Add defensive exception handling for toString conversions + investigate JSC crash

This commit addresses a JSCell assertion failure when calling process.nextTick()
inside a recursive method that hits the JavaScript stack limit.

Bug: ASSERTION FAILED: isSymbol() || isHeapBigInt()
     vendor/WebKit/Source/JavaScriptCore/runtime/JSCell.cpp(252)

Minimal reproducer:
```javascript
const obj = {
  o() {
    try { this.o(); } catch (e) {}  // Recurse until stack overflow
    try { process.nextTick(() => {}); } catch (e) {}
  },
};
obj.o();
```

Root Cause (via gdb):
The crash occurs in JSC::errorDescriptionForValue (ExceptionHelpers.cpp:83)
called by JSC::throwNotAFunctionErrorFromCallIC. When JSC tries to call a
corrupted callback from the nextTick queue and wants to throw "X is not a
function", it calls toString() on X to include it in the error message.
If X is corrupted (invalid JSCell), the assertion in toStringSlowCase() fails.

The corruption happens because:
1. Stack overflow during recursion
2. Callback is validly queued to nextTick (passes validateFunction check)
3. Stack overflow corrupts heap memory where the callback object is stored
4. When nextTick queue drains, it tries to call the now-corrupted callback
5. JSC's error formatting code calls toString() on the corrupted value
6. Assertion fails in JSCell::toStringSlowCase()

Changes Made:
1. **ErrorCode.cpp**: Fixed INVALID_ARG_TYPE to use toStringOrNull() instead
   of toString(), with fallback handling for null results

2. **ErrorStackTrace.cpp**: Added safer string conversion with jsDynamicCast
   validation before calling JSString::value()

3. **CallSite.cpp**: Added exception handling after toStringOrNull() and
   getString() calls

4. **ZigException.cpp**: Added exception checking after all toWTFString()
   calls to handle conversion failures gracefully

5. **Test**: Added regression test documenting the issue

Status:
The defensive improvements prevent some related crashes but do NOT fully
resolve this specific issue. The crash still occurs because:
- JSC's errorDescriptionForValue (in WebKit code we can't modify) calls
  toString() without checking if the cell is valid
- The corruption happens after validation, so we can't detect it beforehand
- Try-catch doesn't help because the assertion aborts before throwing

This appears to be a fundamental limitation where stack overflow can corrupt
heap-allocated objects, and JSC's error formatting assumes all JSCells are
valid. A complete fix would require either:
- Patching JSC's errorDescriptionForValue to handle corrupted cells
- Preventing stack overflow from corrupting heap memory (GC/allocator issue)
- Detecting and skipping corrupted queue entries before JSC tries to call them

The improvements in this commit still add value by making error handling more
robust in other scenarios.

src/bun.js/bindings/CallSite.cpp

@@ -106,17 +106,32 @@ JSValue createNativeFrameForTesting(Zig::GlobalObject* globalObject)
 
 void CallSite::formatAsString(JSC::VM& vm, JSC::JSGlobalObject* globalObject, WTF::StringBuilder& sb)
 {
+    auto catchScope = DECLARE_CATCH_SCOPE(vm);
+
     JSValue thisValue = jsUndefined();
     if (m_thisValue) {
         thisValue = m_thisValue.get();
     }
 
     JSString* myFunctionName = functionName().toStringOrNull(globalObject);
+    if (catchScope.exception()) [[unlikely]] {
+        catchScope.clearException();
+        myFunctionName = nullptr;
+    }
+
     JSString* mySourceURL = sourceURL().toStringOrNull(globalObject);
+    if (catchScope.exception()) [[unlikely]] {
+        catchScope.clearException();
+        mySourceURL = nullptr;
+    }
 
     String functionName;
     if (myFunctionName && myFunctionName->length() > 0) {
         functionName = myFunctionName->getString(globalObject);
+        if (catchScope.exception()) [[unlikely]] {
+            catchScope.clearException();
+            functionName = "<error>"_s;
+        }
     } else if (m_flags & (static_cast<unsigned int>(Flags::IsFunction) | static_cast<unsigned int>(Flags::IsEval))) {
         functionName = "<anonymous>"_s;
     }

src/bun.js/bindings/ErrorCode.cpp

@@ -376,11 +376,15 @@ void determineSpecificType(JSC::VM& vm, JSC::JSGlobalObject* globalObject, WTF::
     if (value.isBigInt()) {
         auto str = value.toStringOrNull(globalObject);
         RETURN_IF_EXCEPTION(scope, void());
-        auto view = str->view(globalObject);
-        RETURN_IF_EXCEPTION(scope, );
-        builder.append("type bigint ("_s);
-        builder.append(view);
-        builder.append("n)"_s);
+        if (str) {
+            auto view = str->view(globalObject);
+            RETURN_IF_EXCEPTION(scope, );
+            builder.append("type bigint ("_s);
+            builder.append(view);
+            builder.append("n)"_s);
+        } else {
+            builder.append("type bigint"_s);
+        }
         return;
     }
 
