ffi: Fast FFI bypasses `i32` range validation after V8 optimization

[trivikr]

Version

main

Platform

macOS 26.5.2

Subsystem

ffi

What steps will reproduce the bug?

import { dlopen } from 'node:ffi';

const { lib, functions } = dlopen(null, {
 abs: { arguments: ['i32'], return: 'i32' },
});

function call(value) {
 return functions.abs(value);
}

eval('%PrepareFunctionForOptimization(call)');
call(0);
call(0);
eval('%OptimizeFunctionOnNextCall(call)');
call(0);

console.log(call(2 ** 32));

lib.close();

Run with

$ node --no-warnings --experimental-ffi --allow-natives-syntax repro.js

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

It should throw ERR_INVALID_ARG_VALUE with Argument 0 must be an int32, as the generic FFI path does.

What do you see instead?

The optimized call accepts 2 ** 32, truncates it to zero, and returns 0

Additional information

No response