GeezerVison

setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".

The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.

Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.

Signed-off-by: Soul Lee <[email protected]>
PR-URL: #65342
Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Juan José Arboleda <[email protected]>

setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".

The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.

Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.

Signed-off-by: Soul Lee <[email protected]>
PR-URL: #65342
Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Juan José Arboleda <[email protected]>