child_process: spawn() does not throw TypeError

Ensure TypeError is thrown, fix a bug where `env` option was
assuming the option was actually an object.

This case is especially bad because it then sets `env == null`
instead of using `process.env`.

Fix #7456

Signed-off-by: Fedor Indutny <fedor@indutny.com>

2 files changed, 47 insertions, 1 deletions

diff --git a/lib/child_process.js b/lib/child_process.js
index 70893e0a3c..5e3eeaf02e 100644
--- a/lib/child_process.js
+++ b/lib/child_process.js
@@ -710,6 +710,10 @@ var spawn = exports.spawn = function(file /*, args, options*/) {
   if (Array.isArray(arguments[1])) {
     args = arguments[1].slice(0);
     options = arguments[2];
+  } else if (arguments[1] && !Array.isArray(arguments[1])) {
+    args = [];
+    options = arguments[2];
+    throw new TypeError('Incorrect value of args option');
   } else {
     args = [];
     options = arguments[1];
@@ -717,7 +721,7 @@ var spawn = exports.spawn = function(file /*, args, options*/) {
 
   args.unshift(file);
 
-  var env = (options ? options.env : null) || process.env;
+  var env = (options && options.env ? options.env : null) || process.env;
   var envPairs = [];
   for (var key in env) {
     envPairs.push(key + '=' + env[key]);
diff --git a/test/simple/test-child-process-spawn-typeerror.js b/test/simple/test-child-process-spawn-typeerror.js
new file mode 100644
index 0000000000..791adcbc20
--- /dev/null
+++ b/test/simple/test-child-process-spawn-typeerror.js
@@ -0,0 +1,42 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+var spawn = require('child_process').spawn,
+  assert = require('assert'),
+  windows = (process.platform === 'win32'),
+  cmd = (windows) ? 'ls' : 'dir',
+  errors = 0;
+
+try {
+  // Ensure this throws a TypeError
+  var child = spawn(cmd, 'this is not an array');
+
+  child.on('error', function (err) {
+    errors++;
+  });
+
+} catch (e) {
+  assert.equal(e instanceof TypeError, true);
+}
+
+process.on('exit', function() {
+  assert.equal(errors, 0);
+});