• Version: 6.4.0 - 8.0.0
• Platform:
• Subsystem:

spawnSync will segfault if called with an object that defines a throwing toString.

Here is a snippet using the high-level child_process API:

const spawn = require('child_process').spawnSync;

const args = [];
const obj = {};
obj.toString = () => {
  throw 'yo';
  // causes ToString on spawn_sync.cc:964 to return empty handle; Set getfaults
    
};
args[0] = obj;
spawn('ls', args);

It may be safer to call toString in JS land before calling into the binding
code.

• @mlfbrown for working on this with me.