[robobun]

Throwing or rejecting a deeply nested non-Error value (a 50k-deep array, Proxy chain, or error.cause chain) SIGSEGVs the process instead of printing the error and exiting 1. The same values SIGSEGV bun test when the diff or snapshot formatter renders them.

Repro

let a = [];
for (let i = 0; i < 50000; i++) a = [a];
throw a;   // or Promise.reject(a); or expect(a).toEqual(1) / toMatchSnapshot() in a test

[
  [
    [
...
Segmentation fault (exit 139)

3/3 on 1.4.0 and ASAN main. Node prints a truncated [ [ [ [Array] ] ] ] and exits 1.

Cause

• console_object::Formatter::new() left stack_check at StackCheck::default(), whose cached_stack_end is 0 so is_safe_to_recurse() always returns true. format2 / Bun.inspect overwrote it with StackCheck::init(), but ~40 other callers (including VirtualMachine::print_exception) did not, so the print_as_prelude guard never fired for them and print_array (no max_depth clamp) recursed until the native stack overflowed.
• print_as_prelude also returned early at !can_circ before the stack check, so Tag::Proxy (not in can_have_circular_references()) bypassed the guard even where stack_check was seated.
• test_runner::pretty_format::Formatter (the toEqual diff and toMatchSnapshot serializer) is a separate struct with no stack guard at all.

Fix

• console_object::Formatter::new() seats stack_check = StackCheck::init() itself (one cached thread-local read; on an unconfigured thread it yields 0, same as the old default). The per-call-site re-seats in ConsoleObject.rs, JSValue::to_fmt, and Formatter::format_value are removed. StackCheck::update and the Default impl (the unbounded value this bug came from) have no users left and are removed.

• print_as_prelude checks is_safe_to_recurse() before the !can_circ early-return so every recursive tag is covered.

• pretty_format::Formatter gains stack_check (seated in new()) and a guard at the top of print_as that sets failed (unwinding the walk) and hit_stack_limit. JestPrettyFormat::format then consults a new FormatOptions::can_throw_stack_overflow once the walk has unwound:

  • diff output (toEqual failures) leaves it off, so a truncated diff is still printed;
  • snapshot serialization (toMatchSnapshot, toMatchInlineSnapshot) turns it on, so a value too deep to serialize fails the test instead of a truncated serialization being written to the .snap / test file and compared on later runs.

  The throw is deferred to the end of format rather than raised where the limit is hit because JSC__JSValue__forEachPropertyOrdered drops an exception thrown from its callback when further properties follow; a leaf-level throw only reached the matcher for arrays and single-key objects (verified: with the leaf-level version, a two-key object still wrote a truncated snapshot).

• The asymmetric-matcher bridge (amf_print_as, used when a diff renders expect.objectContaining(...) and friends) took a &mut dyn Write and wrapped it in two adapters per nesting level, so a write issued N matchers deep passed through 2N adapter frames below the stack check and a ~5k-deep objectContaining chain still overflowed on release. It is now generic over the writer and calls format directly; the FormatTag mapping it shared with the write_format bridge becomes a From impl.

• The uncaught-exception printer keeps can_throw_stack_overflow off: it truncates and exits 1.

Since #37334 the snapshot matchers rethrow the formatter's own error, so the failure surfaces as RangeError: Maximum call stack size exceeded. This PR does not touch expect.rs.

Verification

test/js/bun/util/reportError.test.ts: throw / Promise.reject of a 150k-deep array, a 150k-deep Proxy chain, and a 10k-deep error.cause chain each exit 1 with no signal (depths are sized so an unfixed printer also overflows the 18 MB main-thread stacks of the macOS and Windows builds, not only Linux's 8 MB) (stderr is not piped: the console formatter writes ~K^2 bytes of indentation before the guard fires on release builds).

test/js/node/util/bun-inspect.test.ts: Bun.inspect of a 100k-deep React element chain throws RangeError in-process instead of crashing (the throwing branch of the print_as_prelude reorder; elements, like Proxies, are not tracked for circular references).

test/js/bun/test/pretty-format-overflow.test.ts: failing toEqual on a 100k-deep array / two-key object / React element chain, and against a 50k-deep expect.objectContaining chain, still prints a diff and 1 fail; toMatchSnapshot and toMatchInlineSnapshot on the 100k-deep two-key object fail and write nothing (pretty_format caps indentation at 32 levels, so its piped output is ~3 MB on release). A 256-deep object is asserted to still serialize in full, as a floor on where the guard may fire (measured at ~500 object levels on a debug+ASAN build and ~10x that on release, before main raised the ASAN stack reserve from 128 KB to 512 KB and moved to LLVM 23).

