VM: report import of a module removed after failed compilation
A module whose compilation fails is removed from the cache, but another
module compiled earlier in the same cycle may still import it. Executing
such an import returned an error without setting an exception, so the
shell reported an unrelated TypeError.
Throw "Cannot load module" instead, and add a shell test for a cyclic
dependency of a module that fails to compile.
VM: preserve dependency code after failed module compilation
Commit fd54d52d freed all bytecode added after the parent module's
compilation checkpoint, including successfully compiled dependencies.
Those dependencies remain cached, so a later import in the same VM
executes freed bytecode. This is reachable in the interactive shell
and in embedders that continue after a compilation error.
The fix is to remove eager bytecode cleanup while retaining removal of
the failed module from the cache so subsequent loads can retry. Keep
the removed module and its name in the VM pool because cyclic
dependencies and code metadata can still reference them. These
allocations are released when the VM is destroyed.
Add a shell regression test that retries a failed parent import and then
executes its cached dependency.
QuickJS exposes child elements as own properties, so a child named
like an XMLNode method hides the method on its prototype. Let methods
take precedence over bare child names, as on the njs engine. Keep the
child accessible through $tag$name and avoid deleting it when deleting
the method name.
Cover collisions for all XMLNode methods and prototype changes.
The existing $attr$name and $tag$name accessors compare local names
only, so x:ID and ID, or x:Issuer and Issuer, are indistinguishable.
The new XMLNode methods getAttributeNS(namespaceURI, localName) and
getChildNS(namespaceURI, localName) match both the namespace URI and
the local name.
Previously, property existence checks such as "'$attr$a' in node",
"'to' in node", or "'$tags$to' in node" created the property value and
never released it when no property descriptor was requested. A leaked
XMLNode also held a reference to its document, so the whole document
was never freed.
Also, qjs_xml_node_make() and qjs_xml_attr_make() incremented the
document reference count before creating the object, so a failed
JS_NewObjectClass() left the document permanently referenced.
The fix is to free the value when no descriptor is requested and to
take the document reference only after the object is created.
Previously, Expect treated timeouts as successful matches, and EOF
passed even if the REPL exited abnormally. Some checks could match
the input echo alone, while completion checks required a bell that
varies between libedit versions.
The fix is to fail on timeouts, premature EOF, and abnormal exit;
check the result and prompt for Unicode input and guard against a
repeated promise rejection. Send Unicode as ASCII escapes to work
around libedit 3.1.snap20150325-2.12 on SLES 15 SP7, which reports
a character count where the readline callback expects a byte count.
QuickJS: stop tracking rejections during final report
Converting the rejection reason to a log string may reject another
promise. Disable the tracker before reporting so new rejections
cannot leave references in the request context after its list has
been drained.
Previously, njs_engine_qjs_unhandled_rejection() kept a pointer to
the rejected promise list while converting the first rejection reason
to a string. The conversion may call user JavaScript code, which can
reject more promises and cause the list to be reallocated. After that,
the old pointer was used together with the new item count to free the
promise and reason values, which caused out-of-bounds reads and invalid
frees.
The fix is to take a reference to the first reason and free the list
before conversion, so that rejections created during conversion are
tracked in a new list.
The test/js/promise_rejection_tracker_recursive.t.js test is no longer
skipped for the QuickJS engine.
Promise: do not track handled rejections with no list
Previously, when a handled promise was reported and the rejected promise
list was NULL, the trackers fell through and added it as unhandled. In
the interactive shell, handling a promise after its rejection had been
reported caused another, false unhandled rejection. The QuickJS nginx
module could do the same while formatting a rejection reason.
The fix is to return for every handled notification, removing the promise
from the list only when the list exists. Apply this to both engines in the
shell and nginx module.
CHB: avoid overflow when enforcing the chain limit
Check the requested size against the remaining chain capacity instead of
adding it to the current total. This prevents the size check from wrapping
and bypassing the configured chain limit.
Buffer: reject oversized QJS alloc() and concat() sizes
Buffer.alloc() and Buffer.concat() converted sizes with JS_ToUint32(),
which wraps values modulo 2^32: Buffer.alloc(2 ** 32 + 16) returned a
16-byte buffer. Use JS_ToIndex() instead, so these sizes throw a
RangeError.
In Buffer.concat(), the total length of the list could also overflow the
32-bit accumulator. Keep it in 64 bits and check it against
QJS_BUFFER_MAX_LENGTH. The overflow now throws a RangeError instead of a
TypeError, as in Node.js.
Convert array-like lengths through checked floating-point conversion before
applying ToLength semantics. This avoids reading float-tagged QuickJS
numbers through the integer accessor.
The length is kept as a 64-bit value and passed to qjs_buffer_alloc()
unchanged, so an oversized length is rejected before any allocation
instead of being truncated.
Buffer: check QJS allocation sizes before narrowing
Take a 64-bit size in qjs_buffer_alloc() and reject sizes above
QJS_BUFFER_MAX_LENGTH before converting them. Previously, a caller
holding a wider size had to narrow it to size_t first, which truncated
it silently on 32-bit platforms.
Accept RangeError from Buffer.concat() revalidation.
Remove oversized Buffer.from() cases that make Node.js allocate 4 GiB.
Expect empty Buffer.fill() values to fail.
Use fs.rm() for recursive removal under Node.js.
Check non-enumerable fs.Stats date properties directly.
Use distinct readlink fixtures for concurrently run test cases.
Known failures for js_test --binary=node are limited to module
resolution in import and XML module tests for v25.2.1 on linux.
Previously, the local JavaScript tests, including WebCrypto tests, were
run by the test262 target, while the official TC39 Test262 suite was
run by njs_test262_test.
The fix is to rename the local test target to js_test and make test262
run the official suite. The engine-specific local targets are renamed
to js_test_njs and js_test_quickjs.
Memory pool: compare block addresses without overflow
Previously, the rbtree comparator converted the difference between two
addresses to intptr_t. On 32-bit systems, addresses that differ by at
least 2 GiB could produce an incorrect ordering and prevent a later block
lookup from finding its cluster.
The fix is to compare the addresses directly and return -1, 0, or 1.
This fixes a pool that remained non-empty after all allocations were freed
in the x86 memory pool test.
Previously, the memory pool was covered only indirectly by a single
flathsh configuration.
The fix is to add direct coverage for allocation, reuse, alignment, and
mixed allocation sizes across valid pool configurations. The test uses a
smaller workload in the regular matrix and a full stress workload in the
ASan job.
Library tests are included in the standard test target. The added ASan
configuration omits debug memory so that the complete test target and the
pool page and cluster paths are exercised. The library-test dependency
rule is also corrected for the new test executable.
Previously, input bytes were promoted to signed int before being shifted
into a hash word. A byte with its high bit set could make the 24-bit
shift undefined.
The fix is to cast input bytes to uint32_t before shifting. This
preserves the hash result and avoids undefined behavior under UBSan.
Previously, fetch cached fixed-length responses with bytes after their
declared body. Bodyless and chunked responses with such bytes did not
complete correctly.
The fix is to close a framed response connection with unconsumed bytes
instead of adding it to the keepalive cache.
TypedArray: coerce length argument once on buffer construction
Previously, njs_typed_array_alloc() passed the length argument through
njs_value_to_index() twice, before and after the detached-buffer check,
and kept only the second result. The argument's valueOf() was invoked
twice, which is observable.
The Date setters always converted their result as local time. Use the
setter's UTC flag instead.
Remove the intermediate range check in njs_make_date(). TimeClip already
checks the result after local-to-UTC conversion, which can move a value
across the valid time range boundary.
Fix the conversion of a property key to an array index
Previously, a double was converted to uint32_t before its range was tested,
so a property key that is NaN, negative or larger than 2^31 made the
conversion undefined. UndefinedBehaviorSanitizer reported it for every VM
creation, where an environment variable name is atomized.
The fix is to test the range first and to share one njs_number_is_atom_index()
helper between the four places that repeated the pattern.
The lambda structure is allocated at the end of module compilation,
and if the allocation fails, lambda is NULL. Since nothing fails after
a successful allocation, lambda is always NULL on the failed path.
Previously, assigning null or undefined to node.$tag$name removed
matching children in QuickJS, while the njs engine rejected every
assignment.
The fix is to distinguish property assignment from deletion in the
QuickJS exotic property handler. Assignments now throw TypeError in both
engines, while delete node.$tag$name remains supported.
Previously, text and structural mutators copied and replaced the receiver's
libxml2 node. Existing XMLNode wrappers continued to point at the detached
original, while subsequent lookups returned the replacement. Wrappers for
children preserved by the operation likewise pointed into the detached old
subtree. In QuickJS, mutating the detached receiver again could dereference
the NULL result of xmlReplaceNode().
The fix is to modify the existing receiver's child list directly. Existing
wrappers and subsequent lookups therefore continue to refer to the same
libxml2 node. Removed child lists remain readable until the QuickJS
document or njs VM is destroyed. A node is considered live only when
following its parent links reaches its xmlDoc. Replacement children and
cleanup records are prepared before the live tree is modified.
Changed behaviour:
- A removed child has an undefined $parent, while its descendants retain
their internal parent links.
- Mutating or canonicalizing a removed XMLNode throws TypeError.
- Text and attribute values must be primitive strings; null and undefined
retain their deletion semantics.
- C14N rejects an excluding node from another document or a detached list.
- addChild() and $tags reject namespace-bearing or unsupported source trees
before mutation.
- Named $tags assignments are consistently rejected by both engines.
While here, use an unsigned QuickJS $tags array length, support assigning
$tags on an empty njs XMLNode, and make deleting $tags from an empty node
a no-op.
Previously, text updates encoded content manually and then passed it to
libxml2. This duplicated libxml2 escaping rules and allocated the
encoded buffer before creating the text node.
The fix is to create a libxml2 text node from the unencoded value before
replacing the copied node's children. libxml2 now owns escaping, and a
failure leaves the original XML tree unchanged.
Value-preservation analysis recursively examines the upcoming expression before
the generator decides whether mutable-slot operands need temporary copies.
Deeply nested binary expressions and arrays could therefore exhaust the native
stack.
Move the generator-specific predicate out of the parser API and limit its
recursive walk to 128 levels. At the limit, conservatively require
preservation: an extra move is safe, whereas missing a deeper side effect can
change evaluation semantics.
Module compilation publishes a provisional module before parsing to support
recursive loading. Remove that module on failure and release code records,
line maps, and code buffers produced after the compilation checkpoint so a
failed load does not poison subsequent lookups.
Allocate non-global scopes, local variables, variable tree nodes, references,
and declaration arrays from the compilation pool. The global scope and its
symbol table remain persistent for runtime lookup and later compilation.
Build closure-index arrays temporarily, then copy the finalized indexes into
VM-owned storage referenced by each lambda. Preserve declaration-origin type
without retaining pointers to released block scopes.
Use the parser invocation pool for generator stack entries, copied contexts,
blocks, jump patches, index caches, and traversal scratch. Nested function
generators share the same temporary pool, while generated code and runtime
metadata remain in the VM pool.
Create a pool for each parser invocation and allocate parser nodes, array-item
storage, continuations, preread tokens, and active labels from it. Destroy the
pool after generation and on parser or generator failures.
Keep atoms, lambdas, regexp patterns, scopes, variables, bytecode, and runtime
constants in the VM pool. Clear persistent scope AST roots before releasing
the temporary pool.
Store the atom identifier and resolved variable directly in parser nodes and
move the undefined-reference flag into the common node flags. This removes the
separately allocated reference object and helps reduce parser nodes to the
64-byte memory-pool class.
The generic object-property lowering used six parser nodes and several
generator continuations for each array element. Store array values and indexes
in compact records and emit a dedicated immediate-index initializer instead.
This also avoids interning numeric element indexes and generates elements in
source order with constant continuation depth. Keep template backing arrays
flat because template concatenation requires contiguous storage.
Large literals switch to slow arrays above the fast-array capacity limit, but
the previous initialization path left their indexed values unset. Initialize
slow arrays directly so literals above 32760 elements preserve their contents.
Add generated workloads for large array literals, declarations, references,
closures, and labels. These tests are intended to expose catastrophic parser
scaling and compare compilation changes; source construction and Function()
compilation are both included in the measured interval.
Fix Array.prototype.sort() with huge sparse arrays
Previously, sort deleted every index from the compacted output position to
the original length. A sparse array with length near 2^32 therefore caused
billions of property-delete operations and unbounded memory growth.
The fix is to retain the direct cleanup loop for fast arrays and, for slow
arrays, enumerate and delete only existing indexed properties in the range.
Previously, njs_value_to_primitive() retained a pointer to the caller's value
slot while valueOf(), toString(), or property getters executed user code.
Reentrant code could overwrite that slot, after which the conversion treated
the replacement primitive as the original object.
The fix is to snapshot the input value before the first observable property
lookup and use the stable copy throughout conversion.
Previously, integer-indexed exotic validation was restricted to keys marked
as strings. Numeric atoms and the canonical string "NaN" could bypass the
check and be installed as ordinary typed-array properties.
The fix is to validate numeric atoms and canonical numeric strings after key
conversion, and to remove the obsolete source-type flag.
The numeric-key bypass was introduced in b28e50b1 (0.9.0); the incomplete
canonical-index handling dates to bf208048 (0.3.8).
Previously, PCRE name-table capture indexes were decoded through plain char.
On signed-char targets, bytes with the high bit set were sign-extended and
produced a wild or incorrect capture index used to read a match array.
The fix is to decode unsigned bytes through a checked output parameter and to
validate every named capture index against the compiled capture count.
Fix Object.defineProperty() with reentrant descriptors
Previously, njs_object_prop_define() retained a pointer to a target hash
property while descriptor getters executed user code. Reentrant mutation of
the target could resize the flat hash and leave the retained pointer dangling.
Descriptor getters were also evaluated again after fast-array conversion.
The fix is to convert the descriptor before querying the target and to place
the retry point after descriptor conversion.
Previously, the fast concat path represented a missing source property with
njs_value_invalid and still created the corresponding destination property.
For a slow sparse destination this materialized an internal hole sentinel as
a normal property, which later property access could interpret as an invalid
accessor.
The fix is to advance the destination index without creating a property when
the source lookup reports a hole.
Previously, Object.values() and Object.entries() erased the concrete type of
an exotic receiver, while indexed property fast paths accepted any object
with the fast_array bit. Typed arrays could consequently be interpreted as
njs_array_t objects, causing invalid memory reads and writes.
The fix is to preserve the receiver type during enumeration and to use
njs_is_fast_array() for both indexed get and set fast paths.
The issue was introduced in 69072164 (0.8.6); the overbroad fast path dates
to 912ab387 (0.3.8).
Previously, RegExp.prototype[Symbol.replace]() and Symbol.split() used
non-NULL exotic slots as proof that an exec() result was an internally
allocated match array. A custom exec() could return any exotic object, which
was then cast to an array and freed, corrupting unrelated VM state.
The fix is to record whether RegExpBuiltinExec produced each result and to
release only fresh builtin results that could not escape through user code.
The replace issue was introduced in f7813172 (0.8.2), and the split issue was
introduced in aa697e3e (0.8.2).
This closes #1090, #1091, #1092, #1093, #1096, and #1097 issues on GitHub.
Dmitry Volyntsev [Thu, 27 Aug 2026 22:32:56 +0000 (15:32 -0700)]
Fix the runtime model in the agent developer guide
The guide claimed that module scope survives between requests on the same
worker and that module imports load once per worker. Both are wrong.
js_import only compiles at configuration time; imported module bodies run
when a context is created.
While there, corrected the integration points:
*) js_periodic receives a periodic session rather than nothing, and lives
in server { } for stream;
*) js_filter is installed in the stream filter chain rather than as a
phase handler, and cannot call s.done() once filtering started;
*) stream js_access and js_preread may leave pending events, while stream
js_set may not;
*) "no async support" means no pending nginx events rather than no async
keyword;
*) HTTP has no js_filter directive, stream js_set receives s, and
ngx.shared is cross-worker rather than process-wide and holds only
strings and numbers.
Generator: select a for-in route by the target's own token type
Previously, njs_generate_for_in_statement() worked out what a for-in header
declared from the shape of the tree: a declaration was recognised as a
STATEMENT wrapper whose right child held the kind, and the kind and the name
were reached through that wrapper. The wrapper was navigated again in the
object and body states, and njs_generate_for_let_update() walked it to find
lexical bindings. Nothing named the contract, and the property route used
the same "foreach->left->right" to mean the property key.
The fix is to let the parser put the declaration node under the "in" node
directly, so the target's token type says what it is: VAR, LET or CONST for a
declaration, PROPERTY or PROPERTY_REF for a member target, and NAME for a
plain one. An unrecognised target is now an internal error instead of
falling into the plain-name route. njs_generate_let_update() takes the
single declaration a for-in header has, and njs_generate_for_let_update()
keeps the list walk the classic "for" needs.
The instruction stream is unchanged. The code map for PROPERTY_NEXT on the
declaration route now carries the line of the declaration instead of the zero
the removed wrapper held; backtraces are unaffected.
Parser: classify a "for" declaration header like an expression one
Previously, njs_parser_for_var_binding_or_var_list() peeked one token past a
declaration binding and, on "in", built the for-in nodes itself, consumed the
tokens and used its own right-hand-side and body states. A declaration
header therefore never reached the classifier the expression header uses, and
the two carried separate copies of the same completion.
The fix is to parse an identifier binding once under [~In] and let
njs_parser_for_var_in_of_expression() classify the token it stopped at. The
"in" case now accepts a declaration result, checks there that a for-in
declaration has one binding and no initializer, and continues through the
same right-hand-side, body and NJS_TOKEN_FOR_IN construction as an
expression target. njs_parser_for_var_in_statement() and its completion go
with the duplication, and the restricted-identifier check is left to the
ordinary declaration parser, which reports it identically.
A binding pattern still leaves this route before the classifier, into the
handlers that report it as unsupported.
The tree shape is unchanged, so the generator still selects a for-in route
the way it did, and the emitted code is identical. The declaration node now
takes its source line from the ordinary declaration parser, so a header split
across lines reports the line of "in" rather than of the binding; this shows
only in the AST dump, not in generated code or backtraces.
Previously, the declaration route of a for-in loop stored the resolved
variable index in the AST wrapper njs_parser_node_t, and read it back one
generator state later. The other two routes keep the same value in
ctx->index_next_value, a field njs_generator_loop_ctx_t already has for it.
The inconsistency was the only difference between
njs_generate_for_in_body_wo_decl() and njs_generate_for_in_body(): the rest
was duplicated verbatim, including a guard that is dead in the copy.
The fix is to use the context on the declaration route as well and delete the
duplicate. One AST field is no longer written by the generator, and one of
the three shape-selected for-in paths is gone. The emitted code is unchanged.
Parser: carry the declaration kind across nested parsing
Previously, the kind of a declaration being parsed lived in a mutable
parser->var_type, written once when "var", "let" or "const" was seen and read
for every declarator in the list. A declaration nested in a declarator
initializer overwrote it, so the declarators after it were recorded with the
wrong kind and lexical ones lost their per-iteration binding:
let out = [];
for (let a = function() { var z; }, b = 0; b < 2; b++) out.push(() => b);
out[0]() + ',' + out[1]()
gave "2,2" instead of "0,1", because "b" was recorded as a var.
The fix is to carry the kind in njs_parser_stack_entry_t, as the [In]
parameter already is, so a continuation restores the kind in effect when it
was pushed. njs_parser_stack_entry_t does not grow.
Parser: remove the dead cover parenthesized production
Previously, njs_parser_cover_parenthesized_expression(), its two
continuations and njs_parser_binding_identifier_pattern() formed a closed
island: every reference to them came from inside it, and the only thing
linking it to the parser was a "(void)" cast left with a TODO in 2020. It
honours neither contract this series introduces. Two of its states are
reject landing states that never inspected parser->ret, so with a ")" or a
"," in hand they would consume the token and pop the stack after a reject.
Its parenthesized expression opens no [+In] region.
The fix is to delete the island rather than repair it. Arrow parameters are
not going to be completed through this production, and the binding pattern
entry points it dispatched to are stubs reachable on their own.
Previously, use_lhs told njs_parser_exponentiation_expression() to skip the
unary part and njs_parser_assignment_expression() to skip the arrow check, so
that an expression could resume from an already parsed left-hand side.
The fix is to remove it: its only writer went with the speculative "for"
initializer parse.