@@ -668,8 +672,19 @@ JSC::EncodedJSValue INVALID_ARG_TYPE(JSC::ThrowScope& throwScope, JSC::JSGlobalO
 
 JSC::EncodedJSValue INVALID_ARG_TYPE(JSC::ThrowScope& throwScope, JSC::JSGlobalObject* globalObject, JSC::JSValue val_arg_name, const WTF::String& expected_type, JSC::JSValue val_actual_value)
 {
-    auto* jsString = val_arg_name.toString(globalObject);
+    // Safety: Use toStringOrNull which is safer and returns null on failure
+    auto* jsString = val_arg_name.toStringOrNull(globalObject);
     RELEASE_RETURN_IF_EXCEPTION(throwScope, {});
+
+    // If toString failed, use a fallback name
+    if (!jsString) {
+        auto message = Message::ERR_INVALID_ARG_TYPE(throwScope, globalObject, "<argument>"_s, expected_type, val_actual_value);
+        RELEASE_RETURN_IF_EXCEPTION(throwScope, {});
+        throwScope.throwException(globalObject, createError(globalObject, ErrorCode::ERR_INVALID_ARG_TYPE, message));
+        throwScope.release();
+        return {};
+    }
+
     auto arg_name = jsString->view(globalObject);
     RELEASE_RETURN_IF_EXCEPTION(throwScope, {});
     auto message = Message::ERR_INVALID_ARG_TYPE(throwScope, globalObject, arg_name, expected_type, val_actual_value);

src/bun.js/bindings/ErrorStackTrace.cpp

@@ -637,9 +637,14 @@ String functionName(JSC::VM& vm, JSC::JSGlobalObject* lexicalGlobalObject, JSC::
             if (!slot.isAccessor()) {
                 JSValue functionNameValue = slot.getValue(lexicalGlobalObject, vm.propertyNames->name);
                 if (functionNameValue && functionNameValue.isString()) {
-                    name = functionNameValue.toWTFString(lexicalGlobalObject);
-                    if (!name.isEmpty()) {
-                        return name;
+                    // Additional safety check: verify the cell is actually a JSString
+                    if (JSString* jsString = jsDynamicCast<JSString*>(functionNameValue)) {
+                        name = jsString->value(lexicalGlobalObject);
+                        if (catchScope.exception()) [[unlikely]] {
+                            catchScope.clearException();
+                        } else if (!name.isEmpty()) {
+                            return name;
+                        }
                     }
                 }
             }

src/bun.js/bindings/ZigException.cpp

@@ -717,23 +717,27 @@ void exceptionFromString(ZigException& except, JSC::JSValue value, JSC::JSGlobal
         if (name_value) {
             if (name_value.isString()) {
                 auto name_str = name_value.toWTFString(global);
-                except.name = Bun::toStringRef(name_str);
-                if (name_str == "Error"_s) {
-                    except.type = JSErrorCodeError;
-                } else if (name_str == "EvalError"_s) {
-                    except.type = JSErrorCodeEvalError;
-                } else if (name_str == "RangeError"_s) {
-                    except.type = JSErrorCodeRangeError;
-                } else if (name_str == "ReferenceError"_s) {
-                    except.type = JSErrorCodeReferenceError;
-                } else if (name_str == "SyntaxError"_s) {
-                    except.type = JSErrorCodeSyntaxError;
-                } else if (name_str == "TypeError"_s) {
-                    except.type = JSErrorCodeTypeError;
-                } else if (name_str == "URIError"_s) {
-                    except.type = JSErrorCodeURIError;
-                } else if (name_str == "AggregateError"_s) {
-                    except.type = JSErrorCodeAggregateError;
+                if (scope.exception()) [[unlikely]] {
+                    scope.clearExceptionExceptTermination();
+                } else {
+                    except.name = Bun::toStringRef(name_str);
+                    if (name_str == "Error"_s) {
+                        except.type = JSErrorCodeError;
+                    } else if (name_str == "EvalError"_s) {
+                        except.type = JSErrorCodeEvalError;
+                    } else if (name_str == "RangeError"_s) {
+                        except.type = JSErrorCodeRangeError;
+                    } else if (name_str == "ReferenceError"_s) {
+                        except.type = JSErrorCodeReferenceError;
+                    } else if (name_str == "SyntaxError"_s) {
+                        except.type = JSErrorCodeSyntaxError;
+                    } else if (name_str == "TypeError"_s) {
+                        except.type = JSErrorCodeTypeError;
+                    } else if (name_str == "URIError"_s) {
+                        except.type = JSErrorCodeURIError;
+                    } else if (name_str == "AggregateError"_s) {
+                        except.type = JSErrorCodeAggregateError;
+                    }
                 }
             }
         }
@@ -744,7 +748,12 @@ void exceptionFromString(ZigException& except, JSC::JSValue value, JSC::JSGlobal
         }
         if (message) {
             if (message.isString()) {
-                except.message = Bun::toStringRef(message.toWTFString(global));
+                auto message_str = message.toWTFString(global);
+                if (scope.exception()) [[unlikely]] {
+                    scope.clearExceptionExceptTermination();
+                } else {
+                    except.message = Bun::toStringRef(message_str);
+                }
             }
         }
 
