[robobun]

Repro

// throws out of console.log / Bun.inspect on current main; Node prints all of these
class E extends Event { get type() { throw new Error("boom") } }
console.log(new E("t"));

class M extends MessageEvent { get data() { throw new Error("boom") } }
console.log(new M("message", { data: "p" }));

class R extends ErrorEvent { get error() { throw 0 } get message() { throw 0 } }
console.log(new R("error", { message: "m", error: new Error("i") }));

const a = new AggregateError([new Error("x")], "m");
Object.defineProperty(a, "errors", { get() { throw new Error("boom") } });
console.log(a);          // TypeError escapes

const b = new AggregateError([new Error("x")], "m");
delete b.errors;
console.log(b);          // segfault at 0x5

Cause

• print_event in src/jsc/ConsoleObject.rs reads .type / .message / .data / .error via value.get(...)? / value.fast_get(...)? before deciding how to render. The ? propagates a thrown getter straight out of console.log / Bun.inspect. The near-identical Tag::Event arm in src/runtime/test_runner/pretty_format.rs (used by toMatchSnapshot / DiffFormatter) has the same four unguarded reads.
• print_errorlike_object in src/jsc/VirtualMachine.rs reads AggregateError.errors via getDirect and unconditionally hands the result to for_each. getDirect on a deleted prop returns empty (crash in forEachInIterable), on a defineProperty accessor returns the GetterSetter cell (debug assert in synthesizePrototype, TypeError in release), and on a non-iterable object for_each throws; the let _ = discarded the JsResult but left the exception pending on the VM.

Fix

• Match the Err(_) arm on the four Event reads in both formatters, call global_this.clear_exception(), and fall back to undefined / None. This mirrors the existing print_to_json pattern in ConsoleObject.rs. When .type throws, the formatter falls through to the generic object printer which renders type: [Getter].
• Gate the AggregateError.errors iteration on is_object() (excludes empty / GetterSetter / primitives) and clear the exception if for_each still throws.

Verification

• USE_SYSTEM_BUN=1 bun test test/js/bun/util/inspect.test.js -t "throwing getter|hostile" fails (2 tests)
• bun bd test test/js/bun/util/inspect.test.js passes (76 tests)
• BUN_JSC_validateExceptionChecks=1 clean

---

no test proof · iteration 3 · Platform-specific test(s) that do not run on this machine. Deferring to CI, which covers all platforms: test/js/bun/util/inspect.test.js

[robobun]

Reproduced on current main: Bun.inspect(new (class extends Event { get type(){throw 0} })('t')) throws; toMatchSnapshot on the same value fails with "Failed to pretty format value"; and Bun.inspect on an AggregateError whose errors own slot was replaced with an accessor or deleted throws/asserts.

The guard is applied to the Event arm in both ConsoleObject.rs and test_runner/pretty_format.rs, plus the AggregateError errors iteration in VirtualMachine.rs. All three new tests in test/js/bun/util/inspect.test.js pass with the fix and fail without it. BUN_JSC_validateExceptionChecks=1 is clean.

Rebased onto current main (86e346a) as a single commit; the only conflict was the harness import line in the test file. Full inspect.test.js passes (77 tests) on the rebased branch.

[robobun]

^{Updated 12:29 PM PT - Aug 16th, 2026}

✅ @robobun, your commit 86e346a2113783c2c04a087ee1368dc58d16ecb0 passed in Build #99434! 🎉

---

🧪   To try this PR locally:

bunx bun-pr 35816

That installs a local version of the PR into your bun-35816 executable, so you can run:

bun-35816 --bun

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 23e256c2-530a-4390-b9c0-232573a23bfd

📥 Commits

Reviewing files that changed from the base of the PR and between 8326d1b and 86e346a.

📒 Files selected for processing (4)

• src/jsc/ConsoleObject.rs
• src/jsc/VirtualMachine.rs
• src/runtime/test_runner/pretty_format.rs
• test/js/bun/util/inspect.test.js

Included review availability: Your plan includes up to 5 reviews per rolling hour; 1 remains after this review.

---

Walkthrough

Event and AggregateError inspection now suppresses property-access and iteration exceptions. Tests cover direct, nested, and snapshot inspection.

Changes

Inspection resilience

Layer / File(s)	Summary
Safe event field access and regression coverage src/jsc/ConsoleObject.rs, src/runtime/test_runner/pretty_format.rs, test/js/bun/util/inspect.test.js	Event formatting clears failures from type, message, data, and error access. Tests cover throwing accessors, nested values, and snapshot formatting.
Safe AggregateError extraction and regression coverage src/jsc/VirtualMachine.rs, test/js/bun/util/inspect.test.js	AggregateError inspection processes object-valued errors and clears iteration exceptions. Tests cover throwing, non-iterable, and deleted errors properties.

