Repository: node
Issue: FATAL ERROR when setting 'onread' of a socket
Labels: net

<!--
Thank you for reporting an issue.

This issue tracker is for bugs and issues found within Node.js core.
If you require more general support please file an issue on our help
repo. https://github.com/nodejs/help


Please fill in as much of the template below as you're able.

Version: output of `node -v`
Platform: output of `uname -a` (UNIX), or output of `"$([Environment]::OSVersion | ForEach-Object VersionString) $(if ([Environment]::Is64BitOperatingSystem) { "x64" } else { "x86" })"` in PowerShell console (Windows)
Subsystem: if known, please specify affected core module name
-->

* **Version**: v14.15.1, v12.20.0
* **Platform**: Linux laptop 5.8.0-43-generic #49-Ubuntu SMP Fri Feb 5 03:01:28 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
* **Subsystem**:

### What steps will reproduce the bug?

<!--
Enter details about your bug, preferably a simple code snippet that can be
run using `node` directly without installing third-party dependencies.
-->

```js
var net = require('net');
var socket = net.connect();
socket[Object.getOwnPropertySymbols(socket)[1]].onread = null;
```

### How often does it reproduce? Is there a required condition?

Always

### What is the expected behavior?

<!--
If possible please provide textual output instead of screenshots.
-->

A Type Error should be thrown.

### What do you see instead?

<!--
If possible please provide textual output instead of screenshots.
-->

```
node[148008]: ../src/base_object-inl.h:177:static void node::BaseObject::InternalFieldSet(v8::Local<v8::String>, v8::Local<v8::Value>, const v8::PropertyCallbackInfo<void>&) [with int Field = 2; bool (v8::Value::* typecheck)() const = &v8::Value::IsFunction]: Assertion `((*value)->*typecheck)()' failed.
 1: 0xa03530 node::Abort() [node]
 2: 0xa035ae  [node]
 3: 0xad1fe2  [node]
 4: 0xf24a1e v8::internal::Object::SetPropertyWithAccessor(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>) [node]
 5: 0xf44963 v8::internal::Object::SetPropertyInternal(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>, v8::internal::StoreOrigin, bool*) [node]
 6: 0xf44f32 v8::internal::Object::SetProperty(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) [node]
 7: 0xdd414f v8::internal::StoreIC::Store(v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Name>, v8::internal::Handle<v8::internal::Object>, v8::internal::StoreOrigin) [node]
 8: 0xdd4a76 v8::internal::Runtime_StoreIC_Miss(int, unsigned long*, v8::internal::Isolate*) [node]
 9: 0x13ff179  [node]
Aborted (core dumped)
```

### Additional information

<!--
Tell us anything else you think we should know.
-->

Alternative POC:

```js
var net = require('net');
net.createServer().listen()._handle.onread = 1;
```

Unexpectedly also crashes when assigning to a newly created object, sharing the 0th, 1st, or 2nd prototype.

```js
var net = require('net');
var socket = net.connect();
var object = Object.create(Object.getPrototypeOf(socket[Object.getOwnPropertySymbols(socket)[1]]))
object.onread = null;
// also crashes:
//var object = Object.create(socket[Object.getOwnPropertySymbols(socket)[1]])
//var object = Object.create(Object.getPrototypeOf(Object.getPrototypeOf(socket[Object.getOwnPropertySymbols(socket)[1]])))
// does not crash:
//var object = Object.create(Object.getPrototypeOf(Object.getPrototypeOf(Object.getPrototypeOf(socket[Object.getOwnPropertySymbols(socket)[1]]))))
```

Alternative error:

```js
var net = require('net');
var clone = require('clone');
clone(net.connect());
```

```
FATAL ERROR: v8::Object::SetInternalField() Internal field out of bounds
 1: 0xa03530 node::Abort() [node]
 2: 0x94e471 node::FatalError(char const*, char const*) [node]
 3: 0xb7745a v8::Utils::ReportApiFailure(char const*, char const*) [node]
 4: 0xb774e5  [node]
 5: 0xb8c5c4 v8::Object::SetInternalField(int, v8::Local<v8::Value>) [node]
 6: 0xf24a1e v8::internal::Object::SetPropertyWithAccessor(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>) [node]
 7: 0xf44963 v8::internal::Object::SetPropertyInternal(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>, v8::internal::StoreOrigin, bool*) [node]
 8: 0xf44f32 v8::internal::Object::SetProperty(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) [node]
 9: 0x106e945 v8::internal::Runtime::SetObjectProperty(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) [node]
10: 0x106f9e7 v8::internal::Runtime_SetKeyedProperty(int, unsigned long*, v8::internal::Isolate*) [node]
11: 0x13ff179  [node]
Aborted (core dumped)
```

The following issues are related:

* https://github.com/nodejs/node/issues/32568
* https://github.com/pvorb/clone/issues/106
* https://github.com/pvorb/clone/issues/115