GeezerVison

Copy link

Copy Markdown

Member

@@            Coverage Diff             @@
##             main   #65032      +/-   ##
==========================================
- Coverage   92.04%   90.30%   -1.74%     
==========================================
  Files         399      759     +360     
  Lines      175810   247645   +71835     
  Branches    27119    46693   +19574     
==========================================
+ Hits       161816   223630   +61814     
- Misses      13682    15467    +1785     
- Partials      312     8548    +8236     

mcollina approved these changes Aug 6, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

83 checks passed

Optimized V8 fast API calls truncate out-of-range pointer BigInts.
Validate them against uintptrMax before invoking the raw function
so optimized calls match the generic and shared-buffer paths.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: codex:gpt-5.6-sol
PR-URL: #65032
Fixes: #65031
Reviewed-By: Matteo Collina <[email protected]>

trivikr deleted the ffi-bigint-range-bypass branch August 16, 2026 16:01

setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".

The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.

Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.

Signed-off-by: Soul Lee <[email protected]>
PR-URL: #65342
Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Juan José Arboleda <[email protected]>

setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".

The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.

Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.

Signed-off-by: Soul Lee <[email protected]>
PR-URL: #65342
Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Juan José Arboleda <[email protected]>

Optimized V8 fast API calls truncate out-of-range pointer BigInts.
Validate them against uintptrMax before invoking the raw function
so optimized calls match the generic and shared-buffer paths.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: codex:gpt-5.6-sol
PR-URL: #65032
Fixes: #65031
Reviewed-By: Matteo Collina <[email protected]>

setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".

The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.

Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.

Signed-off-by: Soul Lee <[email protected]>
PR-URL: #65342
Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Juan José Arboleda <[email protected]>