util: limit inspection output size to 128 MB by BridgeAR · Pull Request #22756 · nodejs/node

vsemozhetbyt

The maximum hard limit that `util.inspect()` could theoretically handle
is the maximum string size. That is ~2 ** 28 on 32 bit systems and
~2 ** 30 on 64 bit systems.

Due to the recursive algorithm a complex object could easily exceed
that limit without throwing an error right away and therefore
crashing the application by exceeding the heap limit.

`util.inspect()` is fast enough to compute 128 MB of data below one
second on an Intel(R) Core(TM) i7-5600U CPU. This hard limit allows
to inspect arbitrary big objects from now on without crashing the
application or blocking the event loop significantly.

@BridgeAR

@BridgeAR BridgeAR added the semver-major

PRs that contain breaking changes and should be released in the next major version.

label

Sep 10, 2018

@BridgeAR BridgeAR requested review from a team and removed request for a team

September 10, 2018 07:49

mcollina

@BridgeAR

@BridgeAR BridgeAR added the author ready

PRs that have at least one approval, no pending requests for changes, and a CI started.

label

Sep 11, 2018

vsemozhetbyt

vsemozhetbyt

@BridgeAR

addaleax

addaleax

jdalton

jdalton

@BridgeAR

BridgeAR added a commit to BridgeAR/node that referenced this pull request

Sep 13, 2018
The maximum hard limit that `util.inspect()` could theoretically handle
is the maximum string size. That is ~2 ** 28 on 32 bit systems and
~2 ** 30 on 64 bit systems.

Due to the recursive algorithm a complex object could easily exceed
that limit without throwing an error right away and therefore
crashing the application by exceeding the heap limit.

`util.inspect()` is fast enough to compute 128 MB of data below one
second on an Intel(R) Core(TM) i7-5600U CPU. This hard limit allows
to inspect arbitrary big objects from now on without crashing the
application or blocking the event loop significantly.

PR-URL: nodejs#22756
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: John-David Dalton <john.david.dalton@gmail.com>

jasnell added a commit that referenced this pull request

Oct 2, 2018
Notable changes:

* Build
  * FreeBSD 10 is no longer supported. [#22617](#22617)
* `child_process`
  * The default value of the `windowsHide` option has been changed to `true`. [#21316](#21316)
* `console`
  * `console.countReset()` will emit a warning if the timer being reset does not exist. [#21649](#21649)
  * `console.time()` will no longer reset a timer if it already exists. [#20442](#20442)
* `crypto`
  * PEM-level encryption is now supported. [#23151](#23151)
  * An API for key pair generation has been added. [#22660](#22660)
* Dependencies
  * V8 has been updated to 7.0. [#22754](#22754)
* `fs`
  * The `fs.read()` method now requires a callback. [#22146](#22146)
  * The previously deprecated `fs.SyncWriteStream` utility has been removed.[#20735](#20735)
* `http`
  * The `http`, `https`, and `tls` modules now use the WHATWG URL parser by default. [#20270](#20270)
* `http2`
  * An event will be emitted when a `PING` frame is received. [#23009](#23009)
  * Support for the `ORIGIN` frame has been added. [#22956](#22956)
* General
  * Use of `process.binding()` has been deprecated. Userland code using `process.binding()` should re-evaluate that use and begin migrating.
  * An experimental implementation of `queueMicrotask()` has been added. [#22951](#22951)
* Internal
  * Windows performance-counter support has been removed. [#22485](#22485)
  * The `--expose-http2` command-line option has been removed. [#20887](#20887)
* Promises
  * A new `multipleResolves` event will be emitted when a Promise is resolved (or rejected) more than once. [#22218](#22218)
* Timers
  * Interval timers will be rescheduled even if previous interval threw an error. [#20002](#20002)
* `util`
  * The WHATWG `TextEncoder` and `TextDecoder` are now globals. [#22281](#22281)
  * `util.inspect()` output size is limited to 128 MB by default. [#22756](#22756)
  * A runtime warning will be emitted when `NODE_DEBUG` is set for either `http` or `http2`. [#21914](#21914)

jasnell added a commit that referenced this pull request

Oct 17, 2018
Notable changes:

