Node crashes on new URL

[jetibest]

Version

v19.8.1

Platform

Linux pc 6.2.7-arch1-1 #1 SMP PREEMPT_DYNAMIC Sat, 18 Mar 2023 01:06:36 +0000 x86_64 GNU/Linux

Subsystem

url

What steps will reproduce the bug?

Running in Node:

Welcome to Node.js v19.8.1.
Type ".help" for more information.
> new URL('', 'localhost:80')
/usr/include/c++/12.2.1/string_view:239: constexpr const std::basic_string_view<_CharT, _Traits>::value_type& std::basic_string_view<_CharT, _Traits>::operator[](size_type) const [with _CharT = char; _Traits = std::char_traits<char>; const_reference = const char&; size_type = long unsigned int]: Assertion '__pos < this->_M_len' failed.
Aborted (core dumped)

How often does it reproduce? Is there a required condition?

There's no issue when the second argument is only a hostname, or a port. It only appears to lead to an issue when both the hostname and port is given in the second argument.

What is the expected behavior? Why is that the expected behavior?

An Error should be thrown with code ERR_INVALID_URL:

Uncaught TypeError [ERR_INVALID_URL]: Invalid URL
    at __node_internal_captureLargerStackTrace (node:internal/errors:490:5)
    at new NodeError (node:internal/errors:399:5)
    at new URL (node:internal/url:556:13) {
  input: '',
  code: 'ERR_INVALID_URL'
}

What do you see instead?

The error given in the steps to reproduce shows up, and Node crashes.

Additional information

No response

[targos]

Is this somehow platform-specific? I can't reproduce on Windows (I tried with all most recent node versions, and v19.8.1).

[jetibest]

Ok, just tried v19.8.1 on Debian 5.10.158-2 (2022-12-13) x86_64 GNU/Linux, cannot reproduce it there either.

The relevant difference is that in Debian, I'm seeing /usr/include/c++/10/string_view, whereas in Arch Linux, it's version 12.2.1. Perhaps that's why.

[anonrig]

cc @nodejs/url @lemire

[kvakil]

I can't reproduce on my arch linux machine. Also tried running under valgrind, and nothing showed up.

$ ./node -e "new URL('', 'localhost:80')"
node:internal/url:556
      throw new ERR_INVALID_URL(input);
      ^

TypeError [ERR_INVALID_URL]: Invalid URL
    at new NodeError (node:internal/errors:399:5)
    at new URL (node:internal/url:556:13)
    at [eval]:1:1
    at Script.runInThisContext (node:vm:128:12)
    at Object.runInThisContext (node:vm:306:38)
    at node:internal/process/execution:83:21
    at [eval]-wrapper:6:24
    at runScript (node:internal/process/execution:82:62)
    at evalScript (node:internal/process/execution:104:10)
    at node:internal/main/eval_string:50:3 {
  input: '',
  code: 'ERR_INVALID_URL'
}

Node.js v19.8.1
$ /usr/lib/libc.so.6 
GNU C Library (GNU libc) stable release version 2.37.
Copyright (C) 2023 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 13.1.1 20230429.
libc ABIs: UNIQUE IFUNC ABSOLUTE
Minimum supported kernel: 4.4.0
For bug reporting instructions, please see:
<https://bugs.archlinux.org/>.

[kvakil]

Perhaps you could post a backtrace from gdb or valgrind output?

[targos]

I think we're hitting the assert added in gcc-mirror/gcc@3eefb30 ?

I'm not comfortable with C++ but I guess it uncovers a bug somewhere in Node.js or Ada code ?

[jetibest]

I'm not sure how to do the gdb debugging?

I tried the inspect, but not sure how helpful that could still be:

break in node:internal/url:551
 549     }
 550 
>551     const isValid = parse(input,
 552                           base,
 553                           this.#onParseComplete);
< /usr/include/c++/12.2.1/string_view:239: constexpr const std::basic_string_view<_CharT, _Traits>::value_type& std::basic_string_view<_CharT, _Traits>::operator[](size_type) const [with _CharT = char; _Traits = std::char_traits<char>; const_reference = const char&; size_type = long unsigned int]: Assertion '__pos < this->_M_len' failed.

I reviewed the code, if the relevant code is indeed in BindingData::Parse() of node/src/node_url.cc, then given:

• the issue does not occur when args[0] is non-empty
• and the issue is a failed assert in basic_string_view

The error must occur at line 215 of node/src/node_url.cc:

auto out = ada::parse<ada::url_aggregator>(input.ToStringView(), base_pointer);

EDIT: Missed something.

[anonrig]

@jetibest can you try it with the last node.js version?

[lemire]

I'm not sure how to do the gdb debugging?

Create a script which contains the offending code (e.g., new URL('', 'localhost:80')). Then launch node in gdb, and execute run. Should something like this...

$ gdb node
> run myscript.js

Note that you can use lldb also.

[lemire]

Once it crashes, you can type bt while in gdb. It should provide a stack trace.

[lemire]

I have created a test that should replicate this bug in ada at ada-url/ada#421 So far none of the CI runs have hit a problem.

[lemire]

It does not look like we can reproduce the problem in ada per se.

[lemire]

If the problem is in ada, my guess would be that we could fix it by upgrading ada in node 19.