Unhandled promise rejections: reported only at exit, no event, late .catch suppresses

[proggeramlug]

Severity: P1 (wrong lifecycle + latent UAF)
Found by: audit fable-audit-perry-2.md, late-catch confirmed by probe.

What

Unhandled promise rejections are reported only at process exit, there is no process.on('unhandledRejection')/'rejectionHandled'), and a .catch attached in any later macrotask silently suppresses what Node would treat as a fatal unhandled rejection.

const p = Promise.reject(new Error("boom"));
setTimeout(() => p.catch(() => console.log("late")), 10);
// node (default): crashes before the timer, nonzero exit
// perry: prints "late", exit 0

Why

Rejections with no reaction are tracked in static UNHANDLED_REJECTIONS: RefCell<Vec<usize>> (crates/perry-runtime/src/promise/then.rs:49-50) and only inspected by js_promise_report_unhandled_rejections(), which codegen emits after the event loop exits (crates/perry-codegen/src/codegen/entry.rs:914-918, logic at then.rs:119-194). Three problems:

1. Timing — Node fires per-rejection at end-of-turn; Perry defers to process end, so a later handler suppresses it.
2. No process emitter path at all (zero unhandledRejection hits in runtime+stdlib) — log-and-continue programs get exit(1) instead.
3. UNHANDLED_REJECTIONS entries are not GC roots (no scanner references them) and the exit-time report derefs (*pr).reason — a swept/recycled promise makes that a stale read (UB; arena pages stay mapped so misreport is likelier than a hard fault).

Fix

Check the tracked set at the end of each run_microtasks drain (non-reentrant, timers-allowed mode) instead of at exit; root the reasons (or pin the promise while tracked); add a process emitter hook before the exit(1) fallback so handlers can observe/suppress.

Confidence: high on mechanism; UAF exploitability medium.

[proggeramlug]

Part 3 (the latent UAF) fixed in #6209: scan_unhandled_rejection_roots_mut now roots + address-stabilizes the tracked promises, so the program-end report is no longer a stale/UAF deref (validated under PERRY_GC_FORCE_EVACUATE=1 PERRY_GC_VERIFY_EVACUATION=1).

Remaining (left as a follow-up — a behavior change with real blast radius on rejection semantics):

• Part 1 (timing): fire the unhandled-rejection check at the end of each top-level run_microtasks drain instead of at process exit, so a late .catch no longer suppresses (Promise.reject(...); setTimeout(() => p.catch(...)) should surface at end-of-turn like Node).
• Part 2 (events + default crash): wire process.on('unhandledRejection') / 'rejectionHandled') through the existing process EventEmitter (os_process_emitter) before the exit(1) fallback, so handlers can observe/suppress; and match Node's default no-handler crash. Needs validation against the gap/parity suite (programs relying on Perry's current lenient late-catch would start crashing — which is more correct vs Node, but is a behavior change).

[proggeramlug]

Status after tracing all three sub-issues on current main:

• Part 3 (UAF at report time): already fixed by fix(runtime): root promises tracked for unhandled rejection (UAF) (#6077) #6209 (b8cf5d3e3). scan_unhandled_rejection_roots_mut (promise/then.rs) now roots + address-stabilizes tracked promises, so js_promise_report_unhandled_rejections's deref is safe.
• Part 2 (no event / default crash): open, additive fix. js_promise_report_unhandled_rejections goes straight to eprintln! + exit(1) with no process hook — a process.on('unhandledRejection') listener can never fire (contrast emit_process_uncaught_exception, which already routes through emit_process_event). Fix: before the fallback crash, emit_process_event("unhandledRejection", &[reason, promise]) per tracked promise and only exit(1) where there's no listener (mirroring the uncaughtException contract); also fix the "only reports unhandled_reasons[0]" limitation.
• Part 1 (exit-only timing) + rejectionHandled: open, behavior-flip, deferred. The only inspection point is the exit epilogue (entry.rs), and mark_rejection_handled unconditionally untracks on any later handler attach — so a late .catch() in any macrotask silently suppresses the report (Perry is currently more lenient than Node here). A real per-turn check (after each run_microtasks) plus a rejectionHandled reconciliation set is needed. This flips existing behavior and needs a full gap + parity sweep before merge — deferring as its own PR rather than bundling.

Recommend landing Part 2 (event emission + first-listener-wins default crash) as a standalone additive PR; Part 1/rejectionHandled as a follow-up gated on parity results. Key files: promise/then.rs:49-207, promise/microtasks.rs:101, codegen/entry.rs:820-920, os/os_process_emitter.rs:330-361.

[proggeramlug]

All three parts are now fixed on main — closing.

part	fix
3. Latent UAF (tracked promises not GC roots)	#6209 — scan_unhandled_rejection_roots_mut, registered in the GC scanner registry
1. Timing — reported only at process exit, so a late .catch wrongly suppressed	#6323 — new MicrotaskDrainMode::EventLoop; the rejection report runs at the microtask checkpoint, before the timer queues
2. Events — no process.on('unhandledRejection') / 'rejectionHandled'	#6323

Re-verified on current main against node --experimental-strip-types (stdout and exit codes): a registered unhandledRejection handler fires with (reason, promise) and suppresses the crash; a late .catch in a timer no longer suppresses the report; rejectionHandled fires; with no listener you get Uncaught (in promise) … and exit 1.

Note the reporting deliberately fires only from the event-loop pump — the runtime's other AllowTimers pumps (for await over a stream, fs.cp, perry_poll) drain microtasks with a suspended JS frame on the stack, and reporting there would be a false positive that kills working programs.