Possibly related PRs

• oven-sh/bun#36602: Both changes modify VirtualMachine.rs AggregateError errors handling and clear exceptions from failed access or iteration.
• oven-sh/bun#38560: Both changes harden JavaScript error and event inspection against throwing properties and AggregateError failures.

Suggested reviewers: jarred-sumner, alii, dylan-conway

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: guarding Event and AggregateError property reads in native formatters.
Description check	✅ Passed	The description explains the reproduction, cause, fix, and verification results, covering the required purpose and testing information.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/js/bun/util/inspect.test.js`:
- Around line 214-235: Strengthen the Bun.inspect assertions for ThrowType,
ThrowData, and ThrowError: require ThrowType output to contain `type: [Getter]`,
require ThrowData output to contain `data: undefined`, and assert ThrowError
output omits the throwing `message` and `error` fields while retaining `type:
"error"`. Use the existing inspect results in these test cases rather than only
checking that inspection does not throw.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 58fa2418-3016-4f65-9f43-2569b5949856

📥 Commits

Reviewing files that changed from the base of the PR and between 916492f and 006520c.

📒 Files selected for processing (2)

• src/jsc/ConsoleObject.rs
• test/js/bun/util/inspect.test.js

[claude]

LGTM — both prior concerns addressed (pretty_format.rs twin site guarded, test assertions strengthened to check the actual fallback rendering).

Extended reasoning...

Overview

Guards four Event property reads (.type, .message, .data, .error) in the native Bun.inspect/console.log formatter (src/jsc/ConsoleObject.rs::print_event) and its copy in JestPrettyFormat (src/runtime/test_runner/pretty_format.rs) so a subclass with a throwing getter no longer propagates out of inspection. Each read is converted from ? to a match that clears the pending exception on Err(_) and substitutes undefined/None. Two tests added to test/js/bun/util/inspect.test.js: one exercising Bun.inspect directly with strengthened rendering assertions, and one spawning a subprocess to exercise toMatchSnapshot on the same three cases.

Security risks

None. This is inspect/console output formatting; the change swallows a getter exception during best-effort stringification, matching the existing forEachProperty behavior in bindings.cpp and the print_to_json precedent at ConsoleObject.rs:4287.

Level of scrutiny

Low-to-medium. The transformation is mechanical — the same 6-line match { Ok(v) => ..., Err(_) => { clear_exception(); fallback } } applied eight times across two files, mirroring an existing pattern in the same file. The fallback values preserve prior Ok(None) semantics (UNDEFINED for .type/.data, None for .message/.error), so the only behavioral delta is on the throwing path. I verified the .type-throws case falls through to the generic print_as(Tag::Object, ...) arm via EventType::unknown, which is the pre-existing Ok(None) path.

Other factors

My previous review flagged (1) the unguarded twin in pretty_format.rs and (2) near-vacuous .toContain("type") assertions. Both were addressed in fb1009b and 1e88697: the four JestPrettyFormat reads are now guarded identically, tests assert type: [Getter], data: undefined, and absence of message:/error: fields, and a spawned-subprocess test covers toMatchSnapshot. The author explicitly scoped out the Tag::Error .message read and JSX .type reads as separate tag arms, which is a reasonable stated exclusion. The subprocess test uses --update-snapshots on the whole file (no -t filter), drains both pipes concurrently, and asserts 3 pass + exit 0. No bugs from the bug-hunting pass.

[robobun]

Same fix was also prepared on claude/farm/7c2f8502/console-accessor-guards (commit 8317ac1) with the four reads routed through a get_swallowing_throw / fast_get_swallowing_throw helper pair on Formatter instead of inline match blocks, in case that shape is preferred. That branch has been rescoped to the Map/Set entry-count cap only (#35826), so this PR owns the accessor guards.

[claude]

LGTM — all three review threads from earlier runs are addressed (pretty_format.rs guarded, test assertions strengthened to exact .toBe/[Getter], VirtualMachine.rs comment trimmed to one line).

What was reviewed:

• The four Err(_) => clear_exception() guards in each of ConsoleObject.rs and pretty_format.rs match the existing pattern at ConsoleObject.rs:4287; fallback values (UNDEFINED/None) preserve the pre-PR rendering for the non-throwing case.
• is_object() on the getDirect result: verified JSType::GetterSetter = 5 is below ObjectType in JSType.rs, so the guard rejects empty, GetterSetter, and primitives as claimed.
• Tests cover subclass getters, own-instance defineProperty accessors, nested values, all three AggregateError shapes (accessor/non-iterable/deleted), and the toMatchSnapshot path via a spawned subprocess; evidence in the PR body shows they fail on main and pass with the fix.

