shouldn't segfault.

What do you see instead?

/

Additional information

No response

Activity

  1. nicolo-ribaudo
    changed the title [-]`await Promise.resolve("import('./mod.js')").then(eval)` fails in REPL[/-] [+]`await Promise.resolve("import('./mod.js')").then(eval)` rejects/segfaults in REPL[/+] on Jul 4, 2022
  2. nicolo-ribaudo
    changed the title [-]`await Promise.resolve("import('./mod.js')").then(eval)` rejects/segfaults in REPL[/-] [+]`await Promise.resolve("import('./mod.mjs')").then(eval)` rejects/segfaults in REPL[/+] on Jul 4, 2022
  3. VoltrexKeyva
    added
    replIssues and PRs related to the REPL subsystem.
    on Jul 5, 2022
  4. benjamingr
    added
    confirmed-bugIssues and PRs for confirmed bugs.
    on Jul 5, 2022

  5. benjamingr commented on Jul 5, 2022

    @benjamingr
    benjamingr
    on Jul 5, 2022
    Member

    I can repro this on main, this is a neat find, thanks.

    @nodejs/loaders @nodejs/repl

  6. legendecas commented on Jul 5, 2022

    @legendecas
    legendecas
    on Jul 5, 2022
    Member

    When running the scripts sequentially, the Local<Script> created at https://github.com/nodejs/node/blob/main/src/node_contextify.cc#L947 can outlive the ContextifyScript so https://github.com/nodejs/node/blob/main/src/module_wrap.cc#L594 may crash because the ContextifyScript is released and the access can be invalid.

    When running console.log(6, await Promise.resolve('import("./mod.mjs")').then(eval)); in a fresh REPL, the referrer script unexpectedly becomes the internal/process/task_queues.js instead of the REPL script. This can be problematic as the host_defined_options is not the expected one for the REPL script.

    I'll try to dig into this.

  7. targos commented on Jul 5, 2022

    @targos
    targos
    on Jul 5, 2022
    Member

    @legendecas I'm not sure whether it's related to this crash, but note that we are still using CompileFunctionInContext which is deprecated in V8.

  8. nicolo-ribaudo commented on Jul 5, 2022

    @nicolo-ribaudo
    nicolo-ribaudo
    on Jul 5, 2022
    ContributorAuthor

    When running console.log(6, await Promise.resolve('import("./mod.mjs")').then(eval)); in a fresh REPL, the referrer script unexpectedly becomes the internal/process/task_queues.js instead of the REPL script. This can be problematic as the host_defined_options is not the expected one for the REPL script.

    So, the reason I found this bug is that I was reading https://tc39.es/ecma262/#sec-hostmakejobcallback, which forces non-browser hosts to have a different behavior from browsers. HTML uses that host hook to implement support for Promise.resolve('import(`./example.mjs`)').then(eval) (https://html.spec.whatwg.org/#hostmakejobcallback), so I wanted to test how Node.js behaves.

    So it's possible that the promise rejection (not the crash) is actually expected.

  9. bmeck commented on Jul 5, 2022

    @bmeck
    bmeck
    on Jul 5, 2022 via email
    Member

  10. legendecas commented on Oct 23, 2023

    @legendecas
    legendecas
    on Oct 23, 2023
    Member

    The crash was fixed by #48510. The uncovered issue behind the crash is being tracked at #49726.

  11. legendecas
    closed this as completedon Oct 23, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    confirmed-bugIssues and PRs for confirmed bugs.replIssues and PRs related to the REPL subsystem.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions