Debugger crash where octal escape sequences exists

[MohammadMD1383]

Version

v25.6.1

Platform

Linux lenovo 6.18.9-arch1-2 #1 SMP PREEMPT_DYNAMIC Mon, 09 Feb 2026 17:16:33 +0000 x86_64 GNU/Linux

Subsystem

Debugger

What steps will reproduce the bug?

(the weird this is that I could not reproduce this using vscode debugging, or within a simple script)

I can't provide more info about my project (it's organizational) other than these screenshots from code

How often does it reproduce? Is there a required condition?

the required condition in my project is \033, I tried with \x1b, it does not crash.

happens always

What is the expected behavior? Why is that the expected behavior?

it should not crash

What do you see instead?

a crash with segmentation violation

Additional information

I could extract the backtrace using gdb and analyzing the core dump file:

#0  v8::internal::Variable::set_is_used (this=0x0) at ../deps/v8/src/ast/variables.h:87
#1  v8::internal::ParserBase<v8::internal::Parser>::UseThis (this=0x7ffc149672e0) at ../deps/v8/src/parsing/parser-base.h:1286
#2  v8::internal::Parser::ThisExpression (this=0x7ffc149672e0) at ../deps/v8/src/parsing/parser.h:791
#3  v8::internal::ParserBase<v8::internal::Parser>::ParsePrimaryExpression (this=0x7ffc149672e0) at ../deps/v8/src/parsing/parser-base.h:2195
#4  0x0000560c1fe2e62d in v8::internal::ParserBase<v8::internal::Parser>::ParseMemberExpression (this=0x7ffc149672e0) at ../deps/v8/src/parsing/parser-base.h:4159
#5  v8::internal::ParserBase<v8::internal::Parser>::ParseLeftHandSideExpression (this=0x7ffc149672e0) at ../deps/v8/src/parsing/parser-base.h:3881
#6  v8::internal::ParserBase<v8::internal::Parser>::ParsePostfixExpression (this=0x7ffc149672e0) at ../deps/v8/src/parsing/parser-base.h:3848
#7  v8::internal::ParserBase<v8::internal::Parser>::ParseUnaryExpression (this=0x7ffc149672e0) at ../deps/v8/src/parsing/parser-base.h:3838
#8  v8::internal::ParserBase<v8::internal::Parser>::ParseBinaryExpression (this=0x7ffc149672e0, prec=6) at ../deps/v8/src/parsing/parser-base.h:3716
#9  v8::internal::ParserBase<v8::internal::Parser>::ParseLogicalExpression (this=this@entry=0x7ffc149672e0) at ../deps/v8/src/parsing/parser-base.h:3486
#10 0x0000560c1fe2f13f in v8::internal::ParserBase<v8::internal::Parser>::ParseConditionalExpression (this=0x7ffc149672e0) at ../deps/v8/src/parsing/scanner.h:743
#11 v8::internal::ParserBase<v8::internal::Parser>::ParseAssignmentExpressionCoverGrammar (this=this@entry=0x7ffc149672e0) at ../deps/v8/src/parsing/parser-base.h:3255
#12 0x0000560c1fe3c5d9 in v8::internal::ParserBase<v8::internal::Parser>::ParseExpressionCoverGrammar (this=this@entry=0x7ffc149672e0)
    at ../deps/v8/src/parsing/parser-base.h:2335
#13 0x0000560c1fe4e4b5 in v8::internal::ParserBase<v8::internal::Parser>::ParseExpressionOrLabelledStatement (this=this@entry=0x7ffc149672e0, labels=<optimized out>, 
    own_labels=<optimized out>, allow_function=v8::internal::kAllowLabelledFunctionStatement) at ../deps/v8/src/parsing/parser-base.h:6052
#14 0x0000560c1fe33412 in v8::internal::ParserBase<v8::internal::Parser>::ParseStatement (this=this@entry=0x7ffc149672e0, labels=labels@entry=0x0, 
    own_labels=own_labels@entry=0x0, allow_function=allow_function@entry=v8::internal::kAllowLabelledFunctionStatement) at ../deps/v8/src/parsing/parser-base.h:5894
#15 0x0000560c1fe34e91 in v8::internal::ParserBase<v8::internal::Parser>::ParseStatementListItem (this=this@entry=0x7ffc149672e0)
    at ../deps/v8/src/parsing/parser-base.h:5789
#16 0x0000560c1fe49289 in v8::internal::ParserBase<v8::internal::Parser>::ParseStatementList (this=0x7ffc149672e0, body=0x7ffc14967150, 
    end_token=v8::internal::Token::kEos) at ../deps/v8/src/parsing/parser-base.h:5717
#17 v8::internal::Parser::DoParseProgram (this=this@entry=0x7ffc149672e0, isolate=isolate@entry=0x560c54c56000, info=info@entry=0x7ffc14967d30)
    at ../deps/v8/src/parsing/parser.cc:808
#18 0x0000560c1fe4a297 in v8::internal::Parser::ParseProgram (this=this@entry=0x7ffc149672e0, isolate=isolate@entry=0x560c54c56000, script=script@entry=..., 
    info=info@entry=0x7ffc14967d30, maybe_outer_scope_info=..., maybe_outer_scope_info@entry=...) at ../deps/v8/src/parsing/parser.cc:723
#19 0x0000560c1fe4e940 in v8::internal::parsing::ParseProgram (info=info@entry=0x7ffc14967d30, script=script@entry=..., maybe_outer_scope_info=..., 
    maybe_outer_scope_info@entry=..., isolate=isolate@entry=0x560c54c56000, mode=mode@entry=v8::internal::parsing::ReportStatisticsMode::kYes)
    at ../deps/v8/src/parsing/parsing.cc:57
#20 0x0000560c1f8e2405 in v8::internal::(anonymous namespace)::CompileToplevel (parse_info=parse_info@entry=0x7ffc14967d30, script=..., maybe_outer_scope_info=..., 
    maybe_outer_scope_info@entry=..., isolate=isolate@entry=0x560c54c56000, is_compiled_scope=is_compiled_scope@entry=0x7ffc14967c40)
    at ../deps/v8/src/handles/handles.h:667
#21 0x0000560c1f8e2c98 in v8::internal::Compiler::GetFunctionFromEval (isolate=isolate@entry=0x560c54c56000, source=..., outer_info=..., context=..., 
    language_mode=language_mode@entry=v8::internal::LanguageMode::kSloppy, restriction=restriction@entry=v8::internal::NO_PARSE_RESTRICTION, 
    parameters_end_pos=<optimized out>, eval_position=<optimized out>, parsing_while_debugging=<optimized out>) at ../deps/v8/src/codegen/compiler.cc:3315
#22 0x0000560c1f938a38 in v8::internal::DebugEvaluate::Evaluate (isolate=isolate@entry=0x560c54c56000, outer_info=..., context=..., context@entry=..., 
    receiver=receiver@entry=..., source=..., source@entry=..., throw_on_side_effect=throw_on_side_effect@entry=false) at ../deps/v8/src/debug/debug-evaluate.cc:180
#23 0x0000560c1f9399e3 in v8::internal::DebugEvaluate::Local (isolate=0x560c54c56000, frame_id=<optimized out>, inlined_jsframe_index=inlined_jsframe_index@entry=0, 
    source=..., throw_on_side_effect=throw_on_side_effect@entry=false) at ../deps/v8/src/debug/debug-evaluate.cc:123
#24 0x0000560c1f94a3b2 in v8::internal::DebugStackTraceIterator::Evaluate (this=0x560c54ec9090, source=..., throw_on_side_effect=false)
    at ../deps/v8/src/debug/debug-stack-trace-iterator.cc:264
#25 0x0000560c1fff7f32 in v8_inspector::V8DebuggerAgentImpl::evaluateOnCallFrame (this=0x560c54d14910, callFrameId=..., expression=..., objectGroup=std::optional = {...}, 
    includeCommandLineAPI=..., silent=..., returnByValue=std::optional [no contained value], generatePreview=std::optional = {...}, throwOnSideEffect=..., 
    timeout=std::optional [no contained value], result=0x7ffc14968418, exceptionDetails=0x7ffc14968420) at ../deps/v8/src/inspector/v8-debugger-agent-impl.cc:1602
#26 0x0000560c2007fe49 in v8_inspector::protocol::Debugger::DomainDispatcherImpl::evaluateOnCallFrame (this=<optimized out>, dispatchable=...)
    at /usr/src/debug/nodejs/node/out/Release/obj/gen/inspector-generated-output-root/src/inspector/protocol/Debugger.cpp:728
--Type <RET> for more, q to quit, c to continue without paging--
#27 0x0000560c20056052 in std::function<void()>::operator() (this=0x7ffc14968758) at /usr/include/c++/15.2.1/bits/std_function.h:593
#28 v8_crdtp::UberDispatcher::DispatchResult::Run (this=this@entry=0x7ffc14968750) at ../deps/v8/third_party/inspector_protocol/crdtp/dispatch.cc:509
#29 0x0000560c20019453 in v8_inspector::V8InspectorSessionImpl::dispatchProtocolMessage (this=0x560c54d05420, message=...)
    at ../deps/v8/src/inspector/v8-inspector-session-impl.cc:388
#30 0x0000560c1f71afda in node::inspector::(anonymous namespace)::ChannelImpl::dispatchProtocolMessage (this=0x560c54d19130, message=...) at ../src/inspector_agent.cc:328
#31 node::inspector::NodeInspectorClient::dispatchMessageFromFrontend (this=<optimized out>, session_id=<optimized out>, message=...) at ../src/inspector_agent.cc:641
#32 node::inspector::(anonymous namespace)::SameThreadInspectorSession::Dispatch (this=<optimized out>, message=...) at ../src/inspector_agent.cc:1288
#33 0x0000560c1f74079a in node::inspector::(anonymous namespace)::MainThreadSessionState::Dispatch (this=<optimized out>, message=...)
    at ../src/inspector/main_thread_interface.cc:149
#34 0x0000560c1f73e963 in node::inspector::(anonymous namespace)::AnotherThreadObjectReference<node::inspector::(anonymous namespace)::MainThreadSessionState>::Apply<std::unique_ptr<v8_inspector::StringBuffer> > (target=<optimized out>, fn=<optimized out>, argument=...) at /usr/include/c++/15.2.1/bits/unique_ptr.h:190
#35 0x0000560c1f73ed34 in node::inspector::MainThreadInterface::DispatchMessages (this=0x560c54d17120) at ../src/inspector/main_thread_interface.cc:259
#36 0x0000560c1f73ef25 in operator() (__closure=<optimized out>) at ../src/inspector/main_thread_interface.cc:215
#37 node::CallbackQueue<void, node::Environment*>::CallbackImpl<node::inspector::MainThreadInterface::Post(std::unique_ptr<node::inspector::Request>)::<lambda(node::Environment*)> >::Call(node::Environment *) (this=<optimized out>, args#0=<optimized out>) at ../src/callback_queue-inl.h:90
#38 0x0000560c1f4570fc in node::Environment::RunAndClearInterrupts (this=0x560c54cdbf90) at ../src/env.cc:1396
#39 0x0000560c1f7215bc in node::inspector::NodeInspectorClient::runMessageLoop (this=0x560c54d07b90) at ../src/inspector_agent.cc:798
#40 node::inspector::NodeInspectorClient::runMessageLoopOnPause (this=0x560c54d07b90, context_group_id=<optimized out>) at ../src/inspector_agent.cc:527
#41 0x0000560c200002cd in v8_inspector::V8Debugger::handleProgramBreak (this=0x560c54ce9300, pausedContext=..., exception=exception@entry=..., breakpointIds=..., 
    breakReasons=..., exceptionType=<optimized out>, exceptionType@entry=v8::debug::kException, isUncaught=<optimized out>) at ../deps/v8/src/inspector/v8-debugger.cc:552
#42 0x0000560c2000038e in v8_inspector::V8Debugger::BreakProgramRequested (this=<optimized out>, pausedContext=..., break_points_hit=..., reasons=...)
    at ../deps/v8/src/inspector/v8-debugger.cc:678
#43 0x0000560c1f958102 in v8::internal::Debug::OnDebugBreak (this=this@entry=0x560c54c68000, break_points_hit=..., break_points_hit@entry=..., 
    lastStepAction=<optimized out>, break_reasons=..., break_reasons@entry=...) at ../deps/v8/src/debug/debug.cc:2640
#44 0x0000560c1f95853a in v8::internal::Debug::Break (this=this@entry=0x560c54c68000, frame=<optimized out>, break_target=...) at ../deps/v8/src/handles/handles.h:667
#45 0x0000560c1ff1a6a1 in v8::internal::__RT_impl_Runtime_DebugBreakOnBytecode (args=..., isolate=0x560c54c56000) at ../deps/v8/src/execution/frames.h:1727
#46 v8::internal::Runtime_DebugBreakOnBytecode (args_length=<optimized out>, args_object=<optimized out>, isolate=0x560c54c56000)
    at ../deps/v8/src/runtime/runtime-debug.cc:35
#47 0x00007f1d6de3ac76 in ?? ()
#48 0x00007ffc14968ef0 in ?? ()
#49 0x0000000000000006 in ?? ()

... about 200 more frames ...

[Renegade334]

The stacktrace suggests that V8's parser internals are constructing a ThisExpression with an invalid receiver, but realistically we can't investigate without a repro.

[MohammadMD1383]

well, I created a repro file.

create a test file and place this inside:

const repro = require('./reproduce-error');

const x = new repro({});
const y = new x({});

y.log();

the contents of reproduce-error.js can be found here: https://gist.github.com/MohammadMD1383/723a723618e33f913aeff9415349468c

---

open webStorm and debug test.js.

inside reproduce-error.js place a breakpoint on this line: https://gist.github.com/MohammadMD1383/723a723618e33f913aeff9415349468c#file-reproduce-error-js-L198

after webstorm stops on breakpoint, around 500 ms later process will crash

---

then comment out this line: https://gist.github.com/MohammadMD1383/723a723618e33f913aeff9415349468c#file-reproduce-error-js-L143

and run and debug again, after breakpoint is hit, the process won't crash anymore ...!

[MohammadMD1383]

@Renegade334

[Renegade334]

Fairly sure that this is a parser/AST bug, which appears to have been introduced by the upgrade to V8 13.9 in Node.js v13.2.0.

var outside;

class C {
  assign() {
    this.p = outside;
    debugger;
  }
}

new C().assign();

'\1';

1. node --inspect-brk index.js
2. Open a debugger (eg. DevTools) and execute to breakpoint
3. Peek the value of this
4. Segfault

The existence of the legacy octal escape sequence somewhere in the script is all that's required.

[Renegade334]

Opened https://issues.chromium.org/issues/487336010.