With src/ at the merge-base the 11 new overflow cases fail (plus, on a debug+ASAN build of current main, the pre-existing 500-deep toEqual case in the same file, which this change also covers) (SIGSEGV, or the child dies before printing) and with the fix all 32 tests in the three files pass, including the snapshot path under BUN_JSC_validateExceptionChecks=1. Re-verified locally after each rebase onto main, up to 5a24ce6. The current head (6773705) additionally merges main, including its StackCheck threshold change and the LLVM 23 / Rust nightly upgrade. The merge left this PR's hunks intact and the net diff unchanged. On that head, CI build 116586 ran all three files on the x64-asan lane (shards 14, 7, 9) with the new toolchain: 8/8, 6/6 and 18/18 pass, which includes the 256-deep floor case. That lane is an optimized ASAN build. A debug+ASAN build (bun bd), where frames are largest and where the ~500-level figure above was taken, has not been re-measured on the new toolchain. At the old per-level cost the larger reserve still leaves about 475 levels against the 256 floor. Earlier, the second rebase resolved conflicts with #37334 and the DiffFormatter::new refactor by taking main's expect.rs / diff_format.rs and re-adding the one FormatOptions field. bun-inspect.test.ts, inspect.test.js, console/, snapshot-tests/, jest-each / describe (exercise format_value), and expect.test.js pass unchanged.

Related open PRs

• test_runner: add StackCheck to pretty_format to stop SIGSEGV on deeply nested diff/snapshot values #34885 (closed into this one): its pretty_format guard and test matrix are folded in here.
• console: guard JSX/Proxy recursion in Bun.inspect (stack overflow SIGSEGV) #29709 guards the same JSX/Proxy recursion with a local check; the print_as_prelude reorder here covers it, and the two touch the same hunk.
• error printer: print the AggregateError header, label [cause]/[errors] blocks, and guard the .errors walk #36602 seats stack_check locally in print_exception; redundant once Formatter::new() seats it.
• console: apply depth cap to Map/Set/Array entries and Error cause chains #35288 adds a depth cap on entries and cause chains; independent of the stack guard, but adjacent in ConsoleObject.rs.
• expect: drop the exception when a value throws while a failure message is formatted #39565 changes how the C++ property walk handles an exception thrown while a failure message is formatted (the behaviour the deferred throw here sidesteps) and touches diff_format.rs, where this PR adds one field.
• bun:test: throw the formatter's own error from snapshot matchers instead of "Failed to pretty format value: " #37334 (merged) made the snapshot matchers rethrow the formatter's error; the tests here accept that message (and the older wrapper text).

---

[human-review] gate passed · iteration 4 · 10 files touched

fails on main (without fix)

ASAN without fix: 12 FAILED
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/pr_gate.xml" test/js/bun/test/pretty-format-overflow.test.ts test/js/bun/util/reportError.test.ts test/js/node/util/bun-inspect.test.ts
bun test v1.4.3 (f42e98025)

test/js/bun/test/pretty-format-overflow.test.ts:
43 |     });
44 | 
45 |     const [stderr, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
46 | 
47 |     // The test should fail due to assertion mismatch, but should NOT crash
48 |     expect(exitCode).toBe(1);
                          ^
error: expect(received).toBe(expected)

Expected: 1
Received: 139

      at <anonymous> (/workspace/bun/test/js/bun/test/pretty-format-overflow.test.ts:48:22)
(fail) pretty_format should handle deeply nested objects without crashing > deeply nested object with many properties [7187.27ms]
106 |   }
107 | 
108 |   for (const [name, build] of Object.entries(shapes)) {
109 |     test(`failing toEqual on a deep ${name} still prints a diff`, async () => {
110 |       const { stderr, exitCode } = await runDeepTest(`${build}\nexpect(v).toEqual(1);`);
111 |       expect(stderr).toContain("expec
... (truncated)

release without fix: 11 FAILED
bun test v1.4.3-canary.1 (f42e98025)

test/js/bun/test/pretty-format-overflow.test.ts:
(pass) pretty_format should handle deeply nested objects without crashing > deeply nested object with many properties [41.75ms]
(pass) pretty_format and the native stack limit > a 256-deep object is still serialized in full [7.04ms]
106 |   }
107 | 
108 |   for (const [name, build] of Object.entries(shapes)) {
109 |     test(`failing toEqual on a deep ${name} still prints a diff`, async () => {
110 |       const { stderr, exitCode } = await runDeepTest(`${build}\nexpect(v).toEqual(1);`);
111 |       expect(stderr).toContain("expect(received).toEqual(expected)");
                           ^
error: expect(received).toContain(expected)

