fix(runtime): zero the whole return slot for empty callback results

ArgConverter::SetValue wrote a single ffi_arg when a JS callback returned
null, undefined or a revoked Proxy, so struct-valued returns handed native
code stale bytes past the first word. Callers now pass cif->rtype->size
and the empty branch clears the full slot.

Author: edusperoni

NativeScript/runtime/ArgConverter.h

@@ -71,8 +71,10 @@ class ArgConverter {
   static const ProtocolMeta* FindProtocolMeta(Protocol* protocol);
   static void MethodCallback(ffi_cif* cif, void* retValue, void** argValues,
                              void* userData);
+  // returnSize is the ABI size of the return slot (cif->rtype->size); an
+  // empty, null or undefined value zeroes all of it.
   static void SetValue(v8::Local<v8::Context> context, void* retValue,
-                       v8::Local<v8::Value> value,
+                       size_t returnSize, v8::Local<v8::Value> value,
                        const TypeEncoding* typeEncoding);
   // Returns (lazily creating) the per-isolate interop.escapeException brand
   // private stored in Caches. Empty handle if the isolate cache is invalid.

NativeScript/runtime/ArgConverter.mm

@@ -1,5 +1,6 @@
 #include "ArgConverter.h"
 #include <Foundation/Foundation.h>
+#include <algorithm>
 #include <sstream>
 #include "DictionaryAdapter.h"
 #include "Helpers.h"
@@ -438,7 +439,7 @@
       if (!success) {
         memset(retValue, 0, cif->rtype->size);
       } else {
-        ArgConverter::SetValue(context, retValue, result, data->typeEncoding_);
+        ArgConverter::SetValue(context, retValue, cif->rtype->size, result, data->typeEncoding_);
       }
     } else {
       memset(retValue, 0, cif->rtype->size);
@@ -450,18 +451,18 @@
   }
 }
 
-void ArgConverter::SetValue(Local<Context> context, void* retValue, Local<Value> value,
-                            const TypeEncoding* typeEncoding) {
+void ArgConverter::SetValue(Local<Context> context, void* retValue, size_t returnSize,
+                            Local<Value> value, const TypeEncoding* typeEncoding) {
   if (typeEncoding->type == BinaryTypeEncodingType::VoidEncoding) {
     return;
   }
 
   // Runs inside an ffi closure, where a C++ throw cannot propagate; a revoked
-  // proxy returns nil.
+  // proxy returns nil. libffi sizes the return slot to at least ffi_arg even
+  // for narrower types, and the full slot must be written.
   value = tns::UnwrapProxy(value);
   if (value.IsEmpty() || value->IsNullOrUndefined()) {
-    void* nullPtr = nullptr;
-    *(ffi_arg*)retValue = (unsigned long)nullPtr;
+    memset(retValue, 0, std::max(returnSize, sizeof(ffi_arg)));
     return;
   }
 

NativeScript/runtime/ClassBuilder.mm

@@ -931,7 +931,7 @@ void ScopeClassNameToIsolate(std::string& name, int isolateId) {
             memset(retValue, 0, cif->rtype->size);
           } else {
             const TypeEncoding* typeEncoding = context->meta_->getter()->encodings()->first();
-            ArgConverter::SetValue(v8Context, retValue, res, typeEncoding);
+            ArgConverter::SetValue(v8Context, retValue, cif->rtype->size, res, typeEncoding);
           }
         }
         if (pendingThrow != nil) {

NativeScript/runtime/MetadataBuilder.mm

@@ -1280,7 +1280,7 @@ CMethodCall methodCall(context, item->userData_, typeEncoding, args,
           memset(retValue, 0, cif->rtype->size);
         } else {
           const TypeEncoding* typeEncoding = context->meta_->getter()->encodings()->first();
-          ArgConverter::SetValue(v8Context, retValue, res, typeEncoding);
+          ArgConverter::SetValue(v8Context, retValue, cif->rtype->size, res, typeEncoding);
         }
       }
       if (pendingThrow != nil) {

TestRunner/app/tests/ProxyReceiverTests.js

@@ -145,6 +145,23 @@ describe(module.id, function () {
         }).toThrowError(TypeError, /not a native object/);
     });
 
+    it("zeroes a struct return when a callback returns a revoked proxy", function () {
+        var revocable = Proxy.revocable(CGRectMake(1, 2, 3, 4), {});
+        revocable.revoke();
+
+        [revocable.proxy, null].forEach(function (returned) {
+            var rect = getStructFromCallback(new interop.FunctionReference(function () {
+                return returned;
+            }));
+
+            expect(rect instanceof CGRect).toBe(true);
+            expect(rect.origin.x).toBe(0);
+            expect(rect.origin.y).toBe(0);
+            expect(rect.size.width).toBe(0);
+            expect(rect.size.height).toBe(0);
+        });
+    });
+
     it("releases the native counterpart of the proxy target", function () {
         var target = NSMutableString.alloc().init();
         var proxy = new Proxy(target, {});