René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"`process.report.getReport()` crashes the process on Windows while one Worker exchanges messages and another Worker is idle","articleBody":"## Versions\n\n- Crashes: Node 26.13.0, 26.12.1, 24.22.1 and 24.14.0 on Windows 11, x64, on two machines.\n- Clean: Node 26.13.0 on Ubuntu 24.04.5 (GitHub's `ubuntu-24.04` runner, x64, glibc 2.39), 100 runs of 100.\n\n## Machines\n\n| Machine                      | OS                                   | Node                   |\n| ---------------------------- | ------------------------------------ | ---------------------- |\n| Intel Core i5-12500H         | Windows 11 Home 10.0.26200           | 24.22.1, 26.12.1, 26.13.0 |\n| AMD Ryzen 7 9800X3D          | Windows 11 Pro Education 10.0.26200  | 24.14.0                |\n| GitHub runner, AMD EPYC 7763, 2 cores | Ubuntu 24.04.5 LTS, kernel 7.0.0-1017-azure | 26.13.0     |\n\n## Reproducer\n\nOne file, no dependencies. The main thread starts two Workers from `data:` URLs: one answers each message with one of its own after making some garbage, and is sent a message every 16 ms; the other does nothing. Once the busy Worker has answered five times, the main thread calls `process.report.getReport()` ten times, 50 ms apart, then ends both Workers. Run without arguments it runs that in 20 child processes and tallies their exit codes; `--without-reports` waits the same time but takes no report; `--one-worker` leaves the idle Worker out.\n\n```js\n// Node's diagnostic report, taken on the main thread while one Worker answers a message every 16 ms and a second Worker\n// sits idle, crashes the process on Windows. `node report-crash.mjs [runs]` runs that in child processes, 20 unless\n// given, and tallies their exit codes; `--without-reports` waits the same time but takes no report; `--one-worker`\n// leaves the idle Worker out.\nimport { spawnSync } from \"node:child_process\";\nimport { fileURLToPath } from \"node:url\";\nimport { Worker } from \"node:worker_threads\";\n\nconst busyCode = `\n  import { parentPort } from \"node:worker_threads\";\n  parentPort.on(\"message\", (step) => {\n    const garbage = Array.from({ length: 2000 }, (_, index) => ({ index, text: \"step \" + step }));\n    parentPort.postMessage({ step, made: garbage.length });\n  });\n`;\nconst idleCode = `\n  import { parentPort } from \"node:worker_threads\";\n  parentPort.on(\"message\", () => process.exit(0));\n`;\nconst dataUrl = (code) => new URL(`data:text/javascript,${encodeURIComponent(code)}`);\nconst flags = process.argv.slice(2);\nconst isReporting = !flags.includes(\"--without-reports\");\nconst hasIdle = !flags.includes(\"--one-worker\");\n\nasync function runOnce() {\n  const idle = hasIdle ? new Worker(dataUrl(idleCode)) : undefined;\n  if (idle) await new Promise((resolve) => idle.once(\"online\", resolve));\n  const busy = new Worker(dataUrl(busyCode));\n  let answers = 0;\n  busy.on(\"message\", () => { answers += 1; });\n  await new Promise((resolve) => busy.once(\"online\", resolve));\n  let next = 0;\n  const stepping = setInterval(() => busy.postMessage((next += 1)), 16);\n  while (answers \u003c 5) await new Promise((resolve) => setTimeout(resolve, 5));\n  for (let index = 0; index \u003c 10; index += 1) {\n    if (isReporting) process.report.getReport();\n    else await new Promise((resolve) => setTimeout(resolve, 30));\n    await new Promise((resolve) => setTimeout(resolve, 50));\n  }\n  clearInterval(stepping);\n  await busy.terminate();\n  if (idle) { idle.postMessage(\"end\"); await new Promise((resolve) => idle.once(\"exit\", resolve)); }\n}\n\nif (flags.includes(\"--run\")) {\n  await runOnce();\n} else {\n  const meanings = { 0: \"clean\", 3221226356: \"heap corruption (0xC0000374)\", 3221225477: \"access violation (0xC0000005)\", 3221226505: \"fast fail (0xC0000409)\" };\n  const runs = Number(flags.find((flag) => /^\\d+$/.test(flag))) || 20;\n  const passed = flags.filter((flag) => flag.startsWith(\"--\"));\n  const tally = new Map();\n  for (let index = 0; index \u003c runs; index += 1) {\n    const run = spawnSync(process.execPath, [fileURLToPath(import.meta.url), \"--run\", ...passed], { stdio: [\"ignore\", \"ignore\", \"inherit\"] });\n    const meaning = meanings[run.status] ?? `exit ${run.status ?? run.signal}`;\n    tally.set(meaning, (tally.get(meaning) ?? 