ffi: fix optimized buffer conversions

Preserve pointer-like argument conversions for buffer and arraybuffer
signatures after Fast API optimization. Keep memory-backed arguments
on the specialized native fast path.
Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.6-sol
PR-URL: #64639Fixes: #64638
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Aviv Keller <me@aviv.sh>

Author: trivikr

lib/ffi.js

@@ -68,7 +68,6 @@ const {
 }=require('internal/ffi-shared-buffer');
 
 const{
- initializeFastBufferMetadata,
  wrapWithRawPointerConversions,
 }=require('internal/ffi/fast-api');
 
@@ -90,7 +89,6 @@ function wrapFFIFunction(rawFn, owner) {
 returnType=rawFn[kSbReturn];
 }
 }
-initializeFastBufferMetadata(rawFn,argumentTypes);
 constwrapped=wrapWithSharedBuffer(
 rawFn,
 argumentTypes===undefined ? undefined : makeSignature(argumentTypes,returnType));

lib/internal/ffi/fast-api.js

@@ -6,7 +6,6 @@ const {
  ObjectDefineProperty,
  ReflectApply,
  StringPrototypeIncludes,
- Symbol,
  TypeError,
 }=primordials;
 
@@ -24,11 +23,8 @@ const {
  getRawPointer,
  kFastArguments,
  kFastBufferInvoke,
- kSbSharedBuffer,
 }=internalBinding('ffi');
 
-constkFastBuffer=Symbol('kFastBuffer');
-
 constU64_MAX=0xFFFFFFFFFFFFFFFFn;
 constI64_MAX=0x7FFFFFFFFFFFFFFFn;
 constI64_MIN=-0x8000000000000000n;
@@ -79,16 +75,13 @@ function validateFastIntegerArg(type, value, index) {
 }
 }
 
-functionneedsRawPointerConversion(type,rawFn){
-if(rawFn!==undefined&&rawFn[kFastBuffer]===true&&
-(type==='buffer'||type==='arraybuffer')){
-returnfalse;
-}
+functionneedsRawPointerConversion(type){
 returntype==='buffer'||type==='arraybuffer';
 }
 
 functionneedsPointerLikeConversion(type){
-returntype==='pointer'||type==='ptr'||type==='function';
+returntype==='pointer'||type==='ptr'||type==='function'||
+type==='buffer'||type==='arraybuffer';
 }
 
 functionneedsStringPointerConversion(type){
@@ -100,12 +93,8 @@ function needsNullPointerConversion(type) {
 needsRawPointerConversion(type);
 }
 
-functionneedsPointerConversion(type,rawFn){
-if(rawFn!==undefined&&rawFn[kFastBuffer]===true&&
-(type==='buffer'||type==='arraybuffer')){
-returnfalse;
-}
-returnneedsRawPointerConversion(type,rawFn)||
+functionneedsPointerConversion(type){
+returnneedsRawPointerConversion(type)||
 needsNullPointerConversion(type)||needsStringPointerConversion(type);
 }
 
@@ -174,11 +163,11 @@ function convertPointerArg(type, value, stringState, index) {
 returnvalue;
 }
 
-functiongetFastArgumentIndexes(argumentsTypes,rawFn){
+functiongetFastArgumentIndexes(argumentsTypes){
 letindexes=null;
 for(leti=0;i<argumentsTypes.length;i++){
 if(fastIntegerTypeInfo[argumentsTypes[i]]===undefined&&
-!needsPointerConversion(argumentsTypes[i],rawFn)){
+!needsPointerConversion(argumentsTypes[i])){
 continue;
 }
 if(indexes===null){
@@ -189,31 +178,12 @@ function getFastArgumentIndexes(argumentsTypes, rawFn) {
 returnindexes;
 }
 
-functionconvertFastArg(type,value,rawFn,stringState,index){
+functionconvertFastArg(type,value,stringState,index){
 validateFastIntegerArg(type,value,index);
-returnneedsPointerConversion(type,rawFn) ?
+returnneedsPointerConversion(type) ?
 convertPointerArg(type,value,stringState,index) : value;
 }
 
-functioninitializeFastBufferMetadata(rawFn,argumentTypes){
-if(rawFn===undefined||rawFn===null||argumentTypes===undefined){
-return;
-}
-if(rawFn[kSbSharedBuffer]!==undefined){
-return;
-}
-
-if(rawFn[kFastArguments]!==undefined){
-for(leti=0;i<argumentTypes.length;i++){
-consttype=argumentTypes[i];
-if(type==='buffer'||type==='arraybuffer'){
-rawFn[kFastBuffer]=true;
-break;
-}
-}
-}
-}
-
 functioninheritMetadata(wrapper,rawFn,nargs){
 ObjectDefineProperty(wrapper,'name',{
 __proto__: null,value: rawFn.name,configurable: true,
@@ -239,7 +209,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, _owner) {
 returnrawFn;
 }
 
-constindexes=getFastArgumentIndexes(argumentTypes,rawFn);
+constindexes=getFastArgumentIndexes(argumentTypes);
 if(indexes===null){
 returnrawFn;
 }
@@ -295,9 +265,8 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, _owner) {
 (c1&&hasStringPointerArg(t1,a1));
 if(stringCall)enterStringConversion(stringState);
 try{
-returnrawFn(c0 ?
-convertFastArg(t0,a0,rawFn,stringState,0) : a0,
-c1 ? convertFastArg(t1,a1,rawFn,stringState,1) : a1);
+returnrawFn(c0 ? convertFastArg(t0,a0,stringState,0) : a0,
+c1 ? convertFastArg(t1,a1,stringState,1) : a1);
 }finally{
 if(stringCall)exitStringConversion(stringState);
 }
@@ -318,10 +287,9 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, _owner) {
 (c2&&hasStringPointerArg(t2,a2));
 if(stringCall)enterStringConversion(stringState);
 try{
-returnrawFn(c0 ?
-convertFastArg(t0,a0,rawFn,stringState,0) : a0,
-c1 ? convertFastArg(t1,a1,rawFn,stringState,1) : a1,
-c2 ? convertFastArg(t2,a2,rawFn,stringState,2) : a2);
+returnrawFn(c0 ? convertFastArg(t0,a0,stringState,0) : a0,
+c1 ? convertFastArg(t1,a1,stringState,1) : a1,
+c2 ? convertFastArg(t2,a2,stringState,2) : a2);
 }finally{
 if(stringCall)exitStringConversion(stringState);
 }
@@ -344,7 +312,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, _owner) {
 for(leti=0;i<indexes.length;i++){
 constindex=indexes[i];
 args[index]=convertFastArg(
-argumentTypes[index],args[index],rawFn,stringState,index);
+argumentTypes[index],args[index],stringState,index);
 }
 returnReflectApply(rawFn,undefined,args);
 }finally{
@@ -360,6 +328,5 @@ module.exports = {
  convertPointerArg,
  hasPointerMemoryArg,
  hasStringPointerArg,
- initializeFastBufferMetadata,
  wrapWithRawPointerConversions,
 };

src/ffi/fast.cc

@@ -178,12 +178,32 @@ bool IsPointerTypeName(const std::string& name) {
 return name == "pointer" || name == "ptr" || name == "function";
 }
 