Expected to contain: "expect(received).toEqual(expected)"
Received: "\ndeep.test.ts:\n"

      at <anonymous> (/workspace/bun/test/js/bun/test/pretty-format-overflow.test.ts:111:22)
(fail) pretty_format and the native stack limit > failing toEqual on a deep object still prints a diff [132.61ms]
106 |   }
107 | 
108 |   for (const [name, build] of Object.entries(shapes)) {
109 |     test(`failing toEqual on a deep ${name} still prints a diff`, async (
... (truncated)

passes on PR (with fix)

ASAN with fix: all passed
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/pr_gate.xml" test/js/bun/test/pretty-format-overflow.test.ts test/js/bun/util/reportError.test.ts test/js/node/util/bun-inspect.test.ts
bun test v1.4.3 (f42e98025)

test/js/bun/test/pretty-format-overflow.test.ts:
(pass) pretty_format should handle deeply nested objects without crashing > deeply nested object with many properties [7794.26ms]
(pass) pretty_format and the native stack limit > failing toEqual on a deep array still prints a diff [616.23ms]
(pass) pretty_format and the native stack limit > toMatchSnapshot on a deep object fails instead of writing a truncated snapshot [589.01ms]
(pass) pretty_format and the native stack limit > failing toEqual against a deep expect.objectContaining chain still prints a diff [702.59ms]
(pass) pretty_format and the native stack limit > failing toEqual on a deep object still prints a diff [761.33ms]
(pass) pretty_format and the native stack limit > failing toEqual on a deep React element still prints a diff [840.78ms]
(pass) pretty_format and the native stack limit > a 256-deep object is still serialized in 
... (truncated)

release with fix: all passed
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped)
  target       linux-x64-gnu
  build type   Release
  build dir    ./build/release
  revision     5a24ce6c33
  features     baseline

23 deps, 131 codegen, 1172 objects in 781ms

ninja: Entering directory `/workspace/bun/build/release'
[1/1244] install /workspace/bun
bun install v1.4.3-canary.1 (f42e98025)

Checked 22 installs across 61 packages (no changes) [13.00ms]
[2/1244] install /workspace/bun/packages/bun-error
bun install v1.4.3-canary.1 (f42e98025)

Checked 1 install across 2 packages (no changes) [1.00ms]
[3/1244] gen ErrorCode+*.h
[4/1244] gen bindgenv2
[5/1244] install /workspace/bun/src/node-fallbacks
bun install v1.4.3-canary.1 (f42e98025)

Checked 111 installs across 104 packages (no changes) [4.00ms]
[6/1244] gen node-fallbacks/react-refresh.js
Bundled 1 module in 6ms

  react-refresh.js  4.81 KB  (entry point)

[7/1244] fetch tinycc
[tinycc] up to date
[8/1243] fetch libjpeg-turbo
[libjpeg-turbo] up to date
[9/1216] fetch zlib
[zlib] up to date
[10/1216] gen ProcessBindingConstants.lut.h
Generating /workspace/bun/build/release/codegen/ProcessBindingConstants.lut.h f
... (truncated)

diff hotspot

src/bun_core/util.rs                            |  14 ---
 src/jsc/ConsoleObject.rs                        |  17 +---
 src/jsc/JSValue.rs                              |   1 -
 src/jsc/VirtualMachine.rs                       |   3 +-
 src/runtime/test_runner/diff_format.rs          |   1 +
 src/runtime/test_runner/mod.rs                  |   1 +
 src/runtime/test_runner/pretty_format.rs        |  86 ++++++++++-------
 test/js/bun/test/pretty-format-overflow.test.ts | 118 ++++++++++++++++++++++++
 test/js/bun/util/reportError.test.ts            |  43 ++++++++-
 test/js/node/util/bun-inspect.test.ts           |  31 +++++++
 10 files changed, 250 insertions(+), 65 deletions(-)

gate history · 11 passed · 0 rejected · iteration 4

evidence per changed file

file                                             reads  edits  tests
src/bun_core/util.rs                                 2      2     59
src/jsc/ConsoleObject.rs                            12      8     59
src/jsc/JSValue.rs                                   2      3     59
src/jsc/VirtualMachine.rs                            7      6     59
src/runtime/test_runner/diff_format.rs               1      1     59
src/runtime/test_runner/mod.rs                       0      0     59
src/runtime/test_runner/pretty_format.rs             9      8     60
test/js/bun/test/pretty-format-overflow.test.ts      2      2     38
test/js/bun/util/reportError.test.ts                 5      7     46
test/js/node/util/bun-inspect.test.ts                0      0     14

[robobun]

Reproduced with the repro in the PR body: stock bun and ASAN main SIGSEGV (exit 139) at 50k depth. With the fix the process exits 1. The same guard covers Bun.inspect (throws), and the test runner's diff (truncates, including through nested asymmetric matchers) and snapshot (fails the test) formatters.

Verified locally up to 5a24ce6: 12 cases fail with src/ at main, 32/32 pass with the fix.

The current head 6773705 merges main on top of that, including main's larger ASAN stack reserve in StackCheck and the LLVM 23 upgrade. This PR's hunks are intact and the net diff is unchanged. CI build 116586 ran the three test files on the x64-asan lane with the new toolchain: 8/8, 6/6 and 18/18 pass, including the 256-deep floor case. The only failed job in that build is an x64-asan shard whose red test is test/js/bun/spawn/spawn.test.ts (added on main by #42038, unrelated to this diff, handed to main-break triage).

Not measured: a debug+ASAN build on the new toolchain, which has the largest frames. The CI asan lane is an optimized build, so it does not cover that profile. PR: #34884

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 549a3c80-3e64-48aa-ad1e-d9f7fa85f1d5

📥 Commits

Reviewing files that changed from the base of the PR and between 079cb0a and 6327e89.

📒 Files selected for processing (7)

• src/bun_core/util.rs
• src/jsc/ConsoleObject.rs
• src/jsc/JSValue.rs
• src/jsc/VirtualMachine.rs
• src/runtime/test_runner/pretty_format.rs
• test/js/bun/test/pretty-format-overflow.test.ts
• test/js/bun/util/reportError.test.ts

💤 Files with no reviewable changes (1)

• src/jsc/JSValue.rs

Included review availability: Your plan includes up to 5 reviews per rolling hour; 0 remain after this review.

---

Walkthrough

Changes

Formatter recursion checks are initialized centrally. Unsafe recursion now stops formatting. Regression tests cover deeply nested assertion, thrown-value, and rejected-value scenarios.

Formatter recursion safety

Layer / File(s)	Summary
Centralize formatter stack-check initialization src/bun_core/util.rs, src/jsc/ConsoleObject.rs, src/jsc/JSValue.rs, src/jsc/VirtualMachine.rs	Formatter::new uses StackCheck::init(). Redundant initialization and update calls are removed.
Guard formatter recursion src/jsc/ConsoleObject.rs, src/runtime/test_runner/pretty_format.rs	Console formatting checks recursion safety before its early return. Pretty-formatting stops when recursion is unsafe.
Cover deeply nested values test/js/bun/test/pretty-format-overflow.test.ts, test/js/bun/util/reportError.test.ts	Subprocess tests verify that deeply nested values exit with code 1 without signal termination.

Suggested reviewers: jarred-sumner, alii

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing native stack overflows in console and test-runner formatters for deeply nested values.
Description check	✅ Passed	The description is complete and directly addresses the change, cause, fix, verification steps, regression coverage, and related work. It uses equivalent headings such as Repro, Cause, Fix, and Verific…

---

_{Comment @coderabbitai help to get the list of available commands.}

[robobun]

^{Updated 8:59 AM PT - Sep 16th, 2026}

❌ @robobun, your commit 6773705 has 1 failures in Build #116586 (All Failures):

• test/js/bun/spawn/spawn.test.ts - code 1: stdout reader of an unref'd child and process lifetime > an idle reader stopped at the highwater … on 🐧 13 x64-asan

---

🧪   To try this PR locally:

bunx bun-pr 34884

That installs a local version of the PR into your bun-34884 executable, so you can run:

bun-34884 --bun

[github-actions]

Found 1 issue this PR may fix:

1. Crash through uncaught exception in a JS VM #24069 - Crash message is "Uncaught exception while handling uncaught exception", indicating the exception printer itself crashed while formatting a complex non-Error value (from happy-dom), which matches the uninitialised StackCheck bug this PR fixes.

If this is helpful, copy the block below into the PR description to auto-close this issue on merge.

