René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Crash in cjs_lexer::Parse since v24.14.0: FATAL ERROR: v8::ToLocalChecked Empty MaybeLocal","articleBody":"### Version\n\nv24.14.0\n\n### Platform\n\nWe have only reproduced this on GitHub Actions `ubuntu-latest` runners so far (Linux x64, in CI).\n\n### Subsystem\n\n_No response_\n\n### What steps will reproduce the bug?\n\nWe don't have a deterministic single-file repro: the empty `MaybeLocal` only surfaces under heavy concurrent ESM→CJS preparse, and we couldn't isolate which specific allocation fails. The original environment is a Vite + Ladle dev server pair started by Playwright's `webServer` option, where each child process imports a large dependency graph on cold start.\n\nThe script below is the smallest standalone reproducer we could build that runs `node` only, no third-party deps. It is **probabilistic** — on our machine it aborts within a few thousand iterations, on a faster machine you may need to raise `N_WORKERS` / `N_FILES`. It exercises the same code path (`cjsPreparseModuleExports` → `cjs_lexer.parse`) under similar pressure to the real failure.\n\n````js\n// repro.mjs — run: `node repro.mjs` on Node \u003e= v24.14.0\n// No third-party deps. Aborts probabilistically with the same FATAL.\nimport { Worker, isMainThread, workerData } from 'node:worker_threads';\nimport { mkdtempSync, writeFileSync } from 'node:fs';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\n\nconst N_FILES = 500;\nconst N_WORKERS = 16;\n\nif (isMainThread) {\n  const dir = mkdtempSync(join(tmpdir(), 'cjs-lexer-repro-'));\n  const files = [];\n  for (let i = 0; i \u003c N_FILES; i++) {\n    const p = join(dir, `m${i}.cjs`);\n    // Many exports per file, mixing ASCII and non-ASCII to exercise both\n    // CreateString branches (NewFromOneByte / NewFromUtf8).\n    const body = Array.from({ length: 64 }, (_, k) =\u003e\n      `exports.a${i}_${k} = ${k};\\nexports.u${i}_${k} = 'あ${k}';`,\n    ).join('\\n');\n    writeFileSync(p, body);\n    files.push(pathToFileURL(p).href);\n  }\n  for (let w = 0; w \u003c N_WORKERS; w++) {\n    new Worker(new URL(import.meta.url), { workerData: { files } });\n  }\n} else {\n  await Promise.all(workerData.files.map((f) =\u003e import(f)));\n}\n````\n\nIf a maintainer can point us at a way to force `String::NewFromUtf8(..., kInternalized)` or `Set::Add()` to return empty `MaybeLocal` from user JS (e.g. via prototype accessors, à la #56531), we'd be happy to turn this into a deterministic regression test.\n\n### How often does it reproduce? Is there a required condition?\n\nProbabilistic.\n\n- Real environment (Vite dev server + Ladle dev server started concurrently by Playwright `webServer`): ~1 in 5–10 full `playwright test` runs aborts during cold start.\n- Standalone reproducer above: irregular, requires high `N_WORKERS` × `N_FILES`. May need tuning on faster machines.\n\nRequired conditions seem to be:\n\n- Node `\u003e= v24.14.0` (the version that switched from `cjs-module-lexer` (WASM) to `merve` (native) in #61456 / 68da144). Not reproducible on `v24.13.x`.\n- Multiple processes or worker threads concurrently doing ESM→CJS interop across many CJS files.\n\nPinning to Node `v24.13.1` makes the crash disappear in the real environment.\n\n### What is the expected behavior? Why is that the expected behavior?\n\nIf V8 string creation or `Set::Add` returns an empty `MaybeLocal` (pending exception on the isolate, or allocation failure), `cjs_lexer::Parse` should propagate that as a JavaScript exception instead of aborting the process.\n\n`Parse` is invoked from `cjsPreparseModuleExports` in `lib/internal/modules/esm/translators.js`, which sits on a normal JS frame and can handle a thrown exception — at worst it would surface as a load failure for the affected module, which is recoverable, debuggable, and contained.\n\nThe current behavior — `OnFatalError` aborting the whole process — is too aggressive for this binding: it is on the hot path of every ESM import of a CJS module, and gives user code no recovery path. The previous WASM-based `cjs-module-lexer` did not have an equivalent fatal route here, so this is a regression in observable behavior, not only an implementation detail.\n\n### What do you see instead?\n\nThe process aborts immediately. No JS-level error is thrown, no `uncaughtException` / `unhandledRejection` / `process.on('exit')` handler fires. The child exit is observed only by the parent process (Playwright, in our case).