From b2cd254c35b6b1b128beea0eacdb8e814d91e003 Mon Sep 17 00:00:00 2001
From: Kenta Moriuchi <moriken@kimamass.com>
Date: Thu, 4 Jan 2024 13:12:38 +0900
Subject: fix: strict type check for cross realms (#21669)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Deno v1.39 introduces `vm.runInNewContext`. This may cause problems when
using `Object.prototype.isPrototypeOf` to check built-in types.

```js
import vm from "node:vm";

const err = new Error();
const crossErr = vm.runInNewContext(`new Error()`);

console.assert( !(crossErr instanceof Error) );
console.assert( Object.getPrototypeOf(err) !== Object.getPrototypeOf(crossErr) );
```

This PR changes to check using internal slots solves them.

---

current:

```
> import vm from "node:vm";
undefined
> vm.runInNewContext(`new Error("message")`)
Error {}
> vm.runInNewContext(`new Date("2018-12-10T02:26:59.002Z")`)
Date {}
```

this PR:

```
> import vm from "node:vm";
undefined
> vm.runInNewContext(`new Error("message")`)
Error: message
    at <anonymous>:1:1
> vm.runInNewContext(`new Date("2018-12-10T02:26:59.002Z")`)
2018-12-10T02:26:59.002Z
```

---------

Co-authored-by: Bartek Iwańczuk <biwanczuk@gmail.com>
---
 ext/webgpu/01_webgpu.js | 59 ++++++++++++++++++++-----------------------------
 1 file changed, 24 insertions(+), 35 deletions(-)

(limited to 'ext/webgpu/01_webgpu.js')

diff --git a/ext/webgpu/01_webgpu.js b/ext/webgpu/01_webgpu.js
index 3e8978fef..c8258621f 100644
--- a/ext/webgpu/01_webgpu.js
+++ b/ext/webgpu/01_webgpu.js
@@ -10,11 +10,10 @@ import { core, primordials } from "ext:core/mod.js";
 const ops = core.ops;
 import * as webidl from "ext:deno_webidl/00_webidl.js";
 import { EventTarget } from "ext:deno_web/02_event.js";
-import DOMException from "ext:deno_web/01_dom_exception.js";
+import { DOMException } from "ext:deno_web/01_dom_exception.js";
 import { createFilteredInspectProxy } from "ext:deno_console/01_console.js";
 const {
   ArrayBuffer,
-  ArrayBufferIsView,
   ArrayIsArray,
   ArrayPrototypeFilter,
   ArrayPrototypeMap,
@@ -45,9 +44,12 @@ const {
   SymbolIterator,
   TypeError,
   Uint32Array,
-  Uint32ArrayPrototype,
   Uint8Array,
 } = primordials;
+const {
+  isDataView,
+  isTypedArray,
+} = core;
 const {
   op_webgpu_buffer_get_map_async,
   op_webgpu_request_adapter,
@@ -1690,17 +1692,14 @@ class GPUQueue {
     });
     /** @type {ArrayBufferLike} */
     let abLike = data;
-    if (ArrayBufferIsView(data)) {
-      if (TypedArrayPrototypeGetSymbolToStringTag(data) !== undefined) {
-        // TypedArray
-        abLike = TypedArrayPrototypeGetBuffer(
-          /** @type {Uint8Array} */ (data),
-        );
-      } else {
-        // DataView
-        abLike = DataViewPrototypeGetBuffer(/** @type {DataView} */ (data));
-      }
+    if (isTypedArray(data)) {
+      abLike = TypedArrayPrototypeGetBuffer(
+        /** @type {Uint8Array} */ (data),
+      );
+    } else if (isDataView(data)) {
+      abLike = DataViewPrototypeGetBuffer(/** @type {DataView} */ (data));
     }
+
     const { err } = ops.op_webgpu_write_buffer(
       device.rid,
       bufferRid,
@@ -1744,16 +1743,12 @@ class GPUQueue {
 
     /** @type {ArrayBufferLike} */
     let abLike = data;
-    if (ArrayBufferIsView(data)) {
-      if (TypedArrayPrototypeGetSymbolToStringTag(data) !== undefined) {
-        // TypedArray
-        abLike = TypedArrayPrototypeGetBuffer(
-          /** @type {Uint8Array} */ (data),
-        );
-      } else {
-        // DataView
-        abLike = DataViewPrototypeGetBuffer(/** @type {DataView} */ (data));
-      }
+    if (isTypedArray(data)) {
+      abLike = TypedArrayPrototypeGetBuffer(
+        /** @type {Uint8Array} */ (data),
+      );
+    } else if (isDataView(data)) {
+      abLike = DataViewPrototypeGetBuffer(/** @type {DataView} */ (data));
     }
 
     const { err } = ops.op_webgpu_write_texture(
@@ -3778,10 +3773,8 @@ class GPURenderPassEncoder {
       selfContext: "this",
     });
     if (
-      !(ObjectPrototypeIsPrototypeOf(
-        Uint32ArrayPrototype,
-        dynamicOffsetsData,
-      ))
+      TypedArrayPrototypeGetSymbolToStringTag(dynamicOffsetsData) !==
+        "Uint32Array"
     ) {
       dynamicOffsetsData = new Uint32Array(dynamicOffsetsData ?? []);
       dynamicOffsetsDataStart = 0;
@@ -4337,10 +4330,8 @@ class GPUComputePassEncoder {
       selfContext: "this",
     });
     if (
-      !(ObjectPrototypeIsPrototypeOf(
-        Uint32ArrayPrototype,
-        dynamicOffsetsData,
-      ))
+      TypedArrayPrototypeGetSymbolToStringTag(dynamicOffsetsData) !==
+        "Uint32Array"
     ) {
       dynamicOffsetsData = new Uint32Array(dynamicOffsetsData ?? []);
       dynamicOffsetsDataStart = 0;
@@ -4555,10 +4546,8 @@ class GPURenderBundleEncoder {
       selfContext: "this",
     });
     if (
-      !(ObjectPrototypeIsPrototypeOf(
-        Uint32ArrayPrototype,
-        dynamicOffsetsData,
-      ))
+      TypedArrayPrototypeGetSymbolToStringTag(dynamicOffsetsData) !==
+        "Uint32Array"
     ) {
       dynamicOffsetsData = new Uint32Array(dynamicOffsetsData ?? []);
       dynamicOffsetsDataStart = 0;
-- 
cgit v1.2.3