Fixes #24069

🤖 Generated with Claude Code

[robobun]

Re the auto-linked #24069: that one is a different bug. Its stack trace shows the uncaughtException reentrancy guard panicking because a JS process.on('uncaughtException', ...) listener (happy-dom's BrowserExceptionObserver) threw a TypeError, and the second trip through VirtualMachine.uncaughtException hits panic: Uncaught exception while handling uncaught exception. This PR only touches the formatter's stack-overflow guard when printing a deeply nested thrown value; it doesn't change the listener-reentrancy path. Not adding Fixes #24069.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/jsc/ConsoleObject.rs`:
- Around line 1729-1732: Prevent direct construction of Formatter from bypassing
StackCheck initialization by making Formatter and/or its fields private as
appropriate, or by exposing only constructor-based initialization. Ensure all
Formatter instances use Formatter::new and therefore initialize stack_check
through StackCheck::init, while preserving the existing formatting behavior.

In `@test/js/bun/util/reportError.test.ts`:
- Around line 147-149: Strengthen the assertions in the uncaught-error test
around the existing stderr and exitCode checks: separately verify that the
post-control uncaught-exception printer emits its expected marker or RangeError
output, rather than relying on the earlier console.log(a) catch output. Keep the
exit-code assertion and ensure the test fails if the uncaught printer exits with
code 1 without reporting the RangeError.
- Around line 126-128: Replace the regression comments near the
uncaught-exception printer and the corresponding lines around 145-146 with the
confirmed issue URL only, or remove them if no issue is tracked; do not retain
implementation history or behavioral explanation in those comments.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4e2ecd41-bac0-4fa9-b29a-ebadc4ecc699

📥 Commits

Reviewing files that changed from the base of the PR and between 2b90109 and bf63a9a.

📒 Files selected for processing (2)

• src/jsc/ConsoleObject.rs
• test/js/bun/util/reportError.test.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/js/bun/test/pretty-format-overflow.test.ts`:
- Around line 54-74: Strengthen both subprocess regressions by emitting a small
bounded-depth marker immediately before formatting or throwing, piping stdout or
another bounded stream so the marker remains observable, and asserting it while
continuing to ignore the potentially huge formatter diagnostics. In
test/js/bun/test/pretty-format-overflow.test.ts lines 54-74, verify the
50,000-level array was constructed before toEqual runs; in
test/js/bun/util/reportError.test.ts lines 126-141, verify each throw and
Promise.reject fixture reached the printer. Preserve the existing exit-status
and signal assertions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9e66d5fa-2f29-45dd-8345-deec8e3b1aec

📥 Commits

Reviewing files that changed from the base of the PR and between bf63a9a and 2a99f15.

📒 Files selected for processing (5)

• src/jsc/JSValue.rs
• src/jsc/VirtualMachine.rs
• src/runtime/test_runner/pretty_format.rs
• test/js/bun/test/pretty-format-overflow.test.ts
• test/js/bun/util/reportError.test.ts

💤 Files with no reviewable changes (1)

• src/jsc/JSValue.rs

[robobun]

The pretty_format::Formatter piece overlaps with #34885 (opened ~7 minutes after this one by another run), which applies the same StackCheck guard to pretty_format.rs with a broader test matrix (deep object, toMatchSnapshot, JSX). This PR additionally fixes the console_object::Formatter side (the uncaught-exception printer, the original report) which #34885 does not touch. Whichever lands second will need a trivial rebase of pretty_format.rs.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/js/bun/util/reportError.test.ts`:
- Around line 126-130: Update the parameterized test title in the describe.each
block to include the stmt argument, so each case identifies whether it uses
throw or Promise.reject while preserving the existing wrap and type values.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: c916b3aa-a140-4996-b486-d400c1a1732f

📥 Commits

Reviewing files that changed from the base of the PR and between 2a99f15 and 11ce721.

📒 Files selected for processing (2)

• src/jsc/ConsoleObject.rs
• test/js/bun/util/reportError.test.ts

[claude]

All prior feedback from this thread has been addressed in 2a99f15 and 11ce721 — I don't have anything new to flag. Deferring to a human for sign-off given this changes the recursion-guard invariant for every Formatter::new() caller across two subsystems, and the pretty_format piece needs merge-order coordination with #34885.

Extended reasoning...

Overview

Seats a live StackCheck in both console_object::Formatter::new() and test_runner::pretty_format::Formatter::new(), reorders print_as_prelude so the stack guard runs before the !can_circ early-return (covering Tag::Proxy), removes the four now-redundant per-call-site stack_check = StackCheck::init() assignments plus the redundant .update() in JSValue::to_fmt, and adds subprocess regression tests for deep array/Proxy via throw/Promise.reject/toEqual.