Previously, the initializer was parsed twice: speculatively as a
LeftHandSideExpression so that the token after it could be inspected, and
then the rest of the expression was grafted onto that left-hand side by four
continuation states. A dispatch list and an arrow pre-check existed only to
keep inputs away from the speculative parse.
The fix is to let [~In] end the initializer: the "in" operator is no longer
part of the expression, so the header is a single <Expression> and
njs_parser_for_var_in_of_expression(), which already classified the other
routes, classifies this one too. Its post-hoc for-in detection goes with it.
A declaration header stopping at "in" now reports an invalid target instead
of an unexpected token:
for (var a, b in []);
The first token's text was carried through the header only to be quoted in
the removed diagnostic, so the allocation goes with it.
Parser: report an invalid "for-in" target as a SyntaxError
Previously, an invalid for-in target was a ReferenceError when the
initializer happened to parse as a LeftHandSideExpression and a SyntaxError
otherwise, so the same target changed class once parenthesized:
for (a = 1 in {}); SyntaxError
for ((a = 1) in {}); ReferenceError
The fix is to report a SyntaxError for both, as the specification and V8 do.
The type is observable through Function(), so this is a compatibility change.
njs keeps ReferenceError for invalid assignment targets elsewhere.
Previously, the [In] parameter lived in the lexer, in a byte array indexed by
bracket nesting depth. The lexer advanced the depth while prereading, the
parser wrote at the depth it had consumed to, so a delimiter in a conditional
consequent left the write in the wrong slot and the restriction was lost:
for (a ? (b) : c in d; false;);
The fix is to carry the parameter in njs_parser_stack_entry_t: a frame
records the value in effect when it was pushed and restores it when popped,
including on the njs_parser_reject() landing frame. An arrow initializer now
gets [~In] as well, which it escaped before.
This also allows to remove the [In] support from the lexer. The parser
owns the parameter now. njs_lexer_t drops from 104 to 80 bytes and no longer
allocates.
Parser: fix "for" initializer parsing after a failed speculative parse
Previously, the "for" initializer was parsed speculatively as a
LeftHandSideExpression, and njs_parser_for_expression_map_reparse() resumed
parsing whenever that parse produced no node. njs_parser_reject() rewinds
the state stack only, so the resume continued from a later token with an
abandoned function scope still on parser->scope, and generated bytecode with
a scope that is never instantiated at run time.
The fix is to remove that landing state together with its frame, so a
rejected speculative parse reports a SyntaxError, and to dispatch the
initializer starts that cannot begin a LeftHandSideExpression to <Expression>
directly. Routing "await" through that dispatch also applies [~In] to it, so
a bare "in" in an await initializer is now a SyntaxError.
Memory pool: allocate the block descriptor separately with the sanitizer
Previously, njs_mp_alloc_large() embedded the block descriptor at the end of
the allocation for sizes which are not a power of two, so a read past the end
of an object stayed inside the malloc()ed region and was not detected by the
address sanitizer.
The fix is to always allocate the descriptor separately when the address
sanitizer is enabled.
RegExp: fix Symbol.replace() with an inconsistent match object
Previously, the matched string returned by exec() was assumed to be a
substring of the subject at the reported index.
njs_string_get_substitution() converted "index + matched length" to a byte
offset without a bounds check, and the replace loop advanced the end of the
last match by the byte size of the matched string instead of its character
length. As a result the $' expansion read outside the subject, and on a
multibyte subject the result could start in the middle of a UTF-8 sequence.
The fix is to pass the head and tail slices of the subject to
njs_string_get_substitution() and to track the end of the last match as a
character index. The function no longer converts indexes to offsets, so the
out of range conversion is prevented by construction.
This is an extended fix for #1116 pull request on Github.
Reported by Basavaraj S m (basavaraj@digiscrypt.com).
Dmitry Volyntsev [Wed, 19 Aug 2026 19:50:59 +0000 (12:50 -0700)]
Fetch: fix empty response status text handling
A status line with an empty reason phrase terminated by a bare LF left
the status text start unset. The resulting invalid string slice crashed
the worker when JavaScript read Response.statusText.
Initialize both ends of an empty status text before returning from the
parser. This also avoids subtracting NULL pointers for status lines
without a reason phrase.