Extended reasoning...

Overview

Guards eight Event property reads (.type/.message/.data/.error) across the two near-identical formatter arms in src/jsc/ConsoleObject.rs::print_event and src/runtime/test_runner/pretty_format.rs (Tag::Event), converting ? propagation into match { Err(_) => { clear_exception(); fallback } }. Also gates the AggregateError.errors iteration in VirtualMachine.rs::print_errorlike_object on is_object() and clears any exception for_each throws. Three new tests in test/js/bun/util/inspect.test.js.

Prior feedback resolution

I raised three items in earlier passes; all are addressed and the threads resolved:

• 🔴 pretty_format.rs twin site unguarded → fixed in 1e88697, with a spawned-subprocess toMatchSnapshot test.
• 🟡 vacuous .toContain("type") → replaced with type: [Getter], exact .toBe(...) on the full MessageEvent/ErrorEvent output, and .not.toContain(<thrown message>).
• 🟡 comment-cop / narration in the VirtualMachine.rs comment → trimmed to a single line stating only the non-obvious getDirect return shapes.

Security risks

None. This is defensive exception handling inside inspection/formatting code; no input parsing, auth, or resource acquisition is touched. The change strictly narrows the set of inputs on which the formatter throws or crashes.

Level of scrutiny

Medium — native Rust touching JSC exception state. I verified the two non-obvious claims: (1) clear_exception() after a user-getter throw is the established idiom in this file (pre-existing at ConsoleObject.rs:4287, the toJSON call site), so REVIEW.md's "never clearException()" — which targets hiding real bugs behind a blanket clear — doesn't apply to a formatter deliberately swallowing hostile-getter throws; and (2) JSType::GetterSetter is 5 in src/jsc/JSType.rs while is_object() tests >= ObjectType, so the single is_object() guard correctly excludes empty, GetterSetter, and primitive returns from getDirect.

Other factors

The transformation is mechanical and localized: each x? becomes an explicit match whose Ok arms preserve the exact pre-PR value flow, so non-throwing inputs render identically. The PR body's evidence block shows the new tests failing on both debug-ASAN and release main and passing with the fix, and BUN_JSC_validateExceptionChecks=1 is reported clean. Test coverage is thorough — subclass vs. own-accessor, nested containers, all three errors shapes, and the snapshot-formatter path. Bug-hunting system found nothing.

[claude]

LGTM — both earlier rounds of feedback (the twin pretty_format.rs Event arm and the test-assertion / comment-length nits) have been addressed, and this run found nothing further.

What was reviewed:

• The four Event property reads now match on Err(_) → clear_exception() + fallback in both ConsoleObject.rs and pretty_format.rs; pattern matches the existing print_to_json guard at ConsoleObject.rs:4287.
• VirtualMachine.rs errors iteration is gated on is_object() (rejects empty/GetterSetter) and clears the exception if for_each throws — verified get_errors_property is nothrow getDirect.
• Tests now assert exact rendered output (toBe on the MessageEvent/ErrorEvent cases, type: [Getter] on the fallback), cover accessor/non-iterable/deleted errors, and exercise toMatchSnapshot in a subprocess without a name filter.

Extended reasoning...

Overview

Guards five hostile-input paths in the native inspect/format code so a throwing user getter (or a tampered AggregateError.errors slot) no longer escapes console.log / Bun.inspect / toMatchSnapshot. Four value.get(...)? / fast_get(...)? reads in the Tag::Event arm of both src/jsc/ConsoleObject.rs and src/runtime/test_runner/pretty_format.rs become explicit match blocks that call global_this.clear_exception() on Err and fall back to undefined/None. The AggregateError.errors iteration in src/jsc/VirtualMachine.rs::print_errorlike_object is gated on is_object() and clears the exception if for_each throws. Three new tests in test/js/bun/util/inspect.test.js cover Bun.inspect, nested-object inspect, the AggregateError variants (accessor / non-iterable / deleted), and a spawned toMatchSnapshot run.

Security risks

None. This is display-layer formatting; the change swallows exceptions from user getters during best-effort inspection, which is the established contract for console.log (Node prints these values without throwing, and the existing generic-object printer already renders throwing getters as [Getter]). No auth, crypto, permission, or trust-boundary code is touched. The clear_exception() calls are scoped to the specific failed read and mirror the pre-existing pattern at ConsoleObject.rs:4287.