@@ -755,8 +764,13 @@ void exceptionFromString(ZigException& except, JSC::JSValue value, JSC::JSGlobal
             }
             if (sourceURL) {
                 if (sourceURL.isString()) {
-                    except.stack.frames_ptr[0].source_url = Bun::toStringRef(sourceURL.toWTFString(global));
-                    except.stack.frames_len = 1;
+                    auto sourceURL_str = sourceURL.toWTFString(global);
+                    if (scope.exception()) [[unlikely]] {
+                        scope.clearExceptionExceptTermination();
+                    } else {
+                        except.stack.frames_ptr[0].source_url = Bun::toStringRef(sourceURL_str);
+                        except.stack.frames_len = 1;
+                    }
                 }
             }
 
@@ -809,13 +823,28 @@ void exceptionFromString(ZigException& except, JSC::JSValue value, JSC::JSGlobal
             }
             return;
         }
+        case JSC::HeapBigIntType: {
+            // HeapBigInt can be safely converted to string
+            auto str = value.toWTFString(global);
+            if (scope.exception()) [[unlikely]] {
+                scope.clearExceptionExceptTermination();
+                except.message = Bun::toStringRef("[BigInt]"_s);
+                return;
+            }
+            except.message = Bun::toStringRef(str);
+            return;
+        }
 
         default: {
-            break;
+            // For other cell types that might not have a valid toString implementation,
+            // use a generic error message instead of risking an assertion failure
+            except.message = Bun::toStringRef("[Object]"_s);
+            return;
         }
         }
     }
 
+    // Only primitive values should reach here (null, undefined, boolean, number)
     auto str = value.toWTFString(global);
     if (scope.exception()) [[unlikely]] {
         scope.clearExceptionExceptTermination();

test/regression/issue_jscell_assertion.test.ts

@@ -0,0 +1,62 @@
+import { expect, test } from "bun:test";
+import { bunEnv, bunExe, tempDir } from "harness";
+
+test.todo("nextTick inside recursive method should not cause JSCell assertion", async () => {
+  // This reproduces a bug where calling process.nextTick() inside a recursive
+  // method that hits the JavaScript stack limit causes:
+  //   ASSERTION FAILED: isSymbol() || isHeapBigInt()
+  //   vendor/WebKit/Source/JavaScriptCore/runtime/JSCell.cpp(252)
+  //
+  // Minimal reproducer:
+  //   const obj = {
+  //     o() {
+  //       try { this.o(); } catch (e) {}  // Recurse until stack overflow
+  //       try { process.nextTick(() => {}); } catch (e) {}
+  //     },
+  //   };
+  //   obj.o();
+  //
+  // Root cause: When a stack overflow exception occurs and process.nextTick()
+  // is subsequently called, the exception object or stack trace may contain
+  // corrupted JSCell references. During error formatting, toString() is called
+  // on these corrupted cells, triggering the assertion.
+  //
+  // Partial fixes applied:
+  // - Added exception handling in ZigException.cpp after toWTFString() calls
+  // - Added exception handling in ErrorStackTrace.cpp functionName()
+  // - Added exception handling in CallSite.cpp formatAsString()
+  //
+  // TODO: This test is marked as .todo because the fix is incomplete. The
+  // underlying issue is memory corruption that occurs before error formatting.
+  // Further investigation needed into how stack overflow exceptions interact
+  // with the nextTick queue and whether JSC needs additional safeguards.
+
+  using dir = tempDir("jscell-assertion", {
+    "index.js": /* js */ `
+      const obj = {
+        o() {
+          try { this.o(); } catch (e) {}
+          try { process.nextTick(() => {}); } catch (e) {}
+        },
+      };
+      obj.o();
+      console.log("SUCCESS");
+    `,
+  });
+
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "index.js"],
+    env: bunEnv,
+    cwd: String(dir),
+    stderr: "pipe",
+    stdout: "pipe",
+  });
+
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+  // Should not crash with assertion
+  expect(stderr).not.toContain("ASSERTION FAILED");
+  expect(stderr).not.toContain("toStringSlowCase");
+  expect(stdout).toContain("SUCCESS");
+  expect(exitCode).toBe(0);
+});