Repository navigation
ffi: Detached ArrayBuffers and views are silently converted to null FFI pointers #65082
Description
Version
main
Platform
macOS 26.6.0
Subsystem
ffi
What steps will reproduce the bug?
repro.c
#include <stdint.h>
uint64_t pointer_to_usize(void* ptr) {
return (uint64_t)(uintptr_t)ptr;
}repro.js
import { resolve } from 'node:path';
import { dlopen, suffix, getRawPointer } from 'node:ffi';
const { lib, functions } = dlopen(
resolve(`repro.${suffix}`),
{
pointer_to_usize: {
arguments: ['pointer'],
return: 'u64',
},
},
);
const arrayBuffer = new ArrayBuffer(8);
const typedArray = new Uint8Array(arrayBuffer);
const dataView = new DataView(arrayBuffer);
structuredClone(arrayBuffer, { transfer: [arrayBuffer] });
function show(label, operation) {
try {
console.log(label, operation());
} catch (error) {
console.log(label, error.code);
}
}
try {
for (const [name, value] of [
['ArrayBuffer', arrayBuffer],
['Uint8Array', typedArray],
['DataView', dataView],
]) {
show(`getRawPointer(${name})`, () => getRawPointer(value));
show(`pointer_to_usize(${name})`, () =>
functions.pointer_to_usize(value));
}
} finally {
lib.close();
}Commands to run
$ cc -dynamiclib -o repro.dylib repro.c
$ node --no-warnings --experimental-ffi repro.jsHow often does it reproduce? Is there a required condition?
Always
What is the expected behavior? Why is that the expected behavior?
Each operation should throw ERR_INVALID_ARG_VALUE, consistent with ExportBytes() rejecting detached buffers and views.
What do you see instead?
getRawPointer(ArrayBuffer) 0n
pointer_to_usize(ArrayBuffer) 0n
getRawPointer(Uint8Array) 0n
pointer_to_usize(Uint8Array) 0n
getRawPointer(DataView) 0n
pointer_to_usize(DataView) 0nAll six operations return 0n, silently treating detached memory as a null pointer.
Additional information
No response
Activity
ffi: reject detached ArrayBuffers as pointers
ffi: reject detached ArrayBuffers as pointers
ffi: reject detached ArrayBuffers as pointers