Internal node assertion caused by js copy mechanism

[artur-ma]

Version

22.9.0

Platform

image node:22.9.0-bullseye-slim

Subsystem

No response

What steps will reproduce the bug?

Run in node cli:

const undici = require('undici')
const { default: fastCopy } = require('fast-copy')
const a = new undici.Agent()
a.request({ method: 'GET', origin: 'https://google.com', path: '/' }).then(r => r.body.text())
fastCopy(a)

How often does it reproduce? Is there a required condition?

everytime

What is the expected behavior? Why is that the expected behavior?

Have meaningful protection and error message on JS level

What do you see instead?

Process crash

│  node[80]: static void node::TCPWrap::New(const v8::FunctionCallbackInfo<v8::Value>&) at ../src/tcp_wrap.cc:155  
│   #  Assertion failed: args[0]->IsInt32()                                                                                                                                                                                                   
│                                                                                                                                                                                                                                             │
│ ----- Native stack trace -----                                                                                                                                                                                                                                                                                                                                                                                                                                                       
│  1: 0xf462ec node::Assert(node::AssertionInfo const&) [node]                                                                                                                                                                                
│  2: 0x1088d7c node::TCPWrap::New(v8::FunctionCallbackInfo<v8::Value> const&) [node]                                                                                                                                                         
│  3: 0x1239b24  [node]                                                                                                                                                                                                                       
│  4: 0x1239dcc v8::internal::Builtin_HandleApiConstruct(int, unsigned long*, v8::internal::Isolate*) [node]                                                                                                                                  
│  5: 0x1cfb8f4  [node]                                                                                                                                                                                                                                                                                                                                                                                                                                                                 │
│ ----- JavaScript stack trace -----                                                                                                                                                                                                                                                                                                                                                                                                                                                  
│ 1: getCleanClone (/home/app/node_modules/fast-copy/dist/cjs/index.cjs:52:20)                                                                                                                                                                
│ 2: copyObjectLooseModern (/home/app/node_modules/fast-copy/dist/cjs/index.cjs:214:17)                                                                                                                                                       
│ 3: copier (/home/app/node_modules/fast-copy/dist/cjs/index.cjs:371:20)                                                                                                                                                                      
│ 4: copyObjectLooseModern (/home/app/node_modules/fast-copy/dist/cjs/index.cjs:226:35)                                                                                                                                                       
│ 5: copier (/home/app/node_modules/fast-copy/dist/cjs/index.cjs:371:20)                                                                                                                                                                      
│ 6: copyObjectLooseModern (/home/app/node_modules/fast-copy/dist/cjs/index.cjs:226:35)                                                                                                                                                       
│ 7: copier (/home/app/node_modules/fast-copy/dist/cjs/index.cjs:371:20)                                                                                                                                                                      
│ 8: copyArrayLoose (/home/app/node_modules/fast-copy/dist/cjs/index.cjs:147:30)                                                                                                                                                              
│ 9: copier (/home/app/node_modules/fast-copy/dist/cjs/index.cjs:367:20)                                                                                                                                                                      
│ 10: copyObjectLooseModern (/home/app/node_modules/fast-copy/dist/cjs/index.cjs:226:35)     

Additional information

Using pure js library, without native code manipulation causes internal nodejs error and process crash

here is the library
https://github.com/planttheidea/fast-copy

[avivkeller]

Can you reproduce without the use of this external library? If not, can you report the issue to them and find a minimal reproduction

Can you reproduce without Undici?

[avivkeller]

CC @nodejs/undici

[artur-ma]

@redyetidev The issues is here because pure js code can cause total process crash, the library is using different techniques to copy objects, but it should not cause process crash if they are not touching internal code (C++), and they are not using process.binding

[artur-ma]

This issue reported multiple times, but there was always an assumption that some dependency is manipulating internals

#46093
#18389

Which is not true, this bug can occure even without touching internals

[avivkeller]

I can't reproduce the issue at all...:

const undici = require('undici')
const { default: fastCopy } = require('fast-copy')
const a = new undici.Agent()
a.request({ method: 'GET', origin: 'https://google.com', path: '/' }).then(r => r.body.text())
fastCopy(a)

[avivkeller]

Because this can't be reproduced, and there's no minimal reproduction, I've closed it. I'll reopen if you give more info.

[artur-ma]

@redyetidev wdym cant be reproduced? I gave exact reproduction steps..

undici is part of nodejs project, the fast-copy is copying the object

[avivkeller]

I can't reproduce with the steps you gave. Try reporting the issue to Undici, they may be able to help better.

Undici has some CPP bindings, so it might be an Undici issue?

[artur-ma]

@redyetidev

const net = require('net')


const socket = net.Socket()
socket.connect('google.com', 443)

for (const s of Object.getOwnPropertySymbols(socket)) {
  if (socket[s]?.constructor) {
    socket[s]?.constructor()
  }
}

Here, no dependencies...

[avivkeller]

I'm able to reproduce now, thank you :-):

Repro A

const net = require('net')

const socket = net.Socket();
socket.connect('google.com', 443);
const kHandle = Object.getOwnPropertySymbols(socket).find((s) => s.description === 'kHandle');
new socket[kHandle].constructor();

  #  node[90025]: static void node::PipeWrap::New(const FunctionCallbackInfo<Value> &) at ../src/pipe_wrap.cc:123
  #  Assertion failed: args[0]->IsInt32()

Repro B

const net = require('net')

const socket = net.Socket();
socket.connect('google.com', 443);
const kHandle = Object.getOwnPropertySymbols(socket).find((s) => s.description === 'kHandle');
socket[kHandle].constructor();

#  node[90067]: static void node::PipeWrap::New(const FunctionCallbackInfo<Value> &) at ../src/pipe_wrap.cc:122
#  Assertion failed: args.IsConstructCall()