"clearImmediate" results in an abort

Version: v14.15.1
Platform: Linux 5.8.0-38-generic The binary and long term compatibility with node #43~20.04.1-Ubuntu SMP Tue Jan 12 16:39:47 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
Subsystem: clearImmediate

What steps will reproduce the bug?

Setup a node instance,

» node

and run the following javascript code.

clearImmediate({hasRef: true, _onImmediate: 100000000000000000})

Then an abort occurs.

How often does it reproduce? Is there a required condition?

This abort can always be triggered following the steps above.

What is the expected behavior?

If any error occurs, an exception or other similar error-reporting stuff should be thrown. There is no reason to abort the whole node process.

What do you see instead?

» node
Welcome to Node.js v14.15.1.
Type ".help" for more information.
> clearImmediate({hasRef: true, _onImmediate: 100000000000000000})
node[65197]: ../src/async_wrap.cc:623:static void node::AsyncWrap::QueueDestroyAsyncId(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `args[0]->IsNumber()' failed.
 1: 0xa03530 node::Abort() [node]
 2: 0xa035ae  [node]
 3: 0x979ceb node::AsyncWrap::QueueDestroyAsyncId(v8::FunctionCallbackInfo<v8::Value> const&) [node]
 4: 0xbe369b  [node]
 5: 0xbe4c46  [node]
 6: 0xbe52c6 v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) [node]
 7: 0x13ff259  [node]
[1]    65197 abort (core dumped)  node

Additional information

It seems to be REPL only, the process doesn't crash when executing a file or using eval.

$ node -e 'clearImmediate({hasRef: true, _onImmediate: 100000000000000000})'
internal/timers.js:278
    item._idleNext._idlePrev = item._idlePrev;
                             ^

TypeError: Cannot set property '_idlePrev' of undefined
    at ImmediateList.remove (internal/timers.js:278:30)
    at clearImmediate (timers.js:324:18)
    at [eval]:1:1
    at Script.runInThisContext (vm.js:133:18)
    at Object.runInThisContext (vm.js:310:38)
    at internal/process/execution.js:77:19
    at [eval]-wrapper:6:22
    at evalScript (internal/process/execution.js:76:60)
    at internal/main/eval_string.js:23:3

I'm able to reproduce the crash on master branch when executing the given instruction on REPL.

timers: fix arbitrary object clearImmediate errors

Navigation Menu

Repository navigation

"clearImmediate" results in an abort #37806

What steps will reproduce the bug?

How often does it reproduce? Is there a required condition?

What is the expected behavior?

What do you see instead?

Additional information

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

"clearImmediate" results in an abort #37806

Description

What steps will reproduce the bug?

How often does it reproduce? Is there a required condition?

What is the expected behavior?

What do you see instead?

Additional information

Activity

aduh95 commented on Mar 19, 2021

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions