From 68ae4cc1f88fd7474b414750078c0ddc1e0a2a15 Mon Sep 17 00:00:00 2001
From: vamsi <vamsi@example.com>
Date: Sun, 29 Mar 2026 15:12:36 +0530
Subject: [PATCH] Fix handleIndexError crash on throw null in query servers

If an untrusted map function executes 'throw null', the check 'err[0] == "fatal"' evaluates 'null[0]' which throws an uncaught TypeError, fatally crashing the JavaScript worker process. This adds a null guard 'err && err[0]' to nouveau.js, views.js, and dreyfus.js.
---
 share/server/dreyfus.js | 2 +-
 share/server/nouveau.js | 2 +-
 share/server/views.js   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/share/server/dreyfus.js b/share/server/dreyfus.js
index 3aa72493f82..8a4b8396d3f 100644
--- a/share/server/dreyfus.js
+++ b/share/server/dreyfus.js
@@ -17,7 +17,7 @@ var Dreyfus = (function() {
   function handleIndexError(err, doc) {
     if (err == "fatal_error") {
       throw(["error", "map_runtime_error", "function raised 'fatal_error'"]);
-    } else if (err[0] == "fatal") {
+    } else if (err && err[0] == "fatal") {
       throw(err);
     }
     var message = "function raised exception " + errstr(err);
diff --git a/share/server/nouveau.js b/share/server/nouveau.js
index 8c75d4a2502..a42751e81d3 100644
--- a/share/server/nouveau.js
+++ b/share/server/nouveau.js
@@ -17,7 +17,7 @@ var Nouveau = (function () {
   function handleIndexError(err, doc) {
     if (err == "fatal_error") {
       throw (["error", "map_runtime_error", "function raised 'fatal_error'"]);
-    } else if (err[0] == "fatal") {
+    } else if (err && err[0] == "fatal") {
       throw (err);
     }
     var message = "function raised exception " + err.toSource();
diff --git a/share/server/views.js b/share/server/views.js
index d414436bd95..efb269bb91b 100644
--- a/share/server/views.js
+++ b/share/server/views.js
@@ -70,7 +70,7 @@ var Views = (function() {
       // JavaScript process. If you need to destroy the JavaScript
       // process, throw the error form matched by the block below.
       throw(["error", "map_runtime_error", "function raised 'fatal_error'"]);
-    } else if (err[0] == "fatal") {
+    } else if (err && err[0] == "fatal") {
       // Throwing errors of the form ["fatal","error_key","reason"]
       // will kill the OS process. This is not normally what you want.
       throw(err);