From b2cd254c35b6b1b128beea0eacdb8e814d91e003 Mon Sep 17 00:00:00 2001
From: Kenta Moriuchi <moriken@kimamass.com>
Date: Thu, 4 Jan 2024 13:12:38 +0900
Subject: fix: strict type check for cross realms (#21669)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Deno v1.39 introduces `vm.runInNewContext`. This may cause problems when
using `Object.prototype.isPrototypeOf` to check built-in types.

```js
import vm from "node:vm";

const err = new Error();
const crossErr = vm.runInNewContext(`new Error()`);

console.assert( !(crossErr instanceof Error) );
console.assert( Object.getPrototypeOf(err) !== Object.getPrototypeOf(crossErr) );
```

This PR changes to check using internal slots solves them.

---

current:

```
> import vm from "node:vm";
undefined
> vm.runInNewContext(`new Error("message")`)
Error {}
> vm.runInNewContext(`new Date("2018-12-10T02:26:59.002Z")`)
Date {}
```

this PR:

```
> import vm from "node:vm";
undefined
> vm.runInNewContext(`new Error("message")`)
Error: message
    at <anonymous>:1:1
> vm.runInNewContext(`new Date("2018-12-10T02:26:59.002Z")`)
2018-12-10T02:26:59.002Z
```

---------

Co-authored-by: Bartek Iwańczuk <biwanczuk@gmail.com>
---
 ext/ffi/00_ffi.js | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

(limited to 'ext/ffi')

diff --git a/ext/ffi/00_ffi.js b/ext/ffi/00_ffi.js
index 9dd675f88..db58dda80 100644
--- a/ext/ffi/00_ffi.js
+++ b/ext/ffi/00_ffi.js
@@ -4,7 +4,6 @@ import { core, primordials } from "ext:core/mod.js";
 const ops = core.ops;
 const {
   ArrayBufferIsView,
-  ArrayBufferPrototype,
   ArrayBufferPrototypeGetByteLength,
   ArrayPrototypeMap,
   ArrayPrototypeJoin,
@@ -16,7 +15,6 @@ const {
   NumberIsSafeInteger,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
-  TypedArrayPrototypeGetSymbolToStringTag,
   TypeError,
   Uint8Array,
   Int32Array,
@@ -32,6 +30,11 @@ const {
   SafeArrayIterator,
   SafeWeakMap,
 } = primordials;
+const {
+  isArrayBuffer,
+  isDataView,
+  isTypedArray,
+} = core;
 import { pathFromURL } from "ext:deno_web/00_infra.js";
 const {
   op_ffi_call_nonblocking,
@@ -46,14 +49,10 @@ const {
  * @returns {number}
  */
 function getBufferSourceByteLength(source) {
-  if (ArrayBufferIsView(source)) {
-    if (TypedArrayPrototypeGetSymbolToStringTag(source) !== undefined) {
-      // TypedArray
-      return TypedArrayPrototypeGetByteLength(source);
-    } else {
-      // DataView
-      return DataViewPrototypeGetByteLength(source);
-    }
+  if (isTypedArray(source)) {
+    return TypedArrayPrototypeGetByteLength(source);
+  } else if (isDataView(source)) {
+    return DataViewPrototypeGetByteLength(source);
   }
   return ArrayBufferPrototypeGetByteLength(source);
 }
@@ -232,7 +231,7 @@ class UnsafePointer {
       } else {
         pointer = ops.op_ffi_ptr_of(value);
       }
-    } else if (ObjectPrototypeIsPrototypeOf(ArrayBufferPrototype, value)) {
+    } else if (isArrayBuffer(value)) {
       if (value.length === 0) {
         pointer = ops.op_ffi_ptr_of_exact(new Uint8Array(value));
       } else {
-- 
cgit v1.2.3