* Build
  * FreeBSD 10 is no longer supported.[#22617](#22617)
* `child_process`
  * The default value of the `windowsHide` option has been changed
    to `true`. [#21316](#21316)
* `console`
  * `console.countReset()` will emit a warning if the timer
    being reset does not exist. [#21649](#21649)
  * `console.time()` will no longer reset a timer if it already
    exists. [#20442](#20442)
* Dependencies
  * V8 has been updated to 7.0.
    [#22754](#22754)
* `fs`
  * The `fs.read()` method now requires a callback.
    [#22146](#22146)
  * The previously deprecated `fs.SyncWriteStream` utility has been
    removed.[#20735](#20735)
* `http`
  * The `http`, `https`, and `tls` modules now use the WHATWG URL parser
    by default. [#20270](#20270)
* General
  * Use of `process.binding()` has been deprecated. Userland code using
    `process.binding()` should re-evaluate that use and begin migrating. If
    there are no supported API alternatives, please open an issue in the
    Node.js GitHub repository so that a suitable alternative may be discussed.
  * An experimental implementation of `queueMicrotask()` has been added.
    [#22951](#22951)
* Internal
  * Windows performance-counter support has been removed.
    [#22485](#22485)
  * The `--expose-http2` command-line option has been removed.
    [#20887](#20887)
* Timers
  * Interval timers will be rescheduled even if previous interval threw
    an error. [#20002](#20002)
* `util`
  * The WHATWG `TextEncoder` and `TextDecoder` are now globals.
    [#22281](#22281)
  * `util.inspect()` output size is limited to 128 MB by default.
    [#22756](#22756)
  * A runtime warning will be emitted when `NODE_DEBUG` is set for
    either `http` or `http2`. [#21914](#21914)

jasnell added a commit that referenced this pull request

Oct 17, 2018
Notable changes:

* Build
  * FreeBSD 10 is no longer supported.[#22617](#22617)
* `child_process`
  * The default value of the `windowsHide` option has been changed
    to `true`. [#21316](#21316)
* `console`
  * `console.countReset()` will emit a warning if the timer
    being reset does not exist. [#21649](#21649)
  * `console.time()` will no longer reset a timer if it already
    exists. [#20442](#20442)
* Dependencies
  * V8 has been updated to 7.0.
    [#22754](#22754)
* `fs`
  * The `fs.read()` method now requires a callback.
    [#22146](#22146)
  * The previously deprecated `fs.SyncWriteStream` utility has been
    removed.[#20735](#20735)
* `http`
  * The `http`, `https`, and `tls` modules now use the WHATWG URL parser
    by default. [#20270](#20270)
* General
  * Use of `process.binding()` has been deprecated. Userland code using
    `process.binding()` should re-evaluate that use and begin migrating. If
    there are no supported API alternatives, please open an issue in the
    Node.js GitHub repository so that a suitable alternative may be discussed.
  * An experimental implementation of `queueMicrotask()` has been added.
    [#22951](#22951)
* Internal
  * Windows performance-counter support has been removed.
    [#22485](#22485)
  * The `--expose-http2` command-line option has been removed.
    [#20887](#20887)
* Timers
  * Interval timers will be rescheduled even if previous interval threw
    an error. [#20002](#20002)
* `util`
  * The WHATWG `TextEncoder` and `TextDecoder` are now globals.
    [#22281](#22281)
  * `util.inspect()` output size is limited to 128 MB by default.
    [#22756](#22756)
  * A runtime warning will be emitted when `NODE_DEBUG` is set for
    either `http` or `http2`. [#21914](#21914)

jasnell added a commit that referenced this pull request

Oct 21, 2018
Notable changes:

* Build
  * FreeBSD 10 is no longer supported.[#22617](#22617)
* `child_process`
  * The default value of the `windowsHide` option has been changed
    to `true`. [#21316](#21316)
* `console`
  * `console.countReset()` will emit a warning if the timer
    being reset does not exist. [#21649](#21649)
  * `console.time()` will no longer reset a timer if it already
    exists. [#20442](#20442)
* Dependencies
  * V8 has been updated to 7.0.
    [#22754](#22754)
* `fs`
  * The `fs.read()` method now requires a callback.
    [#22146](#22146)
  * The previously deprecated `fs.SyncWriteStream` utility has been
    removed.[#20735](#20735)
* `http`
  * The `http`, `https`, and `tls` modules now use the WHATWG URL parser
    by default. [#20270](#20270)
* General
  * Use of `process.binding()` has been deprecated. Userland code using
    `process.binding()` should re-evaluate that use and begin migrating. If
    there are no supported API alternatives, please open an issue in the
    Node.js GitHub repository so that a suitable alternative may be discussed.
  * An experimental implementation of `queueMicrotask()` has been added.
    [#22951](#22951)
* Internal
  * Windows performance-counter support has been removed.
    [#22485](#22485)
  * The `--expose-http2` command-line option has been removed.
    [#20887](#20887)
* Timers
  * Interval timers will be rescheduled even if previous interval threw
    an error. [#20002](#20002)
* `util`
  * The WHATWG `TextEncoder` and `TextDecoder` are now globals.
    [#22281](#22281)
  * `util.inspect()` output size is limited to 128 MB by default.
    [#22756](#22756)
  * A runtime warning will be emitted when `NODE_DEBUG` is set for
    either `http` or `http2`. [#21914](#21914)

