ffi: validate the value passed to the float setters by soulee-dev · Pull Request #65342 · nodejs/node

soulee-dev · 2026-08-17T00:28:04Z

Problem

Every other setter in SetValue<T>() requires IsNumber() before it writes, so setInt8(ptr, 0, '5') throws. The floating-point branch calls ToNumber() instead, so setFloat64(ptr, 0, '1.5') writes 1.5, {} writes NaN and null writes 0. The same double is type-checked on the argument path, where ToFFIArgument() throws Argument %s must be a double, and the documentation already says the setters "validate the supplied JavaScript value against the target native type before writing it into memory".

ToNumber() also discards a pending exception. When the value has a valueOf() that throws, the branch calls THROW_ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the caller sees Value must be a number instead of their own error. DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it, and src/README.md asks for an early return instead.

Fix

Check IsNumber() instead. It runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. The messages follow the integer setters and ToFFIArgument() rather than the old generic Value must be a number.

Compatibility

NaN and Infinity still pass, since both are number values; only the type check is new. This makes input that is accepted today throw, but node:ffi is experimental and the recent fixes in this area went the same way without a semver-major label.

Tests

Six assertions are added to the setter block in test/ffi/test-ffi-memory.js, which covered only the integer setters. The last one passes { valueOf: common.mustNotCall() }, so the test fails if the setter ever converts the value again.

Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com>

nodejs-github-bot · 2026-08-17T00:28:10Z

Review requested:

@nodejs/ffi

codecov · 2026-08-17T02:04:20Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.12%. Comparing base (ad7a5b8) to head (f26b00e).
⚠️ Report is 43 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #65342 +/- ##
==========================================
+ Coverage 90.11% 90.12% +0.01% 
==========================================
Files 752 752 Lines 251569 251567 -2 Branches 47268 47266 -2 ==========================================
+ Hits 226701 226725 +24 + Misses 16233 16189 -44 - Partials 8635 8653 +18

Files with missing lines	Coverage Δ
src/ffi/data.cc	`75.71% <100.00%> (+0.55%)`	⬆️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-08-19T18:17:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/76006/

nodejs-github-bot · 2026-08-19T20:59:48Z

Landed in f3a8f1a

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com> PR-URL: #65342Fixes: #65341 Refs: #62858 Refs: #64614 Refs: #64691 Refs: #65032 Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

soulee-dev · 2026-08-17T00:28:04Z

Problem

Every other setter in SetValue<T>() requires IsNumber() before it writes, so setInt8(ptr, 0, '5') throws. The floating-point branch calls ToNumber() instead, so setFloat64(ptr, 0, '1.5') writes 1.5, {} writes NaN and null writes 0. The same double is type-checked on the argument path, where ToFFIArgument() throws Argument %s must be a double, and the documentation already says the setters "validate the supplied JavaScript value against the target native type before writing it into memory".

ToNumber() also discards a pending exception. When the value has a valueOf() that throws, the branch calls THROW_ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the caller sees Value must be a number instead of their own error. DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it, and src/README.md asks for an early return instead.

Fix

Check IsNumber() instead. It runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. The messages follow the integer setters and ToFFIArgument() rather than the old generic Value must be a number.

Compatibility

NaN and Infinity still pass, since both are number values; only the type check is new. This makes input that is accepted today throw, but node:ffi is experimental and the recent fixes in this area went the same way without a semver-major label.

Tests

Six assertions are added to the setter block in test/ffi/test-ffi-memory.js, which covered only the integer setters. The last one passes { valueOf: common.mustNotCall() }, so the test fails if the setter ever converts the value again.

Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com>

nodejs-github-bot · 2026-08-17T00:28:10Z

Review requested:

@nodejs/ffi

codecov · 2026-08-17T02:04:20Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.12%. Comparing base (ad7a5b8) to head (f26b00e).
⚠️ Report is 43 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #65342 +/- ##
==========================================
+ Coverage 90.11% 90.12% +0.01% 
==========================================
Files 752 752 Lines 251569 251567 -2 Branches 47268 47266 -2 ==========================================
+ Hits 226701 226725 +24 + Misses 16233 16189 -44 - Partials 8635 8653 +18

Files with missing lines	Coverage Δ
src/ffi/data.cc	`75.71% <100.00%> (+0.55%)`	⬆️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-08-19T18:17:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/76006/

nodejs-github-bot · 2026-08-19T20:59:48Z

Landed in f3a8f1a

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com> PR-URL: #65342Fixes: #65341 Refs: #62858 Refs: #64614 Refs: #64691 Refs: #65032 Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

soulee-dev · 2026-08-17T00:28:04Z

Problem

Every other setter in SetValue<T>() requires IsNumber() before it writes, so setInt8(ptr, 0, '5') throws. The floating-point branch calls ToNumber() instead, so setFloat64(ptr, 0, '1.5') writes 1.5, {} writes NaN and null writes 0. The same double is type-checked on the argument path, where ToFFIArgument() throws Argument %s must be a double, and the documentation already says the setters "validate the supplied JavaScript value against the target native type before writing it into memory".

ToNumber() also discards a pending exception. When the value has a valueOf() that throws, the branch calls THROW_ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the caller sees Value must be a number instead of their own error. DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it, and src/README.md asks for an early return instead.

Fix

Check IsNumber() instead. It runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. The messages follow the integer setters and ToFFIArgument() rather than the old generic Value must be a number.

Compatibility

NaN and Infinity still pass, since both are number values; only the type check is new. This makes input that is accepted today throw, but node:ffi is experimental and the recent fixes in this area went the same way without a semver-major label.

Tests

Six assertions are added to the setter block in test/ffi/test-ffi-memory.js, which covered only the integer setters. The last one passes { valueOf: common.mustNotCall() }, so the test fails if the setter ever converts the value again.

Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com>

nodejs-github-bot · 2026-08-17T00:28:10Z

Review requested:

@nodejs/ffi

codecov · 2026-08-17T02:04:20Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.12%. Comparing base (ad7a5b8) to head (f26b00e).
⚠️ Report is 43 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #65342 +/- ##
==========================================
+ Coverage 90.11% 90.12% +0.01% 
==========================================
Files 752 752 Lines 251569 251567 -2 Branches 47268 47266 -2 ==========================================
+ Hits 226701 226725 +24 + Misses 16233 16189 -44 - Partials 8635 8653 +18

Files with missing lines	Coverage Δ
src/ffi/data.cc	`75.71% <100.00%> (+0.55%)`	⬆️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-08-19T18:17:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/76006/

nodejs-github-bot · 2026-08-19T20:59:48Z

Landed in f3a8f1a

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com> PR-URL: #65342Fixes: #65341 Refs: #62858 Refs: #64614 Refs: #64691 Refs: #65032 Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

soulee-dev · 2026-08-17T00:28:04Z

Problem

Every other setter in SetValue<T>() requires IsNumber() before it writes, so setInt8(ptr, 0, '5') throws. The floating-point branch calls ToNumber() instead, so setFloat64(ptr, 0, '1.5') writes 1.5, {} writes NaN and null writes 0. The same double is type-checked on the argument path, where ToFFIArgument() throws Argument %s must be a double, and the documentation already says the setters "validate the supplied JavaScript value against the target native type before writing it into memory".

ToNumber() also discards a pending exception. When the value has a valueOf() that throws, the branch calls THROW_ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the caller sees Value must be a number instead of their own error. DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it, and src/README.md asks for an early return instead.

Fix

Check IsNumber() instead. It runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. The messages follow the integer setters and ToFFIArgument() rather than the old generic Value must be a number.

Compatibility

NaN and Infinity still pass, since both are number values; only the type check is new. This makes input that is accepted today throw, but node:ffi is experimental and the recent fixes in this area went the same way without a semver-major label.

Tests

Six assertions are added to the setter block in test/ffi/test-ffi-memory.js, which covered only the integer setters. The last one passes { valueOf: common.mustNotCall() }, so the test fails if the setter ever converts the value again.

Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com>

nodejs-github-bot · 2026-08-17T00:28:10Z

Review requested:

@nodejs/ffi

codecov · 2026-08-17T02:04:20Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.12%. Comparing base (ad7a5b8) to head (f26b00e).
⚠️ Report is 43 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #65342 +/- ##
==========================================
+ Coverage 90.11% 90.12% +0.01% 
==========================================
Files 752 752 Lines 251569 251567 -2 Branches 47268 47266 -2 ==========================================
+ Hits 226701 226725 +24 + Misses 16233 16189 -44 - Partials 8635 8653 +18

Files with missing lines	Coverage Δ
src/ffi/data.cc	`75.71% <100.00%> (+0.55%)`	⬆️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-08-19T18:17:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/76006/

nodejs-github-bot · 2026-08-19T20:59:48Z

Landed in f3a8f1a

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com> PR-URL: #65342Fixes: #65341 Refs: #62858 Refs: #64614 Refs: #64691 Refs: #65032 Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

soulee-dev · 2026-08-17T00:28:04Z

Problem

Every other setter in SetValue<T>() requires IsNumber() before it writes, so setInt8(ptr, 0, '5') throws. The floating-point branch calls ToNumber() instead, so setFloat64(ptr, 0, '1.5') writes 1.5, {} writes NaN and null writes 0. The same double is type-checked on the argument path, where ToFFIArgument() throws Argument %s must be a double, and the documentation already says the setters "validate the supplied JavaScript value against the target native type before writing it into memory".

ToNumber() also discards a pending exception. When the value has a valueOf() that throws, the branch calls THROW_ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the caller sees Value must be a number instead of their own error. DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it, and src/README.md asks for an early return instead.

Fix

Check IsNumber() instead. It runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. The messages follow the integer setters and ToFFIArgument() rather than the old generic Value must be a number.

Compatibility

NaN and Infinity still pass, since both are number values; only the type check is new. This makes input that is accepted today throw, but node:ffi is experimental and the recent fixes in this area went the same way without a semver-major label.

Tests

Six assertions are added to the setter block in test/ffi/test-ffi-memory.js, which covered only the integer setters. The last one passes { valueOf: common.mustNotCall() }, so the test fails if the setter ever converts the value again.

Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com>

nodejs-github-bot · 2026-08-17T00:28:10Z

Review requested:

@nodejs/ffi

codecov · 2026-08-17T02:04:20Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.12%. Comparing base (ad7a5b8) to head (f26b00e).
⚠️ Report is 43 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #65342 +/- ##
==========================================
+ Coverage 90.11% 90.12% +0.01% 
==========================================
Files 752 752 Lines 251569 251567 -2 Branches 47268 47266 -2 ==========================================
+ Hits 226701 226725 +24 + Misses 16233 16189 -44 - Partials 8635 8653 +18

Files with missing lines	Coverage Δ
src/ffi/data.cc	`75.71% <100.00%> (+0.55%)`	⬆️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-08-19T18:17:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/76006/

nodejs-github-bot · 2026-08-19T20:59:48Z

Landed in f3a8f1a

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com> PR-URL: #65342Fixes: #65341 Refs: #62858 Refs: #64614 Refs: #64691 Refs: #65032 Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

soulee-dev · 2026-08-17T00:28:04Z

Problem

Every other setter in SetValue<T>() requires IsNumber() before it writes, so setInt8(ptr, 0, '5') throws. The floating-point branch calls ToNumber() instead, so setFloat64(ptr, 0, '1.5') writes 1.5, {} writes NaN and null writes 0. The same double is type-checked on the argument path, where ToFFIArgument() throws Argument %s must be a double, and the documentation already says the setters "validate the supplied JavaScript value against the target native type before writing it into memory".

ToNumber() also discards a pending exception. When the value has a valueOf() that throws, the branch calls THROW_ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the caller sees Value must be a number instead of their own error. DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it, and src/README.md asks for an early return instead.

Fix

Check IsNumber() instead. It runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. The messages follow the integer setters and ToFFIArgument() rather than the old generic Value must be a number.

Compatibility

NaN and Infinity still pass, since both are number values; only the type check is new. This makes input that is accepted today throw, but node:ffi is experimental and the recent fixes in this area went the same way without a semver-major label.

