Repository navigation
net: onread can modify buffers made immutable after registration #67397
Description
Version
v28.0.0-pre
Platform
macos 26.6.2, arm64 (darwin 25.6.0)
Subsystem
net
What steps will reproduce the bug?
save this as repro.cjs and run with:
./node --js-immutable-arraybuffer repro.cjsconst net = require('node:net');
const server = net.createServer((socket) => socket.end('test'));
server.listen(0, '127.0.0.1', () => {
const buffer = new Uint8Array(4);
let immutable;
const socket = net.connect({
host: '127.0.0.1',
port: server.address().port,
onread: {
buffer,
callback(nread) {
console.log('bytes read:', nread);
console.log('old view length:', buffer.byteLength);
console.log('immutable:', immutable.immutable);
console.log('after:', [...new Uint8Array(immutable)]);
socket.end();
},
},
});
socket.on('close', () => server.close());
immutable = buffer.buffer.transferToImmutable();
console.log('before:', [...new Uint8Array(immutable)]);
});How often does it reproduce? Is there a required condition?
always
What is the expected behavior? Why is that the expected behavior?
after transferToImmutable() succeeds, incoming data must not change
the returned arraybuffer's bytes.
What do you see instead?
before: [ 0, 0, 0, 0 ]
bytes read: 4
old view length: 0
immutable: true
after: [ 116, 101, 115, 116 ]
the old view is detached, but incoming data still changes the new
immutable arraybuffer.
Additional information
i found this while working on #67394. that pr checks buffers when they
are supplied, so it doesn't catch a transfer after registration.
the native listener keeps using the cached address:
UseUserBuffer
OnStreamAlloc
related: #66346
i'm planning to work on a fix.
Activity