+boolIsBufferTypeName(const std::string& name) {
+return name == "buffer" || name == "arraybuffer";
+}
+
 boolSignatureNeedsFastBufferInvoke(const FFIFunction& fn) {
 // The secondary buffer invoke is only generated for the hot monomorphic case
 // where a single pointer-like argument can be satisfied by a Buffer or
 // ArrayBuffer without allocating or caching a BigInt pointer in JS.
 return fn.arg_type_names.size() == 1 &&
-IsPointerTypeName(fn.arg_type_names[0]);
+ (IsPointerTypeName(fn.arg_type_names[0]) ||
+IsBufferTypeName(fn.arg_type_names[0]));
+}
+
+std::shared_ptr<FFIFunction> CloneWithRawPointerArgNames(
+const std::shared_ptr<FFIFunction>& fn) {
+// The primary Fast API entrypoint receives pointer-compatible values as
+// BigInts after the JS wrapper has converted strings, nullish values, and
+// memory-backed objects. A secondary entrypoint handles the monomorphic
+// memory-backed case without extracting the pointer in JS.
+auto clone = std::make_shared<FFIFunction>(*fn);
+for (std::string& name : clone->arg_type_names) {
+if (IsBufferTypeName(name)) {
+ name = "pointer";
+ }
+ }
+return clone;
 }
 
 std::shared_ptr<FFIFunction> CloneWithFastBufferArgNames(

src/ffi/fast.h

@@ -61,6 +61,8 @@ bool SignatureNeedsRawPointerConversions(const FFIFunction& fn);
 boolSignatureNeedsFastIntegerValidation(const FFIFunction& fn);
 boolIsPointerTypeName(const std::string& name);
 boolSignatureNeedsFastBufferInvoke(const FFIFunction& fn);
+std::shared_ptr<FFIFunction> CloneWithRawPointerArgNames(
+const std::shared_ptr<FFIFunction>& fn);
 std::shared_ptr<FFIFunction> CloneWithFastBufferArgNames(
 const std::shared_ptr<FFIFunction>& fn);
 std::unique_ptr<FastFFIMetadata> CreateFastFFIMetadata(const FFIFunction& fn);

src/node_ffi.cc

@@ -249,7 +249,8 @@ MaybeLocal<Function> DynamicLibrary::CreateFunction(
 // Try the generated Fast API path first. If metadata creation rejects the
 // signature, fall back to SharedBuffer for supported scalar shapes, then to
 // the generic libffi invoker.
- info->fast_metadata = CreateFastFFIMetadata(*fn);
+ std::shared_ptr<FFIFunction> fast_fn = CloneWithRawPointerArgNames(fn);
+ info->fast_metadata = CreateFastFFIMetadata(*fast_fn);
 bool use_fast_api = info->fast_metadata != nullptr;
 bool use_sb = !use_fast_api && IsSBEligibleSignature(*fn);
 bool has_ptr_args = use_sb && SignatureHasPointerArgs(*fn);

test/ffi/test-ffi-fast-buffer.js

@@ -95,3 +95,41 @@ test('fast FFI string buffers survive reentrant callbacks', {
 lib.close();
 }
 });
+
+test('optimized buffer signatures preserve pointer-like conversions',()=>{
+constlib=newffi.DynamicLibrary(libraryPath);
+constasBuffer=lib.getFunction('pointer_to_usize',{
+arguments: ['buffer'],
+return: 'u64',
+});
+constasArrayBuffer=lib.getFunction('pointer_to_usize',{
+arguments: ['arraybuffer'],
+return: 'u64',
+});
+
+functioncallBuffer(value){
+returnasBuffer(value);
+}
+
+functioncallArrayBuffer(value){
+returnasArrayBuffer(value);
+}
+
+try{
+for(leti=0;i<100_000;i++){
+assert.strictEqual(callBuffer(0n),0n);
+assert.strictEqual(callArrayBuffer(0n),0n);
+}
+
+for(constcallof[callBuffer,callArrayBuffer]){
+assert.strictEqual(call(null),0n);
+assert.strictEqual(call(undefined),0n);
+assert.notStrictEqual(call('ffi'),0n);
+
+constbytes=Buffer.alloc(1);
+assert.strictEqual(call(bytes),ffi.getRawPointer(bytes));
+}
+}finally{
+lib.close();
+}
+});