Security risks

None. The change strictly narrows a native-stack-overflow crash surface (SIGSEGV → truncate + set failed). can_throw_stack_overflow stays defaulted to false, so newly-covered callers truncate rather than throw.

Level of scrutiny

Moderate-to-high. The mechanism is a one-line constructor swap plus a guard reorder, and StackCheck::init() is a cheap thread-local read that degrades to the old always-pass default on unconfigured threads. But it implicitly changes behavior for every Formatter::new() caller (~40 sites across 18 files), reorders a check in a hot recursive path so it now runs on every tag (including primitives), and touches two separate formatter structs. shallow_clone() was verified to propagate the seated stack_check (ConsoleObject.rs:1764).

Other factors

• All three prior review threads I raised (test output volume, stale comment/redundant .update(), pretty_format sibling, Proxy !can_circ bypass) were addressed in follow-up commits and are resolved.
• The verifier agents examined and refuted the concern that stderr:"ignore" doesn't bound the child's own K² in-memory DiffFormatter buffer on release builds.
• The PR description explicitly calls out overlap with #34885 (same pretty_format guard, broader test matrix) — whichever lands second needs a rebase, which is a maintainer coordination decision.
• One trivial CodeRabbit nit (duplicate describe.each title string) was acknowledged as apply-at-merge; it doesn't affect test execution.
• An earlier revision crashed the Windows aarch64 lane (build 76688) due to piped output volume; the current revision uses stderr:"ignore" — worth confirming CI is green across all lanes on 11ce721 before merge.

[claude]

LGTM — all three prior rounds of feedback are addressed and the mechgate shows fail-before/pass-after on both ASAN and release.

What was reviewed:

• StackCheck::init() seated in both Formatter::new() constructors; verified shallow_clone() copies it and all to_fmt callers pass freshly-constructed formatters, so the removed .update() was indeed dead.
• print_as_prelude reorder: stack check now precedes the !can_circ early-return, so Proxy/JSX and other non-circular recursive tags are covered; the added per-leaf check is a pointer subtract + compare.
• Tests use stderr: "ignore" to avoid the K² release-build output, assert signalCode === null before exitCode === 1, and the describe.each title now distinguishes throw vs. Promise.reject.

Extended reasoning...

Overview

Fixes a native-stack-overflow SIGSEGV when the console/test-runner formatter recurses into a deeply nested non-Error value (50k-deep array, Proxy chain) via three coordinated changes: (1) console_object::Formatter::new() seats stack_check: StackCheck::init() instead of default() and the four now-redundant per-call-site re-seats plus the to_fmt .update() are deleted; (2) print_as_prelude checks is_safe_to_recurse() before the !can_circ early-return so Tag::Proxy and other non-circular recursive tags hit the guard; (3) test_runner::pretty_format::Formatter gains a stack_check field and an is_safe_to_recurse() guard at the top of print_as. A stale comment in VirtualMachine.rs is trimmed. Four new subprocess tests cover throw/reject × array and throw × Proxy for the uncaught printer, plus expect(50k-deep).toEqual([]) for the diff formatter.

Security risks

None introduced. This closes a user-reachable native crash (DoS-class) — throwing a deep value would SIGSEGV the process. StackCheck::init() reads a cached thread-local; on unconfigured threads it returns 0 (identical to the old default), so no behavior change off the JS thread. can_throw_stack_overflow stays defaulted to false, so the uncaught-exception printer and diff formatter truncate + set failed rather than throwing into a context that can't catch.

Level of scrutiny

Medium-high — this is a hot-path native formatter used by every console.log, uncaught-exception print, and test-runner diff. The change itself is small and mechanical (a constructor default swap, a 6-line reorder, a mirrored field+guard in the sibling formatter). I reviewed this PR three times previously; each finding (missing pretty_format sibling, stale comment/dead .update(), K² stderr in the test, Proxy !can_circ bypass) was addressed in a follow-up commit. This run I re-verified: the reordered print_as_prelude at ConsoleObject.rs:3384-3393 is correct; shallow_clone() at :1764 copies stack_check from self; pretty_format::print_as at :1161-1164 has the guard; and a spot-check of to_fmt callers confirms they all pass freshly-constructed formatters, so removing the .update() cannot leave a stale bound.

