Skip to content

[DO NOT MERGE] feat(core): add opt-in assertion instrumentation - #6592

Draft
antonis wants to merge 11 commits into
mainfrom
feat/loud-invariants
Draft

[DO NOT MERGE] feat(core): add opt-in assertion instrumentation#6592
antonis wants to merge 11 commits into
mainfrom
feat/loud-invariants

docs(core): note assertion crash semantics and align handler comment

955f590
Select commit
Loading
Failed to load commit list.
@sentry/warden / warden completed Aug 18, 2026 in 0s

8 issues

High

String() throws TypeError on Symbol values in flattenValues - `packages/core/src/js/assertion.ts:117`

String(symbol) throws a TypeError and crashes the assertion reporter when runtime values contains a Symbol.

Medium

Sentry SDK path markers assume POSIX separators and fail on Windows - `packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:120`

SENTRY_SDK_PATH_MARKERS uses forward-slash literals, but Metro/Babel filename may contain backslashes on Windows, causing the plugin to instrument the SDK's own files and inject a self-referential require('@sentry/react-native').

collectValueIdentifiers captures identifiers from nested scopes, causing ReferenceError in generated code - `packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:289-293`

Identifiers bound inside nested function expressions (e.g., arrow-function parameters) are collected and then referenced in the emitted values object at the assertion call site, where they are out of scope and throw a ReferenceError at runtime.

Destructured console.assert miscompiled as throwing assert - `packages/core/etc/sentry-react-native.api.md:162`

The assertion Babel plugin rewrites const { assert } = console; assert(false) with rethrow: true, turning a report-only console.assert into a throwing assertion that crashes after capturing.

flattenValues crashes when captured value has throwing toString - `packages/core/src/js/assertion.ts:127`

Wrap String(value) in a try-catch so a throwing toString or [Symbol.toPrimitive] doesn't break the reporting path and cause double-capture.

SDK self-exclusion breaks on Windows paths - `packages/core/src/js/index.ts:120-197`

SENTRY_SDK_PATH_MARKERS uses forward-slash literals, but Metro/Babel filename may contain backslashes on Windows, causing the plugin to fail to skip Sentry's own files and risking a self-referential require('@sentry/react-native') if any assertion pragma exists in SDK source.

Also found at:

  • packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:197
collectValueIdentifiers emits out-of-scope references for nested bindings - `packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:278`

Identifiers bound inside nested functions (e.g. arrow-function parameters) are collected and then referenced in the emitted values object at the assertion call site, where they are out of scope and cause a ReferenceError at runtime.

Low

captureAssertionViolation crashes when values is null - `packages/core/src/js/assertion.ts:186-188`

The guard if (values !== undefined) allows null to reach flattenValues, where Object.keys(null) throws a TypeError. Change the check to if (values != null) to safely reject both null and undefined.

4 skills analyzed
Skill Findings Duration Cost
security-review 0 3m 41s $1.21
code-review 3 45m 26s $3.07
find-bugs 5 65m 4s $4.69
gha-security-review 0 42m 3s $0.09

⏱ 156m 14s · 11.8M in / 796.3k out · $9.05