ffi: exportArrayBufferView() inconsistently handles detached views

[trivikr]

Version

main

Platform

macOS 26.6.0

Subsystem

ffi

What steps will reproduce the bug?

repro.c

void* destination(void) {
 static unsigned char byte;
 return &byte;
}

repro.js

import { dlopen, suffix, exportArrayBuffer, exportArrayBufferView } from 'node:ffi';

const { lib, functions } = dlopen(`./repro.${suffix}`, {
 destination: { arguments: [], return: 'pointer' },
});

const pointer = functions.