node:buffer: round an odd byteOffset up for a forward UTF-16 string search by robobun · Pull Request #47260 · oven-sh/bun

robobun · 2026-10-28T23:01:27Z

Problem

Buffer indexOf and includes with a string needle, a UTF-16 encoding, and an odd byteOffset return a match before byteOffset. Buffer.from("abcabc", "utf16le").indexOf("abc", 1, "ucs2") is 0. Node.js v26.12.1, the version main reports, returns 6.
The cause is byteOffset /= 2 in indexOf16 (src/jsc/bindings/JSBuffer.cpp:1626). Node.js rounds up since v26.11.0 (buffer: fix odd UTF-16LE indexOf start nodejs/node#65960).
A differential run found this. No user reported it. Node.js 24.x and 22.x still round down.

Fix

indexOfString rounds the offset up to the next even byte before a forward UTF-16 search. Node.js has the rule only in IndexOfString (node_buffer.cc#L1089-L1092).
A Buffer or Uint8Array needle and lastIndexOf still round down, as in Node.js.
Verified: test/js/node/buffer.test.js (new block, 73 of 160 assertions fail on bun 1.4.3) and test-buffer-indexof.js, synced to v26.12.1.
Self-reviewed: 13 concerns raised, 13 addressed.

Background

A UTF-16 search compares 16-bit code units, so a match starts at an even byte. An odd byteOffset is inside a unit.
Considered the round up in indexOf16 or computeIndexOfRange. Both also serve buffer needles, where Node.js keeps the round down, so each needs a flag.

Downsides

Behavior change: code that relied on the match before an odd offset gets the next match or -1. 2,064 of 1,527,876 results of a differential run change.
Cost: +1 instruction and +3 bytes on the forward UTF-16 string path, 0 on other paths. Measured on JSBuffer.cpp with release flags, no LTO.
The browser polyfill still throws RangeError for this input. node-fallbacks: fix lastIndexOf(value, encoding) and UTF-16 search offsets in the Buffer polyfill #43654 and node-fallbacks: match Node for empty/Uint8Array/end in browser Buffer indexOf #43876 rewrite its search with the old round down.

Notes

Repro

const b = Buffer.from("abcabc", "utf16le"); // 12 bytes: a.b.c.a.b.c.
console.log(b.indexOf("abc", 1, "ucs2"), b.includes("ca", 5, "ucs2"));
const found = [];
let i = -1;
while (found.length < 4 && (i = b.indexOf("abc", i + 1, "ucs2")) !== -1) found.push(i);
console.log(found);

Runtime	`indexOf("abc", 1, "ucs2")`	`includes("ca", 5, "ucs2")`	loop
bun 1.4.3, `main`, Node.js v26.3.0	`0`	`true`	`[0, 0, 0, 0]`
this PR, Node.js v26.12.1	`6`	`false`	`[0, 6]`

Where Node.js has the change

The upstream report is buffer.indexOf is incorrect in utf16le encoding for odd byteOffset nodejs/node#26448 (2019). buffer: fix odd UTF-16LE indexOf start nodejs/node#65960 changed IndexOfString and added two assertions to test/parallel/test-buffer-indexof.js.
src/node_buffer.cc has the round up at tags v26.11.0, v26.12.1 and v26.13.0, and on the v24.x-staging branch. It does not have it at v26.10.0, v24.22.2 or v22.23.4.
IndexOfBuffer and the backward search still use offset / 2 (node_buffer.cc#L1236).

Why the second line of the Node.js change is not here

Node.js also returns -1 when the rounded offset reaches search_end. Here the round up runs after computeIndexOfRange, which already requires that the needle fits before searchEnd. A UTF-16 string needle has an even length of 2 bytes or more, and searchEnd is even. So an odd offset that passes still fits after +1, and that return cannot fire.

Measurements

Cells that differ from Node.js v26.12.1: 2,064 -> 0 of 1,527,876. Cells that change against bun 1.4.3: 2,064, all indexOf or includes with a string needle, a UTF-16 encoding and an odd start. The run covers indexOf, lastIndexOf and includes, string, Buffer, Uint8Array and number needles, six UTF-16 spellings and four one-byte encodings, offsets from -15 to 15 plus fractions, NaN, infinities and booleans, fourteen end values, and even, odd and empty haystacks.
Per call: +1 instruction (incq) on forward UTF-16 string searches, +0 on every other search path, +0 branches. One shrq becomes sarq. This is the whole disassembly diff of JSBuffer.cpp built with the release flags, no LTO, merge base against this PR.
JSBuffer.cpp .text: +3 bytes (166,672 -> 166,675). WebCore::indexOf: +3 bytes (4,362 -> 4,365). Measured with llvm-size-23 and llvm-nm-23 on the same two objects.
Call instructions in JSBuffer.cpp: 2,089 before, 2,089 after. So the change adds 0 allocations, syscalls or queue entries per call.
New test: 73 of 160 assertions fail on bun 1.4.3 and 0 on this PR. A JavaScript model of the search with the round up at seven wrong places fails 6 to 18 of the 160 assertions each. The wrong places include the shared indexOf16, the shared computeIndexOfRange, the lastIndexOf arm, and a position before the empty needle return.
A Buffer view that starts at an odd address: 0 of 15,664 cells differ from a brute-force oracle, and ASAN reports nothing. Node.js hangs on this input (buffer: UTF-16LE indexOf can hang on unaligned Buffer views nodejs/node#65959), so it is not in the differential run.