Other factors

The PR body's mechgate evidence shows the new tests SIGSEGV on main (ASAN: 5 fail; release: Proxy variant fails) and pass with the fix on both profiles. CI build 76704 passed with three unrelated flakes (darwin websocket idle-CPU, two install-test flakes). All CodeRabbit findings are resolved/withdrawn. The overlap with #34885 is noted in the PR body — whichever lands second needs a trivial pretty_format.rs rebase. The bug-hunting system found nothing on this final revision.

[robobun]

Cross-reference from closing #34889 (the omnibus that also carried this change): this PR is the owner of the Formatter::new() seating and, together with #34885, of the pretty_format guard; #34889's tests for both are covered by reportError.test.ts here and by #34885's matrix.

Two textual overlaps to be aware of when this is rebased, neither of which changes what this PR does:

• The print_as_prelude hunk (stack check moved ahead of the can_circ early return) is also in console: guard JSX/Proxy recursion in Bun.inspect (stack overflow SIGSEGV) #29709, as the same three-line move. console: guard JSX/Proxy recursion in Bun.inspect (stack overflow SIGSEGV) #29709 stays open for the JSX circular entry and the Proxy peeling loop; whichever of the two lands second drops that hunk.
• error printer: print the AggregateError header, label [cause]/[errors] blocks, and guard the .errors walk #36602 seats StackCheck::init() locally in VirtualMachine::print_exception and edits the same print_error_instance_js comment that this PR trims. Once this PR lands, that local seating in error printer: print the AggregateError header, label [cause]/[errors] blocks, and guard the .errors walk #36602 becomes redundant (harmless either way).

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[claude]

LGTM — the last remaining .update() sibling in format_value() is now removed along with the dead StackCheck::update method itself.

What was reviewed:

• StackCheck::init() seated in both Formatter::new() constructors; verified all six removed re-seat sites went through new() and shallow_clone() copies the seated value.
• print_as_prelude reorder: is_safe_to_recurse() now precedes the !can_circ early-return so Proxy/JSX chains hit the guard; the check is a single frame-address compare so the extra per-tag cost is negligible.
• pretty_format::Formatter guard sets failed = true and returns Ok(()), matching the existing if self.failed short-circuit; no can_throw_stack_overflow on this path so it truncates rather than throws.
• Confirmed via repo-wide grep that no stack_check.update() callers remain and StackCheck::update is fully dead.

Extended reasoning...

Overview

This PR fixes a SIGSEGV when the console/test-runner formatters recurse into a deeply nested non-Error value (50k-deep array, Proxy chain, or expect(deep).toEqual([])). The root cause was that console_object::Formatter::new() left stack_check at StackCheck::default() (cached_stack_end = 0 ⇒ is_safe_to_recurse() always true), so ~40 callers including the uncaught-exception printer had no live recursion guard. pretty_format::Formatter had no stack guard at all. The fix seats StackCheck::init() in both constructors, moves the is_safe_to_recurse() check above the !can_circ early-return in print_as_prelude so it covers every recursive tag (including Tag::Proxy), removes the now-redundant per-call-site re-seats and the now-unused StackCheck::update method, and trims a stale comment. Seven files touched; four new subprocess tests that SIGSEGV on the unfixed build.

Security risks

None. This is a crash-hardening change in diagnostic-output code paths (uncaught-exception printer, test-runner diff formatter). No auth, crypto, permissions, or untrusted-input parsing is touched. The change strictly narrows the set of inputs that crash the process.

Level of scrutiny

Medium. The formatters are hot-ish diagnostic paths but not correctness-critical — worst case of a bug here is truncated output, not corrupted state. StackCheck::init() is a single read of a cached thread-local (Bun__StackCheck__getMaxStack), so seating it eagerly in the constructor is effectively free; on an unconfigured thread it returns 0, identical to the old default. The print_as_prelude reorder adds one frame-address compare per non-circular tag, which is negligible against the JS-object-walk cost. I verified shallow_clone() copies stack_check (line 1708) so the TablePrinter clone path stays live, and grepped repo-wide to confirm no stack_check.update() callers remain after the format_value and to_fmt deletions.

Other factors

This PR has been through four rounds of automated review with every finding addressed and marked resolved: (1) the stderr: "pipe" → "ignore" output-volume fix, (2) the stale VirtualMachine.rs comment + JSValue.rs .update() cleanup, (3) the pretty_format::Formatter sibling guard, (4) the Proxy !can_circ bypass reorder, (5) the describe.each title disambiguation, and (6) the final format_value .update() sibling + StackCheck::update removal. The tests use branch-free inline fixtures with stderr: "ignore" (per the earlier review's K² output-volume analysis), assert signalCode === null / exitCode === 1, and were verified to SIGSEGV on the unfixed build. The PR description documents the known textual overlaps with #34885 / #29709 / #36602 for whoever rebases second. No outstanding reviewer comments.