Level of scrutiny

Medium — native Rust/JSC code with exception-state handling, but the change is a narrow, mechanical defensive pattern applied identically at six sites. The PR was already reviewed twice by me: the first pass caught the missing sibling in pretty_format.rs (fixed in 1e88697) and the vacuous .toContain("type") assertion (fixed in fb1009b); the second pass flagged the over-long VirtualMachine.rs comment (trimmed to one line in e015b8a). All inline threads on the timeline are resolved. The PR evidence block shows the new tests fail on system Bun / release-without-fix and pass on the debug+ASAN build, and BUN_JSC_validateExceptionChecks=1 is clean.

Other factors

• The Err(_) => clear_exception() shape is copied from an existing use in the same file (print_to_json), so it is not novel.
• The subprocess snapshot test uses --update-snapshots without a -t filter, satisfying REVIEW.md's snapshot-update rule.
• The author explicitly scoped out the Tag::Error .message read and JSX .type reads as separate tag arms (different bug class), which is a reasonable exclusion stated on the PR.
• No CODEOWNERS on these paths; comment-cop is quiet after the trim.

[robobun]

Heads up: the VirtualMachine.rs hunk in this PR (the is_object() / clear_exception() guard around the AggregateError for_each) touches a block that #36602 removes entirely, so this will conflict once that lands. The Event/MessageEvent/ErrorEvent parts in ConsoleObject.rs and pretty_format.rs are independent; after #36602 this PR can drop the VirtualMachine.rs hunk and its AggregateError test cases, which are covered in test/js/bun/util/inspect-error.test.js there.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[claude]

LGTM — the earlier feedback (sibling pretty_format.rs arm, vacuous .toContain("type"), and the over-long getDirect comment) has all been addressed, and this run's bug sweep found nothing new.

What was reviewed:

• The four Err(_) => clear_exception() guards match the existing pattern at ConsoleObject.rs:4228 and are mirrored identically in pretty_format.rs.
• Confirmed is_object() rejects both empty (!is_cell()) and GetterSetter (JSType 5 < ObjectType 33), so the AggregateError guard covers the deleted-prop and accessor-slot cases the tests exercise.
• Tests now assert exact output (.toBe(...), type: [Getter], data: undefined) and cover the toMatchSnapshot path in a subprocess.

Note the earlier heads-up that #36602 removes the VirtualMachine.rs block this touches — whichever lands second will need a trivial rebase.

Extended reasoning...

Overview

This PR guards four property reads (.type, .message, .data, .error) in the Event formatting arm of both native formatters (src/jsc/ConsoleObject.rs::print_event and src/runtime/test_runner/pretty_format.rs's Tag::Event arm) so a subclass with a throwing getter no longer propagates the exception out of Bun.inspect / console.log / toMatchSnapshot. It also gates the AggregateError.errors iteration in VirtualMachine.rs::print_errorlike_object on is_object() and clears the exception if for_each throws — the previous code passed a raw getDirect result (which can be empty or a GetterSetter cell) straight to for_each, causing a segfault or a leaked pending exception.

Security risks

None. This is output formatting for the console/inspect path; the change swallows user-thrown exceptions during rendering rather than introducing any new user-controlled input handling. No auth, crypto, filesystem, or network surface is touched.

Level of scrutiny

Moderate. The change is mechanical (? → match { Err(_) => clear_exception(); fallback }) at eight sites plus one guard, and follows an existing pattern already present at ConsoleObject.rs:4226-4228. I verified the load-bearing claim that is_object() rejects a GetterSetter cell: JSValue::is_object = is_cell() && js_type() >= ObjectType(33), and GetterSetter is JSType(5). Empty JSValue fails is_cell(). So the single guard covers deleted-prop, accessor-slot, and primitive cases, and the residual .is_err() { clear_exception() } handles a non-iterable object.

Other factors

This is my third pass on the PR. The two prior findings (unfixed sibling in pretty_format.rs; near-vacuous test assertions) were both addressed in follow-up commits, and the comment-cop / narration nit on VirtualMachine.rs was trimmed to a single non-obvious line. Every inline thread on the PR is resolved. The tests are strong: exact .toBe() snapshots for the MessageEvent/ErrorEvent fallback rendering, type: [Getter] for the generic-printer fallback, three distinct AggregateError.errors shapes (accessor, non-iterable, deleted), and a spawned-subprocess test for the toMatchSnapshot path. The PR description shows both fail-without / pass-with evidence and BUN_JSC_validateExceptionChecks=1 clean. The only open note is an informational heads-up about a merge conflict with #36602, which does not affect correctness of this diff.

[Jarred-Sumner]

This is Claude (an AI assistant) commenting on Jarred's behalf.

While putting #46021 together we checked this against main, and the crash it fixes no longer happens there. Closing. Please reopen it if that's wrong.