Tests

bun bd test test/js/node/buffer.test.js: 720 pass, with the new test and every other indexOf, lastIndexOf and includes test among them. 2 tests time out at 5 s on the local debug build with ASAN: the fill() comparison that starts Node.js, and the SharedArrayBuffer decoder test. Neither calls indexOf. A local build of main times out on 4 tests of this kind.
test/js/node/test/parallel/test-buffer-indexof.js is the upstream file at v26.12.1 plus the existing local change for new Buffer.prototype.lastIndexOf. It fails on bun 1.4.3 at line 313 (0 !== 4) and passes on this PR.
It is the only one of the 8 test-buffer-*.js files that changed upstream since v26.3.0 which is now at the v26.12.1 text. The other 7 are still at the v26.3.0 text, so this PR does not bring node:buffer to v26.12.1. At the v26.12.1 text, 5 of them pass on this build. test-buffer-isascii.js and test-buffer-isutf8.js do not: isAscii and isUtf8 throw ERR_INVALID_STATE for a detached ArrayBuffer, and Node.js returns true since v26.8.0 (buffer: handle detached ArrayBuffer views nodejs/node#64504).
Also pass: test-buffer-includes.js, buffer-indexof-worstcase.test.ts, buffer-indexOf-detach.test.ts.

Related open PRs

node-fallbacks: fix lastIndexOf(value, encoding) and UTF-16 search offsets in the Buffer polyfill #43654 and node-fallbacks: match Node for empty/Uint8Array/end in browser Buffer indexOf #43876 rewrite the UTF-16 search of the browser polyfill. Both round the offset down, as Node.js did before v26.11.0. The test in node-fallbacks: fix lastIndexOf(value, encoding) and UTF-16 search offsets in the Buffer polyfill #43654 expects the line odd byteOffset 0 4 true. Node.js v26.12.1 prints odd byteOffset 6 4 true for the same code.
node:buffer: coerce end last in indexOf, lastIndexOf and includes #43522 adds a test after the same test in buffer.test.js. The one that merges second needs a rebase that keeps both tests.
node:buffer: keep a 64-bit search offset in indexOf, lastIndexOf and includes #46945 and node:buffer: match Node on fill/compare start offsets, detached indexOf, and inspect extras #41498 change other lines of the same search code.

no test proof · iteration 0 · platform-specific test(s) that do not run on this machine, deferring to CI, which covers all platforms: test/js/node/buffer.test.js

…earch Buffer.prototype.indexOf and includes with a string needle and a UTF-16 encoding rounded an odd byteOffset down to the code unit before it, so the match could begin before byteOffset: Buffer.from("abcabc", "utf16le").indexOf("abc", 1, "ucs2") // 0, now 6 Node.js rounds the offset up since v26.11.0 (nodejs/node#65960). The rule lives in IndexOfString only. A Buffer or Uint8Array needle and lastIndexOf still round down, in Node.js and here. Sync test/js/node/test/parallel/test-buffer-indexof.js to Node.js v26.12.1. The local change for `new Buffer.prototype.lastIndexOf` stays.

coderabbitai · 2026-10-28T23:01:37Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 34 seconds.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

Source mode: Auto
Repository: oven-sh/bun
Branch: robobun/09258b30/buffer-indexof-utf16-odd-offset
File: .coderabbit.yaml
Commit: 721299d
Layers: Repository YAML
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 34ba8e7c-d760-4aa4-9304-7be949df4344

Commits

Reviewing files that changed from the base of the PR and between da867c6 and 721299d.

Files selected for processing: 3

src/jsc/bindings/JSBuffer.cpp
test/js/node/buffer.test.js
test/js/node/test/parallel/test-buffer-indexof.js

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

robobun · 2026-10-28T23:01:41Z

^{Updated 9:06 AM PT - Oct 29th, 2026}

❌ @robobun, your commit 721299d has 2 failures in Build #135155 (All Failures):

step failed outside runner - exit 1 on 🍎 27 aarch64 - test-bun
Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 aarch64 - verify-baseline

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 aarch64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 3.23 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 3.23 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 3.23 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 3.23 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 3.23 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 3.23 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 3.23 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 3.23 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 3.23 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 x64 - test-bun

CapacityLimitExceeded

Failed to create agent for 🐧 13 x64 - cargo-test

CapacityLimitExceeded

Failed to create agent for 🐧 25.04 x64 - test-bun

CapacityLimitExceeded

🧪 To try this PR locally:

bunx bun-pr 47260

That installs a local version of the PR into your bun-47260 executable, so you can run:

bun-47260 --bun

claude

LGTM — a one-line port of Node's forward UCS2 odd-offset round-up, scoped to the string-needle path as upstream is.

