Skip to content

vm: fix compileFunction abort on invalid arrays - #67401

Open
Ayush701-code-zm wants to merge 1 commit into
nodejs:mainfrom
Ayush701-code-zm:vm-compile-function-validate-67366
Open

Ayush701-code-zm wants to merge 1 commit into
nodejs:mainfrom
Ayush701-code-zm:vm-compile-function-validate-67366

Conversation

@Ayush701-code-zm

Copy link
Copy Markdown

Fixes: #67366

vm.compileFunction() crashed the process with a CHECK failure when contextExtensions had a null entry, because the JS check allowed null but the C++ side expects an object. null is now rejected with ERR_INVALID_ARG_TYPE, which matches the docs (Object[]).

params and contextExtensions were also read twice, once in the JS check and again in C++, so a getter could return a valid value first and a bad one later. Both arrays are now copied once, the copy is checked, and the copy is passed to the binding.

Added test/parallel/test-vm-compile-function-validation.js. It crashes without the change and passes with it.

I used an AI assistant while working on this. I reproduced the crash, reviewed the change in lib/vm.js, and ran the vm tests locally.

Reject null entries in options.contextExtensions and read params and
contextExtensions only once before passing them to the binding.

Fixes: nodejs#67366
Signed-off-by: Ayush Anand <h3yayush@gmail.com>
@nodejs-github-bot nodejs-github-bot added needs-ci PRs that need a full CI run. vm Issues and PRs related to the vm subsystem. labels Nov 11, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

Caution

AgentScan found account activity patterns that may be consistent with automation. This is a heuristic, not proof that this pull request was opened by an agent or violates policy. AI-assisted contributions are permitted, but automated tooling must not open pull requests without advance approval, and contributors must personally understand, test, verify, and take responsibility for every submitted change. See the AgentScan analysis, AI use policy, and automation policy for additional context.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agentscan:automated-account needs-ci PRs that need a full CI run. vm Issues and PRs related to the vm subsystem.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

vm.compileFunction() aborts the process on values its own validation accepts

2 participants