Found by the package audit (while fixing #10430/#10431) on Perry 7661bc0 (v0.5.1589), Linux x64. An instanceof
check of an EventEmitter instance against the EventEmitter constructor crashes the process with SIGSEGV before any
output is flushed (including earlier console.log lines).
Reproduction
main.ts:
import { EventEmitter } from "node:events";
import EE from "node:events";
const e = new EventEmitter();
console.log("named", e instanceof EventEmitter);
console.log("default", new EE() instanceof EE);
class Sub extends EventEmitter {}
console.log("sub", new Sub() instanceof EventEmitter, new Sub() instanceof Sub);
node main.ts
PERRY_NO_AUTO_OPTIMIZE=1 perry compile main.ts -o main && ./main; echo "rc=$?"
(Also reproduces with default auto-optimize, per the reporter.)
Expected (Node 26.5.1)
named true
default true
sub true true
Actual (Perry)
Segmentation fault (core dumped)
rc=139
Impact
x instanceof EventEmitter is how many libraries detect emitters/streams (ws, socket.io, mqtt, ioredis, pino,
bunyan, util.inherits-based code). Any such check crashes the process.
Notes
Found by the package audit (while fixing #10430/#10431) on Perry 7661bc0 (v0.5.1589), Linux x64. An
instanceofcheck of an
EventEmitterinstance against theEventEmitterconstructor crashes the process with SIGSEGV before anyoutput is flushed (including earlier
console.loglines).Reproduction
main.ts:(Also reproduces with default auto-optimize, per the reporter.)
Expected (Node 26.5.1)
Actual (Perry)
Impact
x instanceof EventEmitteris how many libraries detect emitters/streams (ws, socket.io, mqtt, ioredis, pino,bunyan,
util.inherits-based code). Any such check crashes the process.Notes
x instanceof Csegfaults whenxis a short (1–5 byte) inline string — crashes ajv 8compile()and every fastify route with a schema #10479 (instanceofhelper dereferencing a non-pointer value — here plausibly thenative EventEmitter handle); not confirmed. Worth checking together with that fix.