node:fs: validate buffer type before offset in fs.read/readSync

src/runtime/node/node_fs.rs

@@ -3905,6 +3905,9 @@
             let buffer_value = arguments.next_eat().ok_or_else(||
                 // theoretically impossible, argument has been passed already
                 ctx.throw_invalid_arguments(format_args!("buffer is required")))?;
+            let buffer = Buffer::from_js(ctx, buffer_value).ok_or_else(|| {
+                ctx.throw_invalid_argument_type_value(b"buffer", b"TypedArray", buffer_value)
+            })?;
 
             let offset_value = arguments.next_eat().unwrap_or(JSValue::NULL);
             // if (offset == null) {
@@ -3931,9 +3934,10 @@
             } else {
                 0.0
             };
-            let buffer = Buffer::from_js(ctx, buffer_value).ok_or_else(|| {
-                ctx.throw_invalid_argument_type_value(b"buffer", b"TypedArray", buffer_value)
-            })?;
+            // `length.toNumber()` can re-enter JS and detach `buffer_value`; re-snapshot
+            // the backing store so the subsequent bounds checks and the read itself see
+            // the post-coercion length/pointer. The type check above cannot change.
+            let buffer = Buffer::from_js(ctx, buffer_value).unwrap_or(buffer);
 
             //   if (length === 0) {
             //     return process.nextTick(function tick() {

test/js/node/fs/fs.test.ts

@@ -1262,6 +1262,37 @@
     }
   });
 
+  it("throws ERR_INVALID_ARG_TYPE for a non-buffer before validating offset", () => {
+    // Node's validateBuffer runs before validateInteger(offset, ...). When both
+    // arguments are invalid the buffer-type error must win.
+    let err: any;
+    try {
+      readSync(0, "not a buffer" as any, -1, 5);
+    } catch (e) {
+      err = e;
+    }
+    expect({ code: err?.code, message: err?.message }).toEqual({
+      code: "ERR_INVALID_ARG_TYPE",
+      message: expect.stringContaining('"buffer"'),
+    });
+    // Same ordering when offset is a non-numeric type.
+    expect(() => readSync(0, 123 as any, "bad" as any, 5)).toThrowWithCode(TypeError, "ERR_INVALID_ARG_TYPE");
+  });
+
+  it("throws ERR_INVALID_ARG_TYPE for a non-buffer before validating offset (async)", () => {
+    // Node throws validation errors synchronously from fs.read().
+    let err: any;
+    try {
+      fs.read(0, "not a buffer" as any, -1, 5, 0, () => {});
+    } catch (e) {
+      err = e;
+    }
+    expect({ code: err?.code, message: err?.message }).toEqual({
+      code: "ERR_INVALID_ARG_TYPE",
+      message: expect.stringContaining('"buffer"'),
+    });
+  });
+
   const firstFourBytes = new Uint32Array(new TextEncoder().encode("File").buffer)[0];
 
   it("works on large files", () => {