Skip to content

ffi: validate the value passed to the float setters - #65342

Open
soulee-dev wants to merge 1 commit into
nodejs:mainfrom
soulee-dev:ffi-validate-float-setters
Open

ffi: validate the value passed to the float setters#65342
soulee-dev wants to merge 1 commit into
nodejs:mainfrom
soulee-dev:ffi-validate-float-setters

Conversation

@soulee-dev

@soulee-dev soulee-dev commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Problem

Every other setter in SetValue<T>() requires IsNumber() before it writes, so setInt8(ptr, 0, '5') throws. The floating-point branch calls ToNumber() instead, so setFloat64(ptr, 0, '1.5') writes 1.5, {} writes NaN and null writes 0. The same double is type-checked on the argument path, where ToFFIArgument() throws Argument %s must be a double, and the documentation already says the setters "validate the supplied JavaScript value against the target native type before writing it into memory".

ToNumber() also discards a pending exception. When the value has a valueOf() that throws, the branch calls THROW_ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the caller sees Value must be a number instead of their own error. DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it, and src/README.md asks for an early return instead.

Fix

Check IsNumber() instead. It runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. The messages follow the integer setters and ToFFIArgument() rather than the old generic Value must be a number.

Compatibility

NaN and Infinity still pass, since both are number values; only the type check is new. This makes input that is accepted today throw, but node:ffi is experimental and the recent fixes in this area went the same way without a semver-major label.

Tests

Six assertions are added to the setter block in test/ffi/test-ffi-memory.js, which covered only the integer setters. The last one passes { valueOf: common.mustNotCall() }, so the test fails if the setter ever converts the value again.

Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032

setInt8() through setUint64() require IsNumber() before any range check
and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32()
and setFloat64() call ToNumber() and write whatever it returns, so a
string, a boolean or a plain object is converted instead of rejected
and a typo such as '1,5' stores NaN in native memory with no error at
the call site. The same double is type-checked when it is passed as a
call argument: ToFFIArgument() requires IsNumber() and otherwise throws
"Argument %s must be a double".

The coercion also discards a pending exception. When ToNumber() fails
because the value has a valueOf() that throws, the branch throws
ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled,
so the original error never reaches the caller, whereas
DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE()
both propagate it.

Check IsNumber() instead, matching the wording of the integer setters
and of ToFFIArgument(). The check runs before any conversion, so
valueOf() is never invoked and there is no pending exception left to
discard. This was the only ToNumber(context) call in src/.

Signed-off-by: Soul Lee <alus20x@gmail.com>
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/ffi

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels Aug 17, 2026
@codecov

codecov Bot commented Aug 17, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.12%. Comparing base (ad7a5b8) to head (f26b00e).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #65342      +/-   ##
==========================================
+ Coverage   90.11%   90.12%   +0.01%     
==========================================
  Files         752      752              
  Lines      251569   251567       -2     
  Branches    47268    47266       -2     
==========================================
+ Hits       226701   226725      +24     
+ Misses      16233    16189      -44     
- Partials     8635     8653      +18     
Files with missing lines Coverage Δ
src/ffi/data.cc 75.71% <100.00%> (+0.55%) ⬆️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ffi: setFloat32()/setFloat64() coerce their value and discard a pending exception

2 participants