v8: Node 26.9.0 crashes with `Check failed: new_capacity > 0.` when `Error.stackTraceLimit` is set above 357913941 with `--trace-uncaught`

Version

v26.9.0

Platform

Darwin 25.6.0 Darwin Kernel Version 25.6.0: Fri Jul 31 19:18:53 PDT 2026; root:xnu-12377.161.14~5/RELEASE_ARM64_T6031 arm64 arm Darwin

Subsystem

v8

What steps will reproduce the bug?

node --trace-uncaught -e 'Error.stackTraceLimit=Infinity; Error()'

How often does it reproduce? Is there a required condition?

Every time

What is the expected behavior? Why is that the expected behavior?

No crash

What do you see instead?

#
# Fatal error in , line 0
# Check failed: new_capacity > 0.
#
#
#
#FailureMessage Object: 0x16b45a7a8
----- Native stack trace -----

 1: 0x104b48804 node::NodePlatform::GetStackTracePrinter()::$_0::__invoke() [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
 2: 0x1066bf2bc V8_Fatal(char const*, ...) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
 3: 0x1070c9f84 v8::internal::Handle<v8::internal::FixedArray> v8::internal::FixedArray::RightTrimOrEmpty<v8::internal::Handle>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::FixedArray>, unsigned int) (.cold.2) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
 4: 0x1051d4884 v8::internal::Handle<v8::internal::FixedArray> v8::internal::FixedArray::RightTrimOrEmpty<v8::internal::Handle>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::FixedArray>, unsigned int) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
 5: 0x104ea831c v8::internal::Isolate::CaptureAndSetErrorStack(v8::internal::DirectHandle<v8::internal::JSObject>, v8::internal::FrameSkipMode, v8::internal::Handle<v8::internal::Object>) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
 6: 0x104ec5510 v8::internal::ErrorUtils::Construct(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::FrameSkipMode, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::ErrorUtils::StackTraceCollection) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
 7: 0x104d7d074 v8::internal::Builtin_ErrorConstructor(int, unsigned long*, v8::internal::Isolate*) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
 8: 0x105a8cbec Builtins_CEntry_Return1_ArgvOnStack_BuiltinExit [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
 9: 0x1059e9424 Builtins_InterpreterEntryTrampoline [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
10: 0x1059e6788 Builtins_JSEntryTrampoline [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
11: 0x1059e6478 Builtins_JSEntry [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
12: 0x104e97970 v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
13: 0x104e97e54 v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
14: 0x104d1bb78 v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
15: 0x104aa57b0 node::contextify::ContextifyScript::EvalMachine(v8::Local<v8::Context>, node::Environment*, long long, bool, bool, bool, v8::MicrotaskQueue*, v8::FunctionCallbackInfo<v8::Value> const&) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
16: 0x106fb1230 node::contextify::ContextifyScript::RunInContext(v8::FunctionCallbackInfo<v8::Value> const&) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
17: 0x1059eb20c Builtins_CallApiCallbackGeneric [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
18: 0x1059e9424 Builtins_InterpreterEntryTrampoline [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
19: 0x1059e9424 Builtins_InterpreterEntryTrampoline [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
20: 0x1059e9424 Builtins_InterpreterEntryTrampoline [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
21: 0x1059e9424 Builtins_InterpreterEntryTrampoline [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
22: 0x1059e9424 Builtins_InterpreterEntryTrampoline [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
23: 0x1059e9424 Builtins_InterpreterEntryTrampoline [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
24: 0x1059e9424 Builtins_InterpreterEntryTrampoline [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
25: 0x1059e6788 Builtins_JSEntryTrampoline [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
26: 0x1059e6478 Builtins_JSEntry [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
27: 0x104e97970 v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
28: 0x104e97344 v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
29: 0x104d27794 v8::Function::Call(v8::Isolate*, v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
30: 0x104a8e334 node::builtins::BuiltinLoader::CompileAndCall(v8::Local<v8::Context>, char const*, node::Realm*) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
31: 0x106fe6db8 node::Realm::ExecuteBootstrapper(char const*) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
32: 0x106f9ee04 node::StartExecution(node::Environment*, char const*) (.cold.1) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
33: 0x104a6edc0 node::StartExecution(node::Environment*, char const*) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
34: 0x104a6ed38 node::StartExecution(node::Environment*, std::__1::function<v8::MaybeLocal<v8::Value> (node::StartExecutionCallbackInfoWithModule const&)>) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
35: 0x1049b59d0 node::LoadEnvironment(node::Environment*, std::__1::function<v8::MaybeLocal<v8::Value> (node::StartExecutionCallbackInfoWithModule const&)>, std::__1::function<void (node::Environment*, v8::Local<v8::Value>, v8::Local<v8::Value>)>) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
36: 0x106fdb5b8 node::NodeMainInstance::Run() (.cold.1) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
37: 0x104b03a5c node::NodeMainInstance::Run() [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
38: 0x104a732b4 node::Start(int, char**) [/Users/silverwind/.local/share/nodejs/v26.9.0/bin/node]
39: 0x18f5a04e4 start [/usr/lib/dyld]
[1]    45370 trace trap  node -e 'Error.stackTraceLimit=Infinity; Error()'

Additional information

Any stack trace limit above 357913941 (2^32 / 12) triggers the crash. v26.8.2 does not crash. Requires --trace-uncaught to crash.

Likely culprit is https://github.com/nodejs/node/pull/65764
Popular module triggering the crash: https://github.com/wooorm/import-meta-resolve/blob/4.2.0/lib/errors.js#L427-L436

在 Node v26.9.0 和 v26.8.2 上运行报告中的命令，然后检查 nodejs/node#65764 以及 FixedArray::RightTrimOrEmpty 和 CaptureAndSetErrorStack 对应的 V8 栈条目。使用 import-meta-resolve 的 lib/errors.js 第 427-436 行作为应用程序触发点；当 Error.stackTraceLimit 超过 357913941 时，reproducer 在使用 --trace-uncaught 的情况下不再崩溃，即表示完成。