Skip to content

fix(core): Avoid functionToStringIntegration causing infinite recursions - #22515

Merged
Lms24 merged 1 commit into
developfrom
lms/fix-core-function-to-string-recursion
Jul 23, 2026
Merged

fix(core): Avoid functionToStringIntegration causing infinite recursions#22515
Lms24 merged 1 commit into
developfrom
lms/fix-core-function-to-string-recursion

Conversation

@Lms24

@Lms24Lms24 commented Jul 22, 2026

Copy link
Copy Markdown
Member

Prevent FunctionToString from delegating through mutable Reflect.apply, which can re-enter the integration when another library performs function integrity checks.

This PR restores the plain wrapper while retaining the cross-origin fallback from #2227 and adds a regression test for reentrant Reflect.apply.

To be clear, the repro for this seems extremely superficial. When inspecting the supplied stack trace of the customer reporting this issue, we found some evidence for another library mocking with the functino prototype's toString(). No concrete evidence though for re-entering via Reflect.apply().

Refs #21965
fixes JS-3120

Avoid delegating through mutable Reflect.apply, which can re-enter the
FunctionToString patch when other libraries instrument native functions.
Retain the cross-origin carrier fallback while using the plain wrapper.
Co-Authored-By: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
@linear-code

Copy link
Copy Markdown

JS-3120

@Lms24
Lms24 marked this pull request as ready for review July 22, 2026 17:05
@Lms24
Lms24 requested review from mydea and nicohrubecJuly 22, 2026 17:05
@Lms24Lms24 changed the title fix(core): Avoid FunctionToString recursionfix(core): Avoid functionToStringIntegration causing infinite recursionsJul 22, 2026
@Lms24Lms24 self-assigned this Jul 22, 2026
@github-actions

Copy link
Copy Markdown
Contributor

size-limit report 📦

⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

PathSize% ChangeChange
@sentry/browser27.78 kB+0.01%+2 B 🔺
@sentry/browser - with treeshaking flags26.23 kB+0.02%+3 B 🔺
@sentry/browser (incl. Tracing)46.3 kB+0.02%+5 B 🔺
@sentry/browser (incl. Tracing + Span Streaming)48.08 kB-0.04%-16 B 🔽
@sentry/browser (incl. Tracing, Profiling)51.11 kB-0.03%-15 B 🔽
@sentry/browser (incl. Tracing, Replay)85.58 kB+0.01%+2 B 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags75.22 kB-0.01%-5 B 🔽
@sentry/browser (incl. Tracing, Replay with Canvas)90.29 kB+0.01%+2 B 🔺
@sentry/browser (incl. Tracing, Replay, Feedback)102.97 kB+0.03%+21 B 🔺
@sentry/browser (incl. Feedback)44.96 kB-0.04%-14 B 🔽
@sentry/browser (incl. sendFeedback)32.58 kB+0.01%+2 B 🔺
@sentry/browser (incl. FeedbackAsync)37.63 kB-0.03%-8 B 🔽
@sentry/browser (incl. Metrics)28.87 kB+0.03%+8 B 🔺
@sentry/browser (incl. Logs)29.1 kB+0.05%+14 B 🔺
@sentry/browser (incl. Metrics & Logs)29.8 kB+0.03%+8 B 🔺
@sentry/react29.58 kB+0.04%+11 B 🔺
@sentry/react (incl. Tracing)48.6 kB-0.02%-6 B 🔽
@sentry/vue33.22 kB+0.02%+6 B 🔺
@sentry/vue (incl. Tracing)48.27 kB+0.03%+12 B 🔺
@sentry/svelte27.81 kB+0.02%+5 B 🔺
CDN Bundle30.11 kB-0.03%-9 B 🔽
CDN Bundle (incl. Tracing)48.16 kB-0.01%-3 B 🔽
CDN Bundle (incl. Logs, Metrics)31.69 kB-0.02%-6 B 🔽
CDN Bundle (incl. Tracing, Logs, Metrics)49.48 kB-0.02%-5 B 🔽
CDN Bundle (incl. Replay, Logs, Metrics)70.95 kB-0.02%-8 B 🔽
CDN Bundle (incl. Tracing, Replay)85.73 kB-0.01%-3 B 🔽
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)87.02 kB-0.02%-11 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback)91.5 kB-0.02%-10 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)92.78 kB-0.02%-12 B 🔽
CDN Bundle - uncompressed89.75 kB-0.01%-5 B 🔽
CDN Bundle (incl. Tracing) - uncompressed144.85 kB-0.01%-5 B 🔽
CDN Bundle (incl. Logs, Metrics) - uncompressed94.46 kB-0.01%-5 B 🔽
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed148.83 kB-0.01%-5 B 🔽
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed219.22 kB-0.01%-5 B 🔽
CDN Bundle (incl. Tracing, Replay) - uncompressed264.09 kB-0.01%-5 B 🔽
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed268.05 kB-0.01%-5 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed277.79 kB-0.01%-5 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed281.74 kB-0.01%-5 B 🔽
@sentry/nextjs (client)51.13 kB+0.03%+14 B 🔺
@sentry/sveltekit (client)46.75 kB+0.05%+19 B 🔺
@sentry/core/server80.19 kB+0.07%+53 B 🔺
@sentry/core/browser51.99 kB+0.01%+4 B 🔺
@sentry/node124.31 kB+0.04%+47 B 🔺
@sentry/node (incl. diagnostics channel injection)149.73 kB+0.03%+31 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection)70.03 kB+0.01%+2 B 🔺
@sentry/node - without tracing74.41 kB-0.04%-27 B 🔽
@sentry/aws-serverless83.92 kB-0.01%-1 B 🔽
@sentry/cloudflare (withSentry) - minified196.64 kB-0.01%-5 B 🔽
@sentry/cloudflare (withSentry)483.87 kB-0.01%-45 B 🔽

View base workflow run

@Lms24
Lms24 merged commit 567ee91 into developJul 23, 2026
553 of 555 checks passed
@Lms24
Lms24 deleted the lms/fix-core-function-to-string-recursion branch July 23, 2026 07:52
Lms24 added a commit that referenced this pull request Jul 23, 2026
…ecursions (#22527)
Backport of: #22515
Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@Lms24@chargome