Skip to content

Fix segfault in JS_NewSymbol with NULL description and align with ES semantics#1447

Merged
bnoordhuis merged 3 commits intoquickjs-ng:masterfrom
engsr6982:master
Apr 11, 2026
Merged

Fix segfault in JS_NewSymbol with NULL description and align with ES semantics#1447
bnoordhuis merged 3 commits intoquickjs-ng:masterfrom
engsr6982:master

Conversation

@engsr6982
Copy link
Copy Markdown
Contributor

Currently, calling JS_NewSymbol(ctx, NULL, false) triggers a segmentation fault because JS_NewAtom unconditionally calls strlen() on the description.

This PR fixes the crash and aligns the C-API with ECMAScript semantics:

  1. Local Symbols (is_global = false): Passing NULL now creates a description-less Symbol (equivalent to Symbol()), correctly utilizing the internal sentinel JS_NewSymbolInternal(ctx, NULL, ...).
  2. Global Symbols (is_global = true): Passing NULL now mimics Symbol.for(). Per the ES specification, Symbol.for() coerces undefined to the string "undefined". We fallback the NULL pointer to "undefined", avoiding any artificial C-level TypeError exceptions.

This makes JS_NewSymbol completely safe to use with optional C strings.

@bnoordhuis
Copy link
Copy Markdown
Contributor

Looks fine to me but can you add a couple of regression tests to api-test.c?

@engsr6982
Copy link
Copy Markdown
Contributor Author

Done. Added regression tests for both cases to api-test.c.

Co-authored-by: Ben Noordhuis <info@bnoordhuis.nl>
@bnoordhuis bnoordhuis merged commit 6ba35b0 into quickjs-ng:master Apr 11, 2026
124 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants