node:test aborts in InternalCallbackScope::Close after listen EPERM

Version

Reproduced with v24.20.0 and v26.7.0.

Platform

Linux 7.1.9-arch1-2 x86_64, glibc 2.44.

Subsystem

test_runner, async_hooks, platform

What steps will reproduce the bug?

When bind(2) returns EPERM during a node:test test, Node can abort in InternalCallbackScope::Close() instead of reporting the listen error. The larger JS body appears to matter for timing. A much smaller server.listen() test reports listen EPERM normally.

Save this as deny-bind.c:

#define _GNU_SOURCE
#include <errno.h>
#include <sys/socket.h>

int bind(int socket, const struct sockaddr *address, socklen_t address_len) {
  errno = EPERM;
  return -1;
}

Save this as repro.mjs:

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { randomUUID } from 'node:crypto';
import { mkdtemp, readFile, rm } from 'node:fs/promises';
import { join } from 'node:path';
import { tmpdir } from 'node:os';
import { createServer } from 'node:http';
import { spawn } from 'node:child_process';

const sourceId = randomUUID();
const stamp = '2026-08-30T12:00:00.000Z';
const item = { id: randomUUID(), version: 1, title: 'x', description: '', expected: '', steps: '', actual: '', evidence: '', author: '', team: '', area: '', feature: '', pagePath: '/reports', kind: 'issue', impact: 'high', status: 'new', priority: 'unassigned', owner: '', resolution: '', release: 'test', browser: '', viewport: '', createdAt: stamp, updatedAt: stamp, comments: [], history: [] };
const envelope = (changes = [{ sequence: 1, item }], overrides = {}) => ({ schemaVersion: 1, mode: 'changes', sourceId, after: 0, nextCursor: 1, hasMore: false, exportedAt: stamp, changes, ...overrides });

function run(args, token = 'test-key'.padEnd(40, 'x')) {
  return new Promise((resolve) => {
    const child = spawn(process.execPath, ['-e', 'process.exit(0)', ...args], {
      env: { ...process.env, FEEDBACK_SYNC_TOKEN: token, FEEDBACK_REMOTE_URL: '' },
    });
    let output = '';
    child.stdout.on('data', (b) => { output += b; });
    child.stderr.on('data', (b) => { output += b; });
    child.on('close', (code) => resolve({ code, output }));
  });
}

test('reproducer', async () => {
  const directory = await mkdtemp(join(tmpdir(), 'feedback-cli-'));
  let failSecond = true;
  let redirect = false;
  const server = createServer((request, response) => {
    if (redirect) { response.writeHead(302, { location: 'https://example.com' }); response.end(); return; }
    const after = Number(new URL(request.url, 'http://localhost').searchParams.get('after'));
    if (after === 1 && failSecond) { response.writeHead(503); response.end(); return; }
    response.setHeader('content-type', 'application/json');
    response.end(JSON.stringify(after === 0 ? envelope(undefined, { hasMore: true }) : after === 1 ? envelope([{ sequence: 2, item: { ...item, version: 2, status: 'planned' } }], { after: 1, nextCursor: 2 }) : envelope([], { after: 2, nextCursor: 2 })));
  });
  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
  const url = `http://127.0.0.1:${server.address().port}`;
  const args = ['--url', url, '--allow-http', '--out', directory];
  try {
    assert.equal((await run(['--url', url, '--out', directory])).code, 1);
    assert.equal((await run(args)).code, 1);
    assert.equal(JSON.parse(await readFile(join(directory, 'feedback.json'))).cursor, 1);
    failSecond = false;
    assert.equal((await run(args)).code, 0);
    assert.equal((await run(args)).code, 0);
    redirect = true;
    assert.equal((await run(args)).code, 1);
  } finally {
    await new Promise((resolve) => server.close(resolve));
    await rm(directory, { recursive: true, force: true });
  }
});

Compile the interceptor and run the test:

cc -shared -fPIC -o deny-bind.so deny-bind.c
LD_PRELOAD="$PWD/deny-bind.so" node --test --test-isolation=none repro.mjs

This reproduced on every attempted run with both listed Node versions. It also occurs with the default process isolation, where the test child aborts and the parent reports a failed test.

How often does it reproduce? Is there a required condition?

Every run with the reproducer above on this machine. bind() must fail with EPERM. The original occurrence was inside a restricted environment where loopback binding was denied. When binding is permitted, the same test passes.

What is the expected behavior? Why is that the expected behavior?

The test runner should report Error: listen EPERM: operation not permitted 127.0.0.1 and exit with a normal test failure. A smaller server.listen() test under the same interceptor already behaves this way.

What do you see instead?

The process aborts with exit status 134:

Assertion failed: (env_->execution_async_id()) == (0)

1: node::Assert(node::AssertionInfo const&)
2: node::InternalCallbackScope::Close()
3: node::InternalCallbackScope::~InternalCallbackScope()
4: node::PerIsolatePlatformData::RunForegroundTask(...)
5: node::PerIsolatePlatformData::FlushForegroundTasksInternal()
6: uv_run
7: node::SpinEventLoopInternal(node::Environment*)
8: node::NodeMainInstance::Run()
9: node::Start(int, char**)

On v24.20.0 the assertion is at src/api/callback.cc:165; on v26.7.0 it is at line 185.

Additional information

This may be related to #38155, but that older case involved async-hook-domain monkey-patching. This reproducer uses only built-in Node modules and the test runner.

No core dump is attached because cores may contain private process memory.

提供されている deny-bind.c と repro.mjs の reproducer を LD_PRELOAD で実行し、その後 src/api/callback.cc の InternalCallbackScope::Close() 付近から調査を始めます。失敗する node:test の経路と、より小さい server.listen() の挙動を比較します。listen の EPERM エラーが通常のテスト失敗として報告され、exit-status-134 の abort が発生しなければ完了です。