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[robobun]

I measured what this diff does to the Bun.serve face of the same bug, because that face is network-reachable.

The handler throws the parsed request body. The server has no error hook, so the default path prints the value. One POST of 400 KB, body depth 200000, loopback. Release builds.

• main at 55c1106: the server process takes SIGSEGV. The client sees ECONNRESET. 471 MB on stderr.
• main plus this diff: no SIGSEGV. The server answers 500, writes 458 MB, then exits 1 with RangeError: Maximum call stack size exceeded. and the version banner.

So the guard works. It fires at about 21400 levels of array. The crash is gone.

Two things remain after this diff, and each has its own open PR:

1. The process still exits. The RangeError comes from the print path and stays pending on the VM, so it is reported as an uncaught error. error printer: clear the pending exception when formatting a non-Error uncaught value throws #36921 propagates that error out of the non-Error branch of print_error_instance_body so the caller clears it. With this diff plus error printer: clear the pending exception when formatting a non-Error uncaught value throws #36921 the server stays alive at every depth I tried, up to 200000.
2. The 458 MB write remains. Nothing here caps the array walk, so the printer writes until the guard fires. console: apply depth cap to Map/Set/Array entries and Error cause chains #35288 adds the depth cap. With console: apply depth cap to Map/Set/Array entries and Error cause chains #35288 alone the same request costs 216 bytes and the server stays alive.

Full matrix, the repro, and a Bun.serve regression test are in #35288. The test is on branch robobun/5fc21a55/serve-deep-throw-test.

[robobun]

Updated this PR to current main in 6773705.

• One conflict, in src/bun_core/util.rs. main added StackCheck::THRESHOLD (with the larger reserve under ASAN) next to update(), and this PR removes update() and impl Default. The merge keeps THRESHOLD and the removals. No user of update() or StackCheck::default() remains.
• Verified on a debug ASAN build of the merged tree: test/js/bun/test/pretty-format-overflow.test.ts 8 pass, test/js/bun/util/reportError.test.ts 6 pass, test/js/node/util/bun-inspect.test.ts 18 pass, inspect.test.js and inspect-error.test.js pass. cargo check -p bun_runtime passes with nightly-2026-09-15.

I measured this PR against four values that overflow the native stack in the error printer on main. The table is in #36602 (comment).

• It stops the array nested 30,000 deep and the cause chain 3,000 deep (throw, Promise.reject).
• It does not stop the AggregateError chain 3,000 deep, or an AggregateError that holds itself in errors. print_errorlike_object walks errors through for_each and agg_iter before a formatter is involved, so the stack bound of the formatter does not apply there. error printer: print the AggregateError header, label [cause]/[errors] blocks, and guard the .errors walk #36602 covers both.
• reportError(deepArray) no longer crashes, but it now throws RangeError: Maximum call stack size exceeded to its caller, and a Bun.serve handler that throws the array fails the debug assertion a task returned Ok with a JS exception pending. The non-Error branch of print_error_instance_body leaves the exception pending. error printer: clear the pending exception when formatting a non-Error uncaught value throws #36921 fixes that. This PR plus the source change of error printer: clear the pending exception when formatting a non-Error uncaught value throws #36921 is clean on both doors. The two PRs conflict in test/js/bun/util/reportError.test.ts.

Build note: after this merge the branch includes #42851 (LLVM 23.1.1), so a local bun bd needs clang 23.1. With an older clang it stops at configure with error: Could not find clang (version >=23.1.0 <23.1.99). I built and ran the tests above on this branch merged with 55c1106, the last main commit before #42851, because my machine has clang 21. #42851 touches none of the files of this PR, and cargo check with the new nightly passes on the pushed tree.

[robobun]

A data point for this PR from #43238: a fuzz run found that an Error behind 100,000 nested Proxies crashes the console formatter (print_proxy recurses with no guard, and Tag::Proxy skips the stack check in print_as_prelude). On main today throw v, Promise.reject(v) and console.log(v) with that chain end in SIGSEGV. #43238 makes timers and ticks format a thrown object too, so it depends on this PR for one remaining shape: a deep Proxy chain nested inside the thrown object. I applied this PR's diff on the #43238 branch (it applies cleanly) and built it: the 100,000-deep chain exits 1 on the timer, sync and console.log paths, nested or not.