Dmitry Volyntsev [Thu, 13 Aug 2026 03:58:26 +0000 (20:58 -0700)]
XML: fix off-by-one in namespace prefix list parsing
njs_xml_parse_ns_list() allocated exactly size pointers, but the
terminating NULL was stored at the index equal to the number of parsed
tokens. When the token count matched the current capacity, the
terminator was written one pointer past the allocation.
The growing loop is replaced with a single allocation holding the array
of pointers followed by the writable copy of the list, the number of
tokens is counted beforehand.
The list is split on any XML whitespace character, empty tokens are not
produced.
Also, fixed potential in place modification of QuickJS string value.
Reported by Vladimir Vulnerability Research Tech Lead @ Cyera, evilgensec
Dmitry Volyntsev [Tue, 11 Aug 2026 01:14:38 +0000 (18:14 -0700)]
HTTP: fail closed on js_access body completion errors
Previously, an exception in an asynchronous readRequest*()
continuation could leave the js_access decision unset, allowing nginx
to continue processing the request as though the access check had
succeeded. An unhandled rejection could also be missed by the body-read
completion path or hidden by a pending internal redirect.
Now body-read completion errors set the access status to 500, and
access finalization checks execution errors before an uncommitted
access decision or internal redirect. Responses already sent by the
handler remain terminal.
Dmitry Volyntsev [Mon, 17 Aug 2026 16:33:34 +0000 (09:33 -0700)]
CI: bump the pinned quickjs-ng version
A static library has to be asked for explicitly since 0.16.0, otherwise
the library is installed as a shared object outside of the loader search
path, the configure test binary fails to start and the library is
reported as not working.
Dmitry Volyntsev [Mon, 17 Aug 2026 16:33:34 +0000 (09:33 -0700)]
QuickJS: fix empty stack in errors created by the host
An error created outside of a JS frame, from a fetch() completion
callback for instance, records an empty stack. Up to QuickJS-NG 0.15.1
deleting the recorded "stack" property let the engine attach a real one
where the error was thrown. Since 0.16.0 the stack is kept in the error
internal data behind an accessor, the property to delete no longer
exists and the empty stack became final.
JS_NewError() is JS_NewObjectClass() plus the stack recording, and the
first half alone is reachable through the public API. Creating the
object that way records nothing, so the engine attaches the stack at the
throw site. This works the same way for every supported engine, hence
the feature test is gone.
Dmitry Volyntsev [Mon, 17 Aug 2026 16:33:34 +0000 (09:33 -0700)]
QuickJS: fix compatibility with quickjs-ng 0.16.0 and later
Two separate problems prevented njs from working with the recent
quickjs-ng releases.
JS_NewArrayBuffer() has grown a "max_len" argument and its free callback
has become a realloc one. The calls are wrapped now, the callback has
to implement the whole realloc contract, because transfer() reallocates
the data even for a buffer which is not resizable.
The class ids used by njs started at 64, while the engine reserves the
ids below JS_CLASS_INIT_COUNT, which has reached 67. JS_NewClass()
failed with a collision and the context could not be created. The ids
are moved above the engine range and the remaining unchecked
JS_NewClass() calls now report the failure.
Dmitry Volyntsev [Fri, 14 Aug 2026 04:22:40 +0000 (21:22 -0700)]
Modules: make context clone setup transactional
A request can fail after a VM has been cloned, for example while
creating its request wrapper or installing the nginx pool cleanup.
The failed VM was neither destroyed nor returned to the reuse queue,
and a partially evaluated module could leave timers armed against it.
A second initialization attempt could then access rejection state from
the destroyed VM.
Keep each clone private until setup succeeds. On failure, cancel its
events, detach request state, and destroy the VM and engine pool for
both engines. Also clean up partially initialized QuickJS contexts and
wrapper objects.
Dmitry Volyntsev [Fri, 14 Aug 2026 03:50:52 +0000 (20:50 -0700)]
QuickJS: discard contexts with pending jobs
A job exception stops the teardown drain immediately. Jobs left behind
could then run after the context was bound to another request. Releasing
events and root values after the drain could also enqueue new jobs with
the same result.
Treat a successful, complete job drain as a precondition for context
reuse. Destroy the runtime when the drain fails or the queue becomes
nonempty during the remaining teardown.
projects / njs.git / log