jsc: check for exceptions before using a stored constructEmptyArray result

src/jsc/bindings/BunString.cpp

@@ -919,8 +919,11 @@ extern "C" JSC::EncodedJSValue JSC__JSValue__upsertBunStringArray(
         } else {
             // Create new array with both values
             JSC::JSArray* array = JSC::constructEmptyArray(global, nullptr, 2);
+            RETURN_IF_EXCEPTION(scope, {});
             array->putDirectIndex(global, 0, existingValue);
+            RETURN_IF_EXCEPTION(scope, {});
             array->putDirectIndex(global, 1, newValue);
+            RETURN_IF_EXCEPTION(scope, {});
             target->putDirect(vm, id, array, 0);
         }
     } else {

src/jsc/bindings/ProcessBindingHTTPParser.cpp

@@ -1,16 +1,33 @@
 #include "ProcessBindingHTTPParser.h"
 #include "ZigGlobalObject.h"
+#include "JavaScriptCore/TopExceptionScope.h"
 #include "llhttp/llhttp.h"
 
 namespace Bun {
 
 using namespace JSC;
 
+// Lazy property builder: exceptions must not propagate into
+// reifyStaticProperty, which performs no exception check.
+static JSArray* constructMethodsArray(VM& vm, JSGlobalObject* globalObject, unsigned length)
+{
+    auto scope = DECLARE_TOP_EXCEPTION_SCOPE(vm);
+    JSArray* methods = constructEmptyArray(globalObject, nullptr, length);
+    if (auto* exception = scope.exception()) [[unlikely]] {
+        (void)scope.tryClearException();
+        Zig::GlobalObject::reportUncaughtExceptionAtEventLoop(globalObject, exception);
+        return nullptr;
+    }
+    return methods;
+}
+
 static JSValue ProcessBindingHTTPParser_methods(VM& vm, JSObject* binding)
 {
     JSGlobalObject* globalObject = binding->globalObject();
 
-    JSArray* methods = constructEmptyArray(globalObject, nullptr, 35);
+    JSArray* methods = constructMethodsArray(vm, globalObject, 35);
+    if (!methods) [[unlikely]]
+        return jsUndefined();
 
     int index = 0;
 #define FOR_EACH_METHOD(num, name, string) \
@@ -25,7 +42,9 @@ static JSValue ProcessBindingHTTPParser_allMethods(VM& vm, JSObject* binding)
 {
     JSGlobalObject* globalObject = binding->globalObject();
 
-    JSArray* methods = constructEmptyArray(globalObject, nullptr, 47);
+    JSArray* methods = constructMethodsArray(vm, globalObject, 47);
+    if (!methods) [[unlikely]]
+        return jsUndefined();
 
     int index = 0;
 #define FOR_EACH_METHOD(num, name, string) \

src/jsc/bindings/ProcessBindingUV.cpp

@@ -153,20 +153,30 @@ JSC_DEFINE_HOST_FUNCTION(jsErrname, (JSGlobalObject * globalObject, JSC::CallFra
 JSC_DEFINE_HOST_FUNCTION(jsGetErrorMap, (JSGlobalObject * globalObject, JSC::CallFrame* callFrame))
 {
     auto& vm = JSC::getVM(globalObject);
-    auto map = JSC::JSMap::create(vm, globalObject->mapStructure());
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    auto* map = JSC::JSMap::create(vm, globalObject->mapStructure());
 
-    // Inlining each of these via macros costs like 300 KB.
-    const auto putProperty = [](JSC::VM& vm, JSC::JSMap* map, JSC::JSGlobalObject* globalObject, ASCIILiteral name, int value, ASCIILiteral desc) -> void {
-        auto arr = JSC::constructEmptyArray(globalObject, static_cast<JSC::ArrayAllocationProfile*>(nullptr), 2);
-        // RETURN_IF_EXCEPTION
+    struct Entry {
+        ASCIILiteral name;
+        int value;
+        ASCIILiteral desc;
+    };
+    static constexpr Entry entries[] = {
+#define ENTRY(name, desc) { #name##_s, UV_##name, desc##_s },
+        BUN_UV_ERRNO_MAP(ENTRY)
+#undef ENTRY
+    };
+
+    for (const auto& [name, value, desc] : entries) {
+        auto* arr = JSC::constructEmptyArray(globalObject, static_cast<JSC::ArrayAllocationProfile*>(nullptr), 2);
+        RETURN_IF_EXCEPTION(scope, {});
         arr->putDirectIndex(globalObject, 0, JSC::jsString(vm, String(name)));
+        RETURN_IF_EXCEPTION(scope, {});
         arr->putDirectIndex(globalObject, 1, JSC::jsString(vm, String(desc)));
+        RETURN_IF_EXCEPTION(scope, {});
         map->set(globalObject, JSC::jsNumber(value), arr);
-    };
-
-#define PUT_PROPERTY(name, desc) putProperty(vm, map, globalObject, #name##_s, UV_##name, desc##_s);
-    BUN_UV_ERRNO_MAP(PUT_PROPERTY)
-#undef PUT_PROPERTY
+        RETURN_IF_EXCEPTION(scope, {});
+    }
 
     return JSValue::encode(map);
 }

src/runtime/bake/DevServer.rs

@@ -2685,7 +2685,7 @@ impl DevServer {
         // TODO: lazy structure caching since we are making these objects a lot
         let global = self.vm().global();
         let params_js_value = if self.router.match_slow(pathname, &mut params).is_some() {
-            params.to_js(global)
+            params.to_js(global)?
         } else {
             JSValue::NULL
         };
@@ -6758,7 +6758,7 @@ fn new_route_params_for_bundle_promise(
             route_index.get()
         )));
     }
-    let params_js_value = params.to_js(global);
+    let params_js_value = params.to_js(global)?;
 
     // SAFETY: `dev_ptr` is live; `framework_bundle` points into
     // `(*dev_ptr).route_bundles[route_bundle_index].data` and its reborrow is

src/runtime/bake/FrameworkRouter.rs

@@ -1210,11 +1210,11 @@ impl MatchedParams {
 
     /// Convert the matched params to a JavaScript object
     /// Returns null if there are no params
-    pub fn to_js(&self, global: &JSGlobalObject) -> JSValue {
+    pub fn to_js(&self, global: &JSGlobalObject) -> JsResult<JSValue> {
         let params_array = self.params.const_slice();
 
         if params_array.is_empty() {
-            return JSValue::NULL;
+            return Ok(JSValue::NULL);
         }
 
         // Create a JavaScript object with params
@@ -1223,14 +1223,9 @@ impl MatchedParams {
             let key_str = bun_core::String::clone_utf8(param.key.slice());
             let value_str = bun_core::String::clone_utf8(param.value.slice());
 
-            obj.put_bun_string_one_or_array(
-                global,
-                &key_str,
-                value_str.to_js(global).expect("unreachable"),
-            )
-            .expect("unreachable");
+            obj.put_bun_string_one_or_array(global, &key_str, value_str.to_js(global)?)?;
         }
-        obj
+        Ok(obj)
     }
 }