\n\nOutput:\n\n```\nFATAL ERROR: v8::ToLocalChecked Empty MaybeLocal\n----- Native stack trace -----\n\n 1: 0x73f778 node::OnFatalError(char const*, char const*) [node]\n 2: 0xc06584  [node]\n 3: 0x8e7b85 node::cjs_lexer::Parse(v8::FunctionCallbackInfo\u003cv8::Value\u003e const\u0026) [node]\n 4: 0x7fb0abdcf08d\n\n----- JavaScript stack trace -----\n\n1: cjsPreparseModuleExports (node:internal/modules/esm/translators:393:44)\n2: createCJSModuleWrap (node:internal/modules/esm/translators:212:35)\n3: commonjsStrategy (node:internal/modules/esm/translators:349:10)\n4: #translate (node:internal/modules/esm/loader:451:20)\n5: afterLoad (node:internal/modules/esm/loader:507:29)\n6: loadAndTranslate (node:internal/modules/esm/loader:512:12)\n7: #getOrCreateModuleJobAfterResolve (node:internal/modules/esm/loader:555:36)\n8: afterResolve (node:internal/modules/esm/loader:603:52)\n9: getOrCreateModuleJob (node:internal/modules/esm/loader:609:12)\n10: syncLink (node:internal/modules/esm/module_job:162:33)\n```\n\n### Additional information\n\nThe native frame `node::cjs_lexer::Parse` corresponds to [`[src/node_cjs_lexer.cc](https://github.com/nodejs/node/blob/main/src/node_cjs_lexer.cc)`](https://github.com/nodejs/node/blob/main/src/node_cjs_lexer.cc), introduced in #61456 / [[68da144](https://github.com/nodejs/node/commit/68da144b4e)](https://github.com/nodejs/node/commit/68da144b4e) (replaced `cjs-module-lexer` with `merve`). Both `CreateString` and `Parse` contain unguarded `.ToLocalChecked()` calls:\n\n- L34: `String::NewFromOneByte(...).ToLocalChecked()` (in `CreateString`)\n- L41: `String::NewFromUtf8(...).ToLocalChecked()` (in `CreateString`)\n- L73: `exports_set-\u003eAdd(context, CreateString(...)).ToLocalChecked()` (in `Parse`)\n\nAll three return empty `MaybeLocal` whenever the isolate has a pending exception or string/handle allocation fails. The current code unconditionally dereferences via `ToLocalChecked()`, which calls `OnFatalError` and aborts.\n\n#### Suggested fix\n\nHave `CreateString` return `MaybeLocal\u003cString\u003e` and propagate failure from `Parse`. Empty `MaybeLocal` becomes a JS exception (the pending one on the isolate, in most cases) rather than a fatal abort:\n\n````cpp\ntemplate \u003ctypename T\u003e\ninline MaybeLocal\u003cString\u003e CreateString(Isolate* isolate, const T\u0026 str) {\n  std::string_view sv = lexer::get_string_view(str);\n  if (simdutf::validate_ascii(sv.data(), sv.size())) {\n    return String::NewFromOneByte(\n        isolate,\n        reinterpret_cast\u003cconst uint8_t*\u003e(sv.data()),\n        NewStringType::kInternalized,\n        static_cast\u003cint\u003e(sv.size()));\n  }\n  return String::NewFromUtf8(isolate,\n                             sv.data(),\n                             NewStringType::kInternalized,\n                             static_cast\u003cint\u003e(sv.size()));\n}\n\nvoid Parse(const FunctionCallbackInfo\u003cValue\u003e\u0026 args) {\n  // ... (head unchanged) ...\n\n  Local\u003cSet\u003e exports_set = Set::New(isolate);\n  for (const auto\u0026 exp : analysis.exports) {\n    Local\u003cString\u003e exp_str;\n    if (!CreateString(isolate, exp).ToLocal(\u0026exp_str)) return;\n    Local\u003cSet\u003e next_set;\n    if (!exports_set-\u003eAdd(context, exp_str).ToLocal(\u0026next_set)) return;\n    exports_set = next_set;\n  }\n\n  LocalVector\u003cValue\u003e reexports_vec(isolate);\n  reexports_vec.reserve(analysis.re_exports.size());\n  for (const auto\u0026 reexp : analysis.re_exports) {\n    Local\u003cString\u003e reexp_str;\n    if (!CreateString(isolate, reexp).ToLocal(\u0026reexp_str)) return;\n    reexports_vec.push_back(reexp_str);\n  }\n\n  Local\u003cValue\u003e result_elements[] = {\n      exports_set,\n      Array::New(isolate, reexports_vec.data(), reexports_vec.size())};\n  args.GetReturnValue().Set(Array::New(isolate, result_elements, 2));\n}\n````\n\nHappy to send a PR with this change plus a regression test, once we agree on the expected behavior (throw vs. silently return empty results) and a way to deterministically trigger empty `MaybeLocal` from JS for the test.\n\n#### Workaround\n\nPin to Node `v24.13.x` (last release before #61456). This makes the crash disappear in our environment.","author":{"url":"https://github.com/makimaki","@type":"Person","name":"makimaki"},"datePublished":"2026-05-15T05:55:42.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":5},"url":"https://github.com/63323/node/issues/63323"}