fs: fix crash on negative zero file descriptor

`isInt32()` accepts -0 because `-0 === (-0 | 0)`, but V8 does not
represent -0 as an Int32 value, so `Value::IsInt32()` rejects it. The
utf8 fast paths of `readFileSync()` and `writeFileSync()` hand the value
straight to the binding, which then took it for a path and aborted on
the null check.

Coerce -0 to 0 before the call, matching `getValidatedFd()` and the rest
of fs, where -0 is a valid way to name file descriptor 0.

Signed-off-by: Christian Aurich <christian.aurichzm@gmail.com>
PR-URL: #65888
Fixes: #65886
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>

Author: christianaurichzm

lib/fs.js

@@ -477,7 +477,11 @@ function readFileSync(path, options) {
 
   if ((options.encoding === 'utf8' || options.encoding === 'utf-8') &&
       !hasUserBuffer) {
-    if (!isInt32(path)) {
+    if (isInt32(path)) {
+      // V8 does not report -0 as an int32, so it would reach the binding as a
+      // path instead of a file descriptor.
+      path |= 0;
+    } else {
       path = getValidatedPath(path);
     }
     return binding.readFileUtf8(path, stringToFlags(options.flag));
@@ -2475,7 +2479,11 @@ function writeFileSync(path, data, options) {
 
   // C++ fast path for string data and UTF8 encoding
   if (typeof data === 'string' && (options.encoding === 'utf8' || options.encoding === 'utf-8')) {
-    if (!isInt32(path)) {
+    if (isInt32(path)) {
+      // V8 does not report -0 as an int32, so it would reach the binding as a
+      // path instead of a file descriptor.
+      path |= 0;
+    } else {
       path = getValidatedPath(path);
     }
 

test/parallel/test-fs-negative-zero.js

@@ -2,6 +2,8 @@
 
 require('../common');
 
+const assert = require('assert');
+const { spawnSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
@@ -29,5 +31,18 @@ ignoreExpectedError(() => fs.mkdirSync(missing, { mode: -0 }));
 ignoreExpectedError(() => fs.chmodSync(missing, -0));
 ignoreExpectedError(() => fs.writeFileSync(missing, '', { mode: -0 }));
 
+// -0 is accepted as file descriptor 0. Writing an empty string reaches the
+// utf8 fast path without issuing a write on the descriptor.
+fs.writeFileSync(-0, '');
+fs.appendFileSync(-0, '');
+
+const child = spawnSync(
+  process.execPath,
+  ['-e', 'process.stdout.write(require("fs").readFileSync(-0, "utf8"))'],
+  { input: 'hello' },
+);
+assert.strictEqual(child.status, 0);
+assert.strictEqual(child.stdout.toString(), 'hello');
+
 fs.watchFile(missing, { interval: -0 }, () => {});
 fs.unwatchFile(missing);