What was reviewed:

Bounds after the round-up: computeIndexOfRange already enforces offset + needleLength <= searchEnd, and with searchEnd masked even and a UTF-16 string needle always an even length >= 2, an odd offset that passes still fits after +1, so indexOf16's haystack length cannot underflow.
Sibling sites: lastIndexOf16 and the Buffer/Uint8Array-needle path in indexOfBuffer keep the round-down, matching Node's lastIndexOf and IndexOfBuffer; the test block asserts both negatively.
Traced the new assertions (negative offsets, odd end, odd-length haystack, empty needle) by hand through computeIndexOfRange/indexOf16 — values match the expected results.
The vendored test-buffer-indexof.js hunks are additive upstream syncs, no existing assertions weakened.

Extended reasoning...

The change adds one line in indexOfString in src/jsc/bindings/JSBuffer.cpp that rounds an odd byteOffset up to even before a forward UTF-16 string search, plus a Bun test block in test/js/node/buffer.test.js and two additive hunks in the vendored test/js/node/test/parallel/test-buffer-indexof.js. It touches Buffer search index arithmetic but no auth, crypto, or injection surface. The round-up runs after computeIndexOfRange's range validation, and the even-needle/even-searchEnd invariant means the rounded offset cannot push the search past the buffer. The bug hunt ran dry with no findings, the three ruled-out candidates all checked out on reading, no CODEOWNER covers the changed files, and the PR has no outstanding reviewer objections.

robobun · 2026-10-28T23:12:33Z

Status: ready for review. This PR has the fix, and its tests pass in CI.

How I reproduced it:

console.log(Buffer.from("abcabc", "utf16le").indexOf("abc", 1, "ucs2"));

bun 1.4.3, main, and Node.js v26.3.0 print 0.
Node.js v26.12.1 and this PR print 6.
USE_SYSTEM_BUN=1 bun test test/js/node/buffer.test.js -t "starts at the next code unit" fails (Expected: 6, Received: 0).
bun bd test test/js/node/buffer.test.js -t "starts at the next code unit" passes.

CI on 721299d9, the branch merged with main (build 135155, finished):

No test failed. Every test-bun job that ran passed: all 20 on Alpine aarch64, all 20 on Debian x64 with ASAN, all 16 on Windows, and 35 of 60 on Debian, Ubuntu and Alpine x64.
67 jobs did not start, because CI could not create agents (CapacityLimitExceeded from EC2). They include all Debian and Ubuntu aarch64 test jobs.
1 macOS job failed before the tests: the download of the build artifact timed out after 120 s. The 4 other macOS aarch64 jobs passed. The 4 macOS x64 jobs expired in the queue and did not run.

CI on af6d4536, before the merge (build 134781):

158 of 160 test-bun jobs passed: Debian, Ubuntu and Alpine on x64 and aarch64, Debian x64 with ASAN, Windows on x64 and aarch64, and macOS on aarch64. The 2 macOS x64 jobs expired in the queue.
The only red jobs were test-aot-drawn, a lane that main removed in AOT: fixes for modules, classes and Workers, WebKit upgrade, shorter compiler docs #47129. Its tests do not search a Buffer.

PR: #47260

…fset

robobun · 2026-10-29T11:38:53Z

Merged main (da867c6) into this branch so that CI runs on a green main. There was no conflict.

CI run 134781 was red for a reason outside this PR: only test/aot/* tests on the lane test-aot-drawn failed. The same families failed on main at this branch's old base (6c3d1bf, build 134576).
On a debug build of da867c6 with this branch and eight other open PRs merged in: the 12 indexOf tests of test/js/node/buffer.test.js pass, and test/js/node/test/parallel/test-buffer-indexof.js passes.
The full buffer.test.js gives 721 pass and 1 fail on that build. The fail is every fill() argument shape produces the same output in Node.js and Bun, which timed out at 5 s and passes in 4 s when it runs alone.

robobun assigned Jarred-Sumner Oct 28, 2026

github-actions Bot added the claude label Oct 28, 2026

claude Bot reviewed Oct 28, 2026

View reviewed changes

ci: retrigger

af6d453

robobun mentioned this pull request Oct 29, 2026

node-fallbacks: fix lastIndexOf(value, encoding) and UTF-16 search offsets in the Buffer polyfill #43654

Open

Merge branch 'main' into robobun/09258b30/buffer-indexof-utf16-odd-of…

721299d

…fset

Navigation Menu

Repository navigation

node:buffer: round an odd byteOffset up for a forward UTF-16 string search - #47260

node:buffer: round an odd byteOffset up for a forward UTF-16 string search#47260
robobun wants to merge 3 commits into
mainfrom
robobun/09258b30/buffer-indexof-utf16-odd-offset

robobun commented Oct 28, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

Review limit reached

Uh oh!

robobun commented Oct 28, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

robobun commented Oct 28, 2026 •

edited

Loading

Uh oh!

robobun commented Oct 29, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

robobun commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Background

Downsides

Uh oh!

coderabbitai Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

robobun commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

robobun commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

robobun commented Oct 29, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

robobun commented Oct 28, 2026 •

edited

Loading

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

robobun commented Oct 28, 2026 •

edited

Loading

robobun commented Oct 28, 2026 •

edited

Loading