Repository navigation
fs::StatFs promise crashes v8 with incorrect argument #61224
Description
Version
v24.6.0
Platform
Darwin Vesuvius 24.6.0 Darwin Kernel Version 24.6.0: Wed Oct 15 21:12:21 PDT 2025; root:xnu-11417.140.69.703.14~1/RELEASE_X86_64 x86_64
Subsystem
fs
What steps will reproduce the bug?
Run the following code:
import * as fs from 'node:fs/promises'
fs.statfs()
Other arguments such as null, undefined, 4 or Symbol() crash as well.
How often does it reproduce? Is there a required condition?
It crashes 100% consistently.
What is the expected behavior? Why is that the expected behavior?
A thrown error, like maybe an ERR_INVALID_ARG_TYPE or something similar.
What do you see instead?
# node[50047]: void node::fs::StatFs(const FunctionCallbackInfo<Value> &) at ../src/node_file.cc:1228
# Assertion failed: (*path) != nullptr
----- Native stack trace -----
1: 0x1094142b1 node::Assert(node::AssertionInfo const&) [/usr/local/Cellar/node/24.6.0/bin/node]
2: 0x1080c1e39 node::fs::StatFs(v8::FunctionCallbackInfo<v8::Value> const&) [/usr/local/Cellar/node/24.6.0/bin/node]
3: 0x108bf644d Builtins_CallApiCallbackGeneric [/usr/local/Cellar/node/24.6.0/bin/node]
----- JavaScript stack trace -----
1: statfs (node:internal/fs/promises:1050:13)
2: file:///Users/dada/a.js:4:4
3: run (node:internal/modules/esm/module_job:371:25)
fish: Job 1, 'node a.js' terminated by signal SIGABRT (Abort)
Additional information
No response
Activity
VoltrexKeyva commentedon Dec 30, 2025
Can reproduce on v24.12.0.
targos commentedon Dec 31, 2025
node/lib/internal/fs/promises.js
Line 1050 in 7b7f693
Looks like we're missing a
getValidatedPathcall.