src: fix crash when reading length on Storage.prototype

Signed-off-by: Mohamed Sayed <k@3zrv.com>
PR-URL: #63529
Fixes: #63514
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: 3zrv

src/node_webstorage.cc

@@ -43,6 +43,7 @@ using v8::PropertyAttribute;
 using v8::PropertyCallbackInfo;
 using v8::PropertyDescriptor;
 using v8::PropertyHandlerFlags;
+using v8::Signature;
 using v8::String;
 using v8::Value;
 
@@ -737,8 +738,9 @@ static void Initialize(Local<Object> target,
       Local<Value>(),
       PropertyHandlerFlags::kHasNoSideEffect));
 
-  Local<FunctionTemplate> length_getter =
-      FunctionTemplate::New(isolate, StorageLengthGetter);
+  Local<Signature> length_signature = Signature::New(isolate, ctor_tmpl);
+  Local<FunctionTemplate> length_getter = FunctionTemplate::New(
+      isolate, StorageLengthGetter, Local<Value>(), length_signature);
   ctor_tmpl->PrototypeTemplate()->SetAccessorProperty(env->length_string(),
                                                       length_getter,
                                                       Local<FunctionTemplate>(),

test/parallel/test-webstorage.js

@@ -51,6 +51,28 @@ test('Storage instances cannot be created in userland', async () => {
   assert.match(cp.stderr, /Error: Illegal constructor/);
 });
 
+test('calling "length" getter on invalid this throws', async () => {
+  const cp = await spawnPromisified(process.execPath, [
+    '--no-warnings',
+    '--experimental-webstorage', '-e', `(${function() {
+      // eslint-disable-next-line node-core/must-call-assert
+      assert.throws(() => Storage.prototype.length, TypeError);
+      const { get } = Object.getOwnPropertyDescriptor(Storage.prototype, 'length');
+      for (const thisArg of [null, undefined, 1n, -0, NaN, true, false, '', [], {}, Symbol()]) {
+        // eslint-disable-next-line node-core/must-call-assert
+        assert.throws(() => get.call(thisArg), TypeError);
+      }
+    }})();`,
+  ]);
+
+  assert.deepStrictEqual(cp, {
+    code: 0,
+    signal: null,
+    stdout: '',
+    stderr: '',
+  });
+});
+
 test('sessionStorage is not persisted', async () => {
   let cp = await spawnPromisified(process.execPath, [
     '--experimental-webstorage', '-pe', 'sessionStorage.foo = "barbaz"',