Handle exception from target toString in Bun.plugin

[robobun]

When Bun.plugin() is called with a target value whose toString() throws (e.g. an object with a throwing toString, or anything that triggers a stack overflow during string coercion), the pending exception was not checked before proceeding to constructEmptyObject, tripping the assertNoException() assertion in debug builds.

toStringOrNull returns nullptr on exception, which caused the inner if body to be skipped without propagating the error.

Repro

Bun.plugin({
  target: { toString() { throw new Error("boom"); } },
  setup: () => {},
});

Before: ASSERTION FAILED: !exception() in ExceptionScope.h
After: error: boom is thrown as expected.

Found by Fuzzilli (fingerprint 3287a60078202cd7).

[robobun]

^{Updated 1:05 AM PT - May 21st, 2026}

❌ @robobun, your commit 0ac1d3d has 5 failures in Build #56573 (All Failures):

• scripts/build/ci.ts - build failed on 🍎 x64 - build-cpp
• src/bun_core/lib.rs - unnecessary `unsafe` block on 🐧 aarch64-android - build-rust
• src/bun_core/lib.rs - unnecessary `unsafe` block on 🐧 x64-android - build-rust
• src/bun_core/lib.rs - unnecessary `unsafe` block on 🐧 aarch64-musl - build-rust
• src/spawn/process.rs - unused label on :freebsd: x64 - build-rust
• src/install/npm.rs - unused label on :freebsd: x64 - build-rust
• src/spawn/process.rs - unused label on :freebsd: aarch64 - build-rust
• src/install/npm.rs - unused label on :freebsd: aarch64 - build-rust
• src/threading/Futex.rs - unreachable `pub` item on :freebsd: x64 - build-rust
• src/threading/Futex.rs - unreachable `pub` item on :freebsd: x64 - build-rust
• src/threading/Futex.rs - unreachable `pub` item on :freebsd: aarch64 - build-rust
• src/threading/Futex.rs - unreachable `pub` item on :freebsd: aarch64 - build-rust
• linker stderr: clang++: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument] on :freebsd: x64 - build-rust
• linker stderr: clang++: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument] on :freebsd: aarch64 - build-rust
• linker stderr: clang++: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument] on 🐧 aarch64-android - build-rust
• linker stderr: clang++: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument] on 🐧 x64-android - build-rust
• linker stderr: clang++: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument] on 🐧 x64-asan - build-rust
• linker stderr: clang++: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument] on 🐧 aarch64-musl - build-rust

---

🧪   To try this PR locally:

bunx bun-pr 31168

That installs a local version of the PR into your bun-31168 executable, so you can run:

bun-31168 --bun

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: ad6d96fc-25d9-4992-ac1c-0998913ff79f

📥 Commits

Reviewing files that changed from the base of the PR and between 0b20408 and 0ac1d3d.

📒 Files selected for processing (2)

• src/jsc/bindings/BunPlugin.cpp
• test/js/bun/plugin/plugins.test.ts

---

Walkthrough

The PR adds exception handling in the BunPlugin C++ binding when parsing the target property. Two early-return exception checks ensure exceptions during target string conversion are propagated immediately. A test validates that exceptions thrown from a target object's toString() method are correctly handled.

Changes

Plugin target property exception handling

Layer / File(s)	Summary
Exception checks in target parsing and test validation src/jsc/bindings/BunPlugin.cpp, test/js/bun/plugin/plugins.test.ts	Two RETURN_IF_EXCEPTION guards added after target string derivation to stop execution if exceptions occur. A new test case verifies exceptions from target.toString() implementations are propagated correctly by plugin().

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically identifies the main change: handling exceptions from the target toString method in Bun.plugin, which aligns with the changeset.
Description check	✅ Passed	The description provides comprehensive context about the bug, root cause, repro case, and before/after behavior, though it lacks explicit 'How did you verify' section matching the template.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

LGTM — straightforward exception-propagation fix following the standard JSC RETURN_IF_EXCEPTION pattern, with a regression test.

Extended reasoning...

Overview

This PR adds two RETURN_IF_EXCEPTION(throwScope, {}) checks in setupBunPlugin (src/jsc/bindings/BunPlugin.cpp) so that an exception thrown during target string coercion is propagated instead of being silently carried into constructEmptyObject, which trips assertNoException() in debug builds. A matching regression test is added to test/js/bun/plugin/plugins.test.ts.

Security risks

None. This is purely defensive exception-handling on a user-supplied options object; it does not touch auth, crypto, filesystem, or network paths. The only behavioral change is that a pending JS exception is now correctly surfaced instead of asserting (debug) or proceeding with a stale exception (release).

Level of scrutiny

Low. The change is two lines of the canonical RETURN_IF_EXCEPTION macro, identical to dozens of other uses in this same function and file (e.g. after getIfPropertyExists, toWTFString, etc.). The first check after targetJSString->value(globalObject) guards rope-resolution failures; the second, placed after the if (auto* targetJSString = ...) block, covers the primary bug where toStringOrNull returned nullptr due to a thrown exception. Both placements are correct and idiomatic.

Other factors

• Fuzzer-found (Fuzzilli) assertion failure with a clear repro in the PR description.
• Test exercises the exact failure path (target.toString() throws) and asserts the user's error is propagated.
• No CODEOWNERS for this path, no outstanding reviewer comments, and no bugs flagged by the bug-hunting system.

[github-actions]

This PR may be a duplicate of:

1. Fix unchecked exception when Bun.plugin target coercion throws #31017 - Same two-line RETURN_IF_EXCEPTION fix in setupBunPlugin for unchecked exception when Bun.plugin target coercion throws
2. Handle exceptions from toStringOrNull in Bun.plugin target parsing #28369 - Identical RETURN_IF_EXCEPTION guards in setupBunPlugin for toStringOrNull exception handling in Bun.plugin target parsing

🤖 Generated with Claude Code

[robobun]

Duplicate of #31017.