jasnell added a commit that referenced this pull request

Oct 22, 2018
Notable changes:

* Build
  * FreeBSD 10 is no longer supported.[#22617](#22617)
* `child_process`
  * The default value of the `windowsHide` option has been changed
    to `true`. [#21316](#21316)
* `console`
  * `console.countReset()` will emit a warning if the timer
    being reset does not exist. [#21649](#21649)
  * `console.time()` will no longer reset a timer if it already
    exists. [#20442](#20442)
* Dependencies
  * V8 has been updated to 7.0.
    [#22754](#22754)
* `fs`
  * The `fs.read()` method now requires a callback.
    [#22146](#22146)
  * The previously deprecated `fs.SyncWriteStream` utility has been
    removed.[#20735](#20735)
* `http`
  * The `http`, `https`, and `tls` modules now use the WHATWG URL parser
    by default. [#20270](#20270)
* General
  * Use of `process.binding()` has been deprecated. Userland code using
    `process.binding()` should re-evaluate that use and begin migrating. If
    there are no supported API alternatives, please open an issue in the
    Node.js GitHub repository so that a suitable alternative may be discussed.
  * An experimental implementation of `queueMicrotask()` has been added.
    [#22951](#22951)
* Internal
  * Windows performance-counter support has been removed.
    [#22485](#22485)
  * The `--expose-http2` command-line option has been removed.
    [#20887](#20887)
* Timers
  * Interval timers will be rescheduled even if previous interval threw
    an error. [#20002](#20002)
* `util`
  * The WHATWG `TextEncoder` and `TextDecoder` are now globals.
    [#22281](#22281)
  * `util.inspect()` output size is limited to 128 MB by default.
    [#22756](#22756)
  * A runtime warning will be emitted when `NODE_DEBUG` is set for
    either `http` or `http2`. [#21914](#21914)

devsnek pushed a commit to devsnek/node that referenced this pull request

Oct 23, 2018
Notable changes:

* Build
  * FreeBSD 10 is no longer supported.[nodejs#22617](nodejs#22617)
* `child_process`
  * The default value of the `windowsHide` option has been changed
    to `true`. [nodejs#21316](nodejs#21316)
* `console`
  * `console.countReset()` will emit a warning if the timer
    being reset does not exist. [nodejs#21649](nodejs#21649)
  * `console.time()` will no longer reset a timer if it already
    exists. [nodejs#20442](nodejs#20442)
* Dependencies
  * V8 has been updated to 7.0.
    [nodejs#22754](nodejs#22754)
* `fs`
  * The `fs.read()` method now requires a callback.
    [nodejs#22146](nodejs#22146)
  * The previously deprecated `fs.SyncWriteStream` utility has been
    removed.[nodejs#20735](nodejs#20735)
* `http`
  * The `http`, `https`, and `tls` modules now use the WHATWG URL parser
    by default. [nodejs#20270](nodejs#20270)
* General
  * Use of `process.binding()` has been deprecated. Userland code using
    `process.binding()` should re-evaluate that use and begin migrating. If
    there are no supported API alternatives, please open an issue in the
    Node.js GitHub repository so that a suitable alternative may be discussed.
  * An experimental implementation of `queueMicrotask()` has been added.
    [nodejs#22951](nodejs#22951)
* Internal
  * Windows performance-counter support has been removed.
    [nodejs#22485](nodejs#22485)
  * The `--expose-http2` command-line option has been removed.
    [nodejs#20887](nodejs#20887)
* Timers
  * Interval timers will be rescheduled even if previous interval threw
    an error. [nodejs#20002](nodejs#20002)
* `util`
  * The WHATWG `TextEncoder` and `TextDecoder` are now globals.
    [nodejs#22281](nodejs#22281)
  * `util.inspect()` output size is limited to 128 MB by default.
    [nodejs#22756](nodejs#22756)
  * A runtime warning will be emitted when `NODE_DEBUG` is set for
    either `http` or `http2`. [nodejs#21914](nodejs#21914)

deepak1556 pushed a commit to electron/node that referenced this pull request

Dec 10, 2018
Notable changes:

