• Version: 6.9.2 -> 7.2.0
• Platform: Linux
• Subsystem:

Buffer::Length hard crashes.

I know that there are other issues where what to do about crashing bugs is being discussed, but I think most of the other examples are code directly accessible to JavaScript via process.binding. Here is an example that is something more subtle, but nevertheless can be triggered.

const dgram = require('dgram');
const util = require('util');
// Create object that passes instanceof Buffer check
function FakeBuffer() { }
util.inherits(FakeBuffer, Buffer);
const message = new FakeBuffer();
// Pass object to code that eventually calls Length
dgram.createSocket('udp4'). send(message, 41234, 'localhost', _ => {});