Tests

Six assertions are added to the setter block in test/ffi/test-ffi-memory.js, which covered only the integer setters. The last one passes { valueOf: common.mustNotCall() }, so the test fails if the setter ever converts the value again.

Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com>

nodejs-github-bot · 2026-08-17T00:28:10Z

Review requested:

@nodejs/ffi

codecov · 2026-08-17T02:04:20Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.12%. Comparing base (ad7a5b8) to head (f26b00e).
⚠️ Report is 43 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #65342 +/- ##
==========================================
+ Coverage 90.11% 90.12% +0.01% 
==========================================
Files 752 752 Lines 251569 251567 -2 Branches 47268 47266 -2 ==========================================
+ Hits 226701 226725 +24 + Misses 16233 16189 -44 - Partials 8635 8653 +18

Files with missing lines	Coverage Δ
src/ffi/data.cc	`75.71% <100.00%> (+0.55%)`	⬆️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-08-19T18:17:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/76006/

nodejs-github-bot · 2026-08-19T20:59:48Z

Landed in f3a8f1a

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com> PR-URL: #65342Fixes: #65341 Refs: #62858 Refs: #64614 Refs: #64691 Refs: #65032 Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

soulee-dev · 2026-08-17T00:28:04Z

Problem

Every other setter in SetValue<T>() requires IsNumber() before it writes, so setInt8(ptr, 0, '5') throws. The floating-point branch calls ToNumber() instead, so setFloat64(ptr, 0, '1.5') writes 1.5, {} writes NaN and null writes 0. The same double is type-checked on the argument path, where ToFFIArgument() throws Argument %s must be a double, and the documentation already says the setters "validate the supplied JavaScript value against the target native type before writing it into memory".

ToNumber() also discards a pending exception. When the value has a valueOf() that throws, the branch calls THROW_ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the caller sees Value must be a number instead of their own error. DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it, and src/README.md asks for an early return instead.

Fix

Check IsNumber() instead. It runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. The messages follow the integer setters and ToFFIArgument() rather than the old generic Value must be a number.

Compatibility

NaN and Infinity still pass, since both are number values; only the type check is new. This makes input that is accepted today throw, but node:ffi is experimental and the recent fixes in this area went the same way without a semver-major label.

Tests

Six assertions are added to the setter block in test/ffi/test-ffi-memory.js, which covered only the integer setters. The last one passes { valueOf: common.mustNotCall() }, so the test fails if the setter ever converts the value again.

Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com>

nodejs-github-bot · 2026-08-17T00:28:10Z

Review requested:

@nodejs/ffi

codecov · 2026-08-17T02:04:20Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.12%. Comparing base (ad7a5b8) to head (f26b00e).
⚠️ Report is 43 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #65342 +/- ##
==========================================
+ Coverage 90.11% 90.12% +0.01% 
==========================================
Files 752 752 Lines 251569 251567 -2 Branches 47268 47266 -2 ==========================================
+ Hits 226701 226725 +24 + Misses 16233 16189 -44 - Partials 8635 8653 +18

Files with missing lines	Coverage Δ
src/ffi/data.cc	`75.71% <100.00%> (+0.55%)`	⬆️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-08-19T18:17:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/76006/

nodejs-github-bot · 2026-08-19T20:59:48Z

Landed in f3a8f1a

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com> PR-URL: #65342Fixes: #65341 Refs: #62858 Refs: #64614 Refs: #64691 Refs: #65032 Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

soulee-dev · 2026-08-17T00:28:04Z

Problem

Every other setter in SetValue<T>() requires IsNumber() before it writes, so setInt8(ptr, 0, '5') throws. The floating-point branch calls ToNumber() instead, so setFloat64(ptr, 0, '1.5') writes 1.5, {} writes NaN and null writes 0. The same double is type-checked on the argument path, where ToFFIArgument() throws Argument %s must be a double, and the documentation already says the setters "validate the supplied JavaScript value against the target native type before writing it into memory".

ToNumber() also discards a pending exception. When the value has a valueOf() that throws, the branch calls THROW_ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the caller sees Value must be a number instead of their own error. DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it, and src/README.md asks for an early return instead.

