ffi: Detached ArrayBuffers and views are silently converted to null FFI pointers

[trivikr]

Version

main

Platform

macOS 26.6.0

Subsystem

ffi

What steps will reproduce the bug?

repro.c

#include <stdint.h>

uint64_t pointer_to_usize(void* ptr) {
 return (uint64_t)(uintptr_t)ptr;
}

repro.js

import { resolve } from 'node:path';
import { dlopen, suffix, getRawPointer } from 'node:ffi';

const { lib, functions } = dlopen(
 resolve(`repro.${suffix}`),
 {
 pointer_to_usize: {
 arguments: ['pointer'],
 return: 'u64',
 },
 },
);

const arrayBuffer = new ArrayBuffer(8);
const typedArray = new Uint8Array(arrayBuffer);
const dataView = new DataView(arrayBuffer);

structuredClone(arrayBuffer, { transfer: [arrayBuffer] });

function show(label, operation) {
 try {
 console.log(label, operation());
 } catch (error) {
 console.log(label, error.code);
 }
}

try {
 for (const [name, value] of [
 ['ArrayBuffer', arrayBuffer],
 ['Uint8Array', typedArray],
 ['DataView', dataView],
 ]) {
 show(`getRawPointer(${name})`, () => getRawPointer(value));
 show(`pointer_to_usize(${name})`, () =>
 functions.pointer_to_usize(value));
 }
} finally {
 lib.close();
}

Commands to run

$ cc -dynamiclib -o repro.dylib repro.c
$ node --no-warnings --experimental-ffi repro.js

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

Each operation should throw ERR_INVALID_ARG_VALUE, consistent with ExportBytes() rejecting detached buffers and views.

What do you see instead?

getRawPointer(ArrayBuffer) 0n
pointer_to_usize(ArrayBuffer) 0n
getRawPointer(Uint8Array) 0n
pointer_to_usize(Uint8Array) 0n
getRawPointer(DataView) 0n
pointer_to_usize(DataView) 0n

All six operations return 0n, silently treating detached memory as a null pointer.

Additional information

No response