Repository navigation
ffi: exportArrayBufferView() inconsistently handles detached views #65085
Description
Version
main
Platform
macOS 26.6.0
Subsystem
ffi
What steps will reproduce the bug?
repro.c
void* destination(void) {
static unsigned char byte;
return &byte;
}repro.js
import { dlopen, suffix, exportArrayBuffer, exportArrayBufferView } from 'node:ffi';
const { lib, functions } = dlopen(`./repro.${suffix}`, {
destination: { arguments: [], return: 'pointer' },
});
const pointer = functions.destination();
function detached(makeValue) {
const buffer = new ArrayBuffer(1);
const value = makeValue(buffer);
structuredClone(buffer, { transfer: [buffer] });
return value;
}
function run(name, fn) {
try {
fn();
console.log(`${name}: accepted`);
} catch (error) {
console.log(`${name}: ${error.code ?? error.name}: ${error.message}`);
}
}
run('ArrayBuffer', () => {
exportArrayBuffer(detached((buffer) => buffer), pointer, 1);
});
run('Uint8Array', () => {
exportArrayBufferView(
detached((buffer) => new Uint8Array(buffer)),
pointer,
1,
);
});
run('DataView', () => {
exportArrayBufferView(
detached((buffer) => new DataView(buffer)),
pointer,
1,
);
});
lib.close();Commands to run:
$ cc -dynamiclib -o repro.dylib repro.c
$ node --no-warnings --experimental-ffi repro.jsHow often does it reproduce? Is there a required condition?
Always
What is the expected behavior? Why is that the expected behavior?
All detached inputs should be rejected consistently, preferably with Node.js’s ERR_INVALID_ARG_VALUE.
What do you see instead?
ArrayBuffer: ERR_INVALID_ARG_VALUE: ArrayBuffer is detached
Uint8Array: accepted
DataView: TypeError: Cannot perform get DataView.prototype.byteLength on a detached or out-of-bounds ArrayBufferA detached ArrayBuffer produces ERR_INVALID_ARG_VALUE, a detached Uint8Array is accepted, and a detached DataView produces a V8 TypeError
Additional information
Noticed while working on #65082
Activity
ffi: reject detached ArrayBufferViews
ffi: reject detached ArrayBufferViews
ffi: reject detached ArrayBufferViews