reinterpretation of a JS value as wrapped C++ object leads to seg faults

[theosotr]

Summary

Several native methods reinterpret a JavaScript value as a wrapped C++ object and then dereference the result without checking it. These methods can be reached from ordinary JavaScript with a receiver/argument of the wrong shape, causing a hard crash (SIGSEGV, exit 139).

Environment

• Package: tree-sitter (confirmed against current master, v0.25.1)
• Node: v24.21.0
• node-addon-api: ^8.5.0
• OS: Linux x64

Example programs

const Parser = require('tree-sitter');
const JavaScript = require('tree-sitter-javascript');
const { LookaheadIterator } = Parser;

const parser = new Parser();
parser.setLanguage(JavaScript);
const tree = parser.parse('1');

const desc = Object.getOwnPropertyDescriptor(LookaheadIterator.prototype, 'currentType');
desc.get.call(tree);            // SIGSEGV

const Parser = require('tree-sitter');
const { SyntaxNode, Tree } = Parser;

const fakeTree = Object.create(Tree.prototype);
SyntaxNode.prototype.toString.call({ tree: fakeTree });   // SIGSEGV

const Parser = require('tree-sitter');
const JavaScript = require('tree-sitter-javascript');

const parser = new Parser();
parser.setLanguage(JavaScript);
const tree = parser.parse('function foo(a, b) { return a + b; } let x = foo(1,2);');
const cursor = tree.walk();

cursor.resetTo(tree);           // type confusion
cursor.gotoFirstChild();
cursor.currentNode();           // SIGSEGV / garbage

Each program crashes the process with SIGSEGV (exit 139); (3) is heap-dependent and crashes in the large majority of runs, otherwise returns corrupted cursor state.

Expected behaviour

Reaching any of these with a wrong receiver/argument should raise a catchable TypeError, not crash (or silently corrupt) the host process.

I have a patch ready and will open a PR.