"fs.chownSync" results in an abort

[zyscoder]

• Version: v14.15.1
• Platform: Linux 5.8.0-38-generic The binary and long term compatibility with node #43~20.04.1-Ubuntu SMP Tue Jan 12 16:39:47 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
• Subsystem: fs.chownSync

What steps will reproduce the bug?

Setup a node instance,

» node

and run the following javascript code.

fs.chownSync("",-1, -1)

Then the node instance crashes.

How often does it reproduce? Is there a required condition?

This abort can always be triggered following the steps above.

What is the expected behavior?

If any error occurs, an exception or other similar error-reporting stuff should be thrown. There is no reason to abort the whole node process.

What do you see instead?

» node
Welcome to Node.js v14.15.1.
Type ".help" for more information.
> fs.chownSync("",-1, -1)
node[51145]: ../src/node_file.cc:2179:void node::fs::Chown(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `args[1]->IsUint32()' failed.
 1: 0xa03530 node::Abort() [node]
 2: 0xa035ae  [node]
 3: 0xa0d54a  [node]
 4: 0xbe369b  [node]
 5: 0xbe4c46  [node]
 6: 0xbe52c6 v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) [node]
 7: 0x13ff259  [node]                                                                                                                                                                                                                      

Additional information

[aduh95]

Can reproduce on master:

> out/Release/node -e 'fs.chownSync("",-1, -1)' 
out/Release/node[42049]: ../src/node_file.cc:2187:void node::fs::Chown(const FunctionCallbackInfo<v8::Value> &): Assertion `args[1]->IsUint32()' failed.
 1: 0x10aedc895 node::Abort() […/out/Release/node]
 2: 0x10aedc701 node::Assert(node::AssertionInfo const&) […/out/Release/node]
 3: 0x10aef14ed node::fs::Chown(v8::FunctionCallbackInfo<v8::Value> const&) […/out/Release/node]
 4: 0x10b0c1e5a v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo) […/out/Release/node]
 5: 0x10b0c1438 v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) […/out/Release/node]
 6: 0x10b0c09ff v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) […/out/Release/node]
 7: 0x10b9399b9 Builtins_CEntry_Return1_DontSaveFPRegs_ArgvOnStack_BuiltinExit […/out/Release/node]
 8: 0x10b8d43e5 Builtins_InterpreterEntryTrampoline […/out/Release/node]
[2]    42049 abort      out/Release/node -e 'fs.chownSync("",-1, -1)'
> out/Release/node -e 'fs.chown("",-1, -1, Function.prototype)' 
out/Release/node[42085]: ../src/node_file.cc:2187:void node::fs::Chown(const FunctionCallbackInfo<v8::Value> &): Assertion `args[1]->IsUint32()' failed.
 1: 0x106a16895 node::Abort() […/out/Release/node]
 2: 0x106a16701 node::Assert(node::AssertionInfo const&) […/out/Release/node]
 3: 0x106a2b4ed node::fs::Chown(v8::FunctionCallbackInfo<v8::Value> const&) […/out/Release/node]
 4: 0x106bfbe5a v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo) […/out/Release/node]
 5: 0x106bfb438 v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) […/out/Release/node]
 6: 0x106bfa9ff v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) […/out/Release/node]
 7: 0x1074739b9 Builtins_CEntry_Return1_DontSaveFPRegs_ArgvOnStack_BuiltinExit […/out/Release/node]
 8: 0x10740e3e5 Builtins_InterpreterEntryTrampoline […/out/Release/node]
[2]    42085 abort      out/Release/node -e 'fs.chown("",-1, -1, Function.prototype)'

fsPromises methods are not impacted:

> out/Release/node -e 'fs.promises.chown("",-1, -1)'            
node:internal/process/promises:245
          triggerUncaughtException(err, true /* fromPromise */);
          ^

RangeError [ERR_OUT_OF_RANGE]: The value of "uid" is out of range. It must be >= 0 && < 4294967296. Received -1
    at Object.chown (node:internal/fs/promises:637:3)
    at [eval]:1:13
    at Script.runInThisContext (node:vm:131:12)
    at Object.runInThisContext (node:vm:308:38)
    at node:internal/process/execution:77:19
    at [eval]-wrapper:6:22
    at evalScript (node:internal/process/execution:76:60)
    at node:internal/main/eval_string:23:3 {
  code: 'ERR_OUT_OF_RANGE'
}
> out/Release/node -e 'fs.promises.open("/dev/null").then(fh=>fh.chown(-1, -1))'  
node:internal/process/promises:245
          triggerUncaughtException(err, true /* fromPromise */);
          ^

RangeError [ERR_OUT_OF_RANGE]: The value of "uid" is out of range. It must be >= 0 && < 4294967296. Received -1
    at fchown (node:internal/fs/promises:630:3)
    at fsCall (node:internal/fs/promises:265:18)
    at FileHandle.chown (node:internal/fs/promises:126:12)
    at [eval]:1:43 {
  code: 'ERR_OUT_OF_RANGE'
}

[RaisinTen]

PR: #38004