lib: validate sequence iterator objects

Reject primitive iterator factory results before accessing next, as
required by GetIteratorFromMethod.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #65844
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>

Author: panva

lib/internal/webidl.js

@@ -835,7 +835,12 @@ function createSequenceConverter(converter) {
 
     // Step 4 and create-sequence step 1: get the iterator record.
     const iterator = FunctionPrototypeCall(method, V);
-    const nextMethod = iterator?.next;
+    if (type(iterator) !== 'Object') {
+      throw makeException(
+        'cannot be converted to sequence.',
+        options);
+    }
+    const nextMethod = iterator.next;
     if (typeof nextMethod !== 'function') {
       throw makeException(
         'cannot be converted to sequence.',

test/parallel/test-internal-webidl.js

@@ -510,6 +510,39 @@ assert.throws(() => webidl.requiredArguments(1, 2, opts), {
   }), []);
 }
 
+for (const [prototype, value] of [
+  [Number.prototype, 1],
+  [String.prototype, 'iterator'],
+  [Boolean.prototype, true],
+  [BigInt.prototype, 1n],
+  [Symbol.prototype, Symbol()],
+]) {
+  let nextReads = 0;
+  Object.defineProperty(prototype, 'next', {
+    configurable: true,
+    get() {
+      nextReads++;
+      return () => ({ done: true });
+    },
+  });
+  try {
+    const iterable = { [Symbol.iterator]: () => value };
+    assertInvalidArgType(() => converters['sequence<DOMString>'](iterable));
+    assertInvalidArgType(() => structuredClone(null, { transfer: iterable }));
+    assert.strictEqual(nextReads, 0);
+  } finally {
+    delete prototype.next;
+  }
+}
+
+{
+  function iterator() {}
+  iterator.next = () => ({ done: true });
+  assert.deepStrictEqual(converters['sequence<DOMString>']({
+    [Symbol.iterator]: () => iterator,
+  }), []);
+}
+
 {
   class Example {
     #brand;