* Build
  * FreeBSD 10 is no longer supported.[#22617](nodejs/node#22617)
* `child_process`
  * The default value of the `windowsHide` option has been changed
    to `true`. [#21316](nodejs/node#21316)
* `console`
  * `console.countReset()` will emit a warning if the timer
    being reset does not exist. [#21649](nodejs/node#21649)
  * `console.time()` will no longer reset a timer if it already
    exists. [#20442](nodejs/node#20442)
* Dependencies
  * V8 has been updated to 7.0.
    [#22754](nodejs/node#22754)
* `fs`
  * The `fs.read()` method now requires a callback.
    [#22146](nodejs/node#22146)
  * The previously deprecated `fs.SyncWriteStream` utility has been
    removed.[#20735](nodejs/node#20735)
* `http`
  * The `http`, `https`, and `tls` modules now use the WHATWG URL parser
    by default. [#20270](nodejs/node#20270)
* General
  * Use of `process.binding()` has been deprecated. Userland code using
    `process.binding()` should re-evaluate that use and begin migrating. If
    there are no supported API alternatives, please open an issue in the
    Node.js GitHub repository so that a suitable alternative may be discussed.
  * An experimental implementation of `queueMicrotask()` has been added.
    [#22951](nodejs/node#22951)
* Internal
  * Windows performance-counter support has been removed.
    [#22485](nodejs/node#22485)
  * The `--expose-http2` command-line option has been removed.
    [#20887](nodejs/node#20887)
* Timers
  * Interval timers will be rescheduled even if previous interval threw
    an error. [#20002](nodejs/node#20002)
* `util`
  * The WHATWG `TextEncoder` and `TextDecoder` are now globals.
    [#22281](nodejs/node#22281)
  * `util.inspect()` output size is limited to 128 MB by default.
    [#22756](nodejs/node#22756)
  * A runtime warning will be emitted when `NODE_DEBUG` is set for
    either `http` or `http2`. [#21914](nodejs/node#21914)

deepak1556 pushed a commit to electron/node that referenced this pull request

Dec 19, 2018
Notable changes:

* Build
  * FreeBSD 10 is no longer supported.[#22617](nodejs/node#22617)
* `child_process`
  * The default value of the `windowsHide` option has been changed
    to `true`. [#21316](nodejs/node#21316)
* `console`
  * `console.countReset()` will emit a warning if the timer
    being reset does not exist. [#21649](nodejs/node#21649)
  * `console.time()` will no longer reset a timer if it already
    exists. [#20442](nodejs/node#20442)
* Dependencies
  * V8 has been updated to 7.0.
    [#22754](nodejs/node#22754)
* `fs`
  * The `fs.read()` method now requires a callback.
    [#22146](nodejs/node#22146)
  * The previously deprecated `fs.SyncWriteStream` utility has been
    removed.[#20735](nodejs/node#20735)
* `http`
  * The `http`, `https`, and `tls` modules now use the WHATWG URL parser
    by default. [#20270](nodejs/node#20270)
* General
  * Use of `process.binding()` has been deprecated. Userland code using
    `process.binding()` should re-evaluate that use and begin migrating. If
    there are no supported API alternatives, please open an issue in the
    Node.js GitHub repository so that a suitable alternative may be discussed.
  * An experimental implementation of `queueMicrotask()` has been added.
    [#22951](nodejs/node#22951)
* Internal
  * Windows performance-counter support has been removed.
    [#22485](nodejs/node#22485)
  * The `--expose-http2` command-line option has been removed.
    [#20887](nodejs/node#20887)
* Timers
  * Interval timers will be rescheduled even if previous interval threw
    an error. [#20002](nodejs/node#20002)
* `util`
  * The WHATWG `TextEncoder` and `TextDecoder` are now globals.
    [#22281](nodejs/node#22281)
  * `util.inspect()` output size is limited to 128 MB by default.
    [#22756](nodejs/node#22756)
  * A runtime warning will be emitted when `NODE_DEBUG` is set for
    either `http` or `http2`. [#21914](nodejs/node#21914)