Fix

Check IsNumber() instead. It runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. The messages follow the integer setters and ToFFIArgument() rather than the old generic Value must be a number.

Compatibility

NaN and Infinity still pass, since both are number values; only the type check is new. This makes input that is accepted today throw, but node:ffi is experimental and the recent fixes in this area went the same way without a semver-major label.

Tests

Six assertions are added to the setter block in test/ffi/test-ffi-memory.js, which covered only the integer setters. The last one passes { valueOf: common.mustNotCall() }, so the test fails if the setter ever converts the value again.

Fixes: #65341
Refs: #62858
Refs: #64614
Refs: #64691
Refs: #65032

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com>

nodejs-github-bot · 2026-08-17T00:28:10Z

Review requested:

@nodejs/ffi

codecov · 2026-08-17T02:04:20Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.12%. Comparing base (ad7a5b8) to head (f26b00e).
⚠️ Report is 43 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #65342 +/- ##
==========================================
+ Coverage 90.11% 90.12% +0.01% 
==========================================
Files 752 752 Lines 251569 251567 -2 Branches 47268 47266 -2 ==========================================
+ Hits 226701 226725 +24 + Misses 16233 16189 -44 - Partials 8635 8653 +18

Files with missing lines	Coverage Δ
src/ffi/data.cc	`75.71% <100.00%> (+0.55%)`	⬆️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-08-19T18:17:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/76006/

nodejs-github-bot · 2026-08-19T20:59:48Z

Landed in f3a8f1a

setInt8() through setUint64() require IsNumber() before any range check and reject anything else with ERR_INVALID_ARG_VALUE, but setFloat32() and setFloat64() call ToNumber() and write whatever it returns, so a string, a boolean or a plain object is converted instead of rejected and a typo such as '1,5' stores NaN in native memory with no error at the call site. The same double is type-checked when it is passed as a call argument: ToFFIArgument() requires IsNumber() and otherwise throws "Argument %s must be a double". The coercion also discards a pending exception. When ToNumber() fails because the value has a valueOf() that throws, the branch throws ERR_INVALID_ARG_VALUE on top of the exception V8 has already scheduled, so the original error never reaches the caller, whereas DataView.prototype.setFloat64() and Buffer.prototype.writeDoubleLE() both propagate it. Check IsNumber() instead, matching the wording of the integer setters and of ToFFIArgument(). The check runs before any conversion, so valueOf() is never invoked and there is no pending exception left to discard. This was the only ToNumber(context) call in src/. Signed-off-by: Soul Lee <alus20x@gmail.com> PR-URL: #65342Fixes: #65341 Refs: #62858 Refs: #64614 Refs: #64691 Refs: #65032 Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels Aug 17, 2026

soulee-dev mentioned this pull request Aug 17, 2026
ffi: setFloat32()/setFloat64() coerce their value and discard a pending exception #65341
Closed

trivikr added ffi Issues and PRs related to experimental Foreign Function Interface support. request-ci Add this label to start a Jenkins CI on a PR. labels Aug 19, 2026

trivikr approved these changes Aug 19, 2026
View reviewed changes

github-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 19, 2026

This comment was marked as outdated.
Sign in to view

ShogunPanda approved these changes Aug 19, 2026
View reviewed changes

juanarbol approved these changes Aug 19, 2026
View reviewed changes

trivikr added the commit-queue PRs queued for automated landing through the Commit Queue. label Aug 19, 2026

nodejs-github-bot merged commit f3a8f1a into nodejs:mainAug 19, 2026
93 of 94 checks passed

nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Aug 19, 2026

soulee-dev mentioned this pull request Aug 22, 2026
docs: add contribution note for nodejs/node#65342 ossca-node/board#3
Merged

daeyeon pushed a commit to ossca-node/board that referenced this pull request Aug 22, 2026
docs: add contribution note fornodejs/node#65342(#3)
5f54a06

soulee-dev mentioned this pull request Aug 23, 2026
ffi: memory helpers return undefined instead of throwing when a required argument is omitted #65499
Open

github-actionsBot mentioned this pull request Aug 25, 2026
2026-08-26, Version 26.8.0 (Current) #65551
Merged