Skip to content

Fixes segfault from #1661 - #1675

Merged
saghul merged 1 commit into
quickjs-ng:masterfrom
sr5434:reject_handler_segfault
Aug 21, 2026
Merged

saghul merged 1 commit into
quickjs-ng:masterfrom
sr5434:reject_handler_segfault

Conversation

@sr5434

@sr5434 sr5434 commented Aug 18, 2026 •

Copy link
Copy Markdown
Contributor

Fixes #1661 by configuring reject functions to take an argument. This way, instead of reading stale data at argv[0], it will read undefined when no parameters are passed. Both the js_async_dispose_rethrow and js_async_dispose_step paths were patched, but I still need to test js_async_dispose_rethrow, so I’m leaving this as a draft until I or someone else figures out how to trigger that issue.

@sr5434
sr5434 force-pushed the reject_handler_segfault branch from 274ab9b to 11af626 Compare August 20, 2026 16:56
@sr5434
sr5434 force-pushed the reject_handler_segfault branch from a87c5c2 to c65872e Compare August 20, 2026 17:05
@sr5434

sr5434 commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

Thanks, @mschwarzl, for helping me reproduce the second path. This PR should be ready now.

@sr5434
sr5434 marked this pull request as ready for review August 20, 2026 17:06
@saghul
saghul merged commit 05b2db9 into quickjs-ng:master Aug 21, 2026
240 of 241 checks passed
@sr5434
sr5434 deleted the reject_handler_segfault branch August 21, 2026 12:07
social4hyq pushed a commit to social4hyq/homebrew-core that referenced this pull request Sep 20, 2026
quickjs-ng 0.17.0

Created-by: HarmonybrewBot
Commit-by: HarmonybrewBot
Merged-by: HarmonybrewBot
Description: Created by `brew bump`

---

Created with `brew bump-formula-pr`.<details>
  <summary>release notes</summary>
  <pre>## What's Changed
* update projects.md to include scriptc project reference (from the Ver… by @lukasMega in quickjs-ng/quickjs#1677
* Fixes segfault from #1661 by @sr5434 in quickjs-ng/quickjs#1675
* docs: add Qbs to projects by @ABBAPOH in quickjs-ng/quickjs#1685
* Add Big Endian architecture support instructions by @saghul in quickjs-ng/quickjs#1681
* Conditional BUILD_DIR by @kapouer in quickjs-ng/quickjs#1686
* Fix String.prototype.normalize() crash from #1683 by @sr5434 in quickjs-ng/quickjs#1688
* Fix reference count bug in Promise.withResolvers by @bnoordhuis in quickjs-ng/quickjs#1692
* Enable test262 host-gc-required feature by @bnoordhuis in quickjs-ng/quickjs#1696
* docs: add Vayu to projects by @athrvk in quickjs-ng/quickjs#1702
* Use mirror for Alpine GHA by @bnoordhuis in quickjs-ng/quickjs#1705
* Fix Iterator.from GetIteratorDirect handling by @jiang1997 in quickjs-ng/quickjs#1706
* Link against libm unconditionally on Unices by @bnoordhuis in quickjs-ng/quickjs#1699
* Fix out-of-bound read in JS_NewTypedArray by @bnoordhuis in quickjs-ng/quickjs#1704
* Preserve old interrupt handler in std.evalScript by @bnoordhuis in quickjs-ng/quickjs#1707
* fix: correct int/int32_t pointer mismatches for -Wincompatible-pointer-types by @SomSamantray in quickjs-ng/quickjs#1657
* Fix JS_FreeCStringUTF16 on slice strings by @bnoordhuis in quickjs-ng/quickjs#1709
* Add react-native-quickjs project to documentation by @saghul in quickjs-ng/quickjs#1710
* Move JSClass out of quickjs.h by @bnoordhuis in quickjs-ng/quickjs#1713
* Optimize JS_DeleteGlobalVar by @bnoordhuis in quickjs-ng/quickjs#1714
* Throw error when converting BigIntArray to Int8Array (#1690) by @sr5434 in quickjs-ng/quickjs#1694
* Fix power-of-two integer hash collisions by @bnoordhuis in quickjs-ng/quickjs#1720
* Store constant atoms more compactly in wire format by @bnoordhuis in quickjs-ng/quickjs#1719
* Prevent Object.preventExtensions when a TypedArray has a resizable ArrayBuffer by @sr5434 in quickjs-ng/quickjs#1695
* Make DOMException a bit more conformant by @goffrie in quickjs-ng/quickjs#1721
* Fix TypedArray.prototype.at() to handle resized ArrayBuffer correctly by @sr5434 in quickjs-ng/quickjs#1718
* Fix JS_SetMemoryLimit byte accounting on WASI by @josefguenther in quickjs-ng/quickjs#1711
* Fix(wasi): enable configurable stack overflow protection by @aayush-kapoor in quickjs-ng/quickjs#1700
* Use a bigger initial atom hash table by @bnoordhuis in quickjs-ng/quickjs#1723
* Add private symbols by @bnoordhuis in quickjs-ng/quickjs#1725
* Peephole-optimize negation + conditional jump by @bnoordhuis in quickjs-ng/quickjs#1726
* Check for property deletion when accessing in `with` by @sr5434 in quickjs-ng/quickjs#1722

## New Contributors
* @lukasMega made their first contribution in quickjs-ng/quickjs#1677
* @kapouer made their first contribution in quickjs-ng/quickjs#1686
* @athrvk made their first contribution in quickjs-ng/quickjs#1702
* @SomSamantray made their first contribution in quickjs-ng/quickjs#1657
* @goffrie made their first contribution in quickjs-ng/quickjs#1721
* @josefguenther made their first contribution in quickjs-ng/quickjs#1711
* @aayush-kapoor made their first contribution in quickjs-ng/quickjs#1700

**Full Changelog**: https://github.com/quickjs-ng/quickjs/compare/v0.16.2...v0.17.0</pre>
  <p>View the full release notes at <a href="https://github.com/quickjs-ng/quickjs/releases/tag/v0.17.0">https://github.com/quickjs-ng/quickjs/releases/tag/v0.17.0</a>.</p>
</details>
<hr>

See merge request: Harmonybrew/homebrew-core!20596
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

AsyncDisposableStack: zero-argument reject handler causes heap use-after-free

2 participants