Repository navigation
vm: fix compileFunction abort on invalid arrays - #67401
Ayush701-code-zm wants to merge 1 commit into
Conversation
Reject null entries in options.contextExtensions and read params and contextExtensions only once before passing them to the binding. Fixes: nodejs#67366 Signed-off-by: Ayush Anand <h3yayush@gmail.com>
|
Welcome to Node.js, and thank you for your first contribution! Before review, please take a moment to read:
Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal. Caution AgentScan found account activity patterns that may be consistent with automation. This is a heuristic, not proof that this pull request was opened by an agent or violates policy. AI-assisted contributions are permitted, but automated tooling must not open pull requests without advance approval, and contributors must personally understand, test, verify, and take responsibility for every submitted change. See the AgentScan analysis, AI use policy, and automation policy for additional context. |
Fixes: #67366
vm.compileFunction() crashed the process with a CHECK failure when contextExtensions had a null entry, because the JS check allowed null but the C++ side expects an object. null is now rejected with ERR_INVALID_ARG_TYPE, which matches the docs (Object[]).
params and contextExtensions were also read twice, once in the JS check and again in C++, so a getter could return a valid value first and a bad one later. Both arrays are now copied once, the copy is checked, and the copy is passed to the binding.
Added test/parallel/test-vm-compile-function-validation.js. It crashes without the change and passes with it.
I used an AI assistant while working on this. I reproduced the crash, reviewed the change in lib/vm.js, and ran the vm tests locally.