0) + 1);\n  }\n  console.log(`Node ${process.version} on ${process.platform}, ${runs} runs${passed.length ? \" \" + passed.join(\" \") : \"\"}:`);\n  for (const [meaning, count] of tally) console.log(`  ${count} ${meaning}`);\n}\n```\n\nExpected: 20 clean exits. On Windows, about half the runs end in a heap corruption (exit code 0xC0000374), a fast fail (0xC0000409, as Node's own `abort()` gives on Windows) or, now and then, an access violation (0xC0000005); with the larger reproducer below, a few runs in 100 end with exit code 1 instead because `getReport()` is handed a report that is not JSON, its strings holding bytes from elsewhere:\n\n```\nSyntaxError: Bad control character in string literal in JSON at position 31547 (line 1176 column 16)\n    at parse (\u003canonymous>)\n    at Object.getReport (node:internal/process/report:64:12)\n```\n\nwhere line 1176 of the report text, an environment variable's name in `environmentVariables`, read as an environment variable's name with stray bytes in it.\n\nWith `--without-reports` every run is clean, so the Workers alone do not crash; with `--one-worker` every run is clean, so a report taken with one busy Worker and no other does not crash either. A child process with pipes held by the main thread, in place of the idle Worker, does not crash either (20 of 20 clean); the second Worker is what matters, busy or idle.\n\n## Counts\n\n**The smaller reproducer above**, on the i5-12500H, Node 26.13.0:\n\n| Runs | Clean | Heap corruption | Fast fail |\n| --- | ---: | ---: | ---: |\n| 100, with reports | 50 | 15 | 35 |\n| 20, `--without-reports` | 20 | 0 | 0 |\n| 20, `--one-worker` | 20 | 0 | 0 |\n\nNo run of these 100 gave a report that was not JSON; the larger reproducer below did, 1 to 4 times in 100.\n\n**The larger reproducer**, a script in our repository: the same busy Worker, started from a file, and esbuild's synchronous API called once first, whose service on Windows is a second, idle Worker holding the esbuild child process; the ten reports taken 50 ms apart. 100 runs a row.\n\n| Machine | Node    | Clean | Heap corruption | Access violation | Fast fail | Report not JSON |\n| ------- | ------- | ----: | --------------: | ---------------: | --------: | --------------: |\n| i5-12500H | 24.22.1 |    39 |              20 |                0 |        40 |               1 |\n| i5-12500H | 26.12.1 |    21 |              49 |                2 |        24 |               4 |\n| i5-12500H | 26.13.0 |    48 |              15 |                0 |        34 |               3 |\n| 9800X3D | 24.14.0 |     4 of 20 |     1 of 20 |          0 of 20 |  15 of 20 |               0 |\n| Linux   | 26.13.0 |   100 |               0 |                0 |         0 |               0 |\n\nOn Linux the script's five cases, the Worker from a file, with its globals deleted, with its old generation held to 256 MiB, from a `data:` URL, and the repository's own sandbox Worker, were 20 of 20 clean each, and 20 runs without reports were clean. On the 9800X3D on 24.14.0, 100 runs without reports were clean, and the five cases crashed 11 to 16 of 20 each, so none of the Worker's own differences is the cause.\n\n## The dump\n\nA dump of the larger reproducer's crash, taken on Node 24.14.0 under `cdb -o` with Node's symbols (`node_4b10_2026-10-23_01-04-20-062_29cc.dmp`, 23 Oct 2026), shows the heap found corrupt as `node::report::WriteNodeReport`'s callback (`src/node_report.cc:236`), run through `Environment::RunAndClearInterrupts`, frees a `std::ostringstream`'s buffer. That is the path by which the main thread's report asks each Worker, by an interrupt, for the Worker's own section of the report. The dump can be supplied.\n\n## What we know of the conditions\n\n- Two Workers are needed, one of them exchanging messages while the reports are taken; the other may be idle.\n- The reports must be taken; the same Workers for the same time without a report never crash.\n- It is Windows' alone in our runs: 100 of 100 clean on Linux with the same script and Node.\n- Node 24.14.0, 24.22.1, 26.12.1 and 26.13.0 all crash; nodejs/node#65778, fixed in 24.22.1 and 26.10.0, is another path (a Worker's teardown), and this crash outlived it.","author":{"url":"https://github.com/aliash01","@type":"Person","name":"aliash01"},"datePublished":"2026-10-30T06:59:19Z","url":"https://github.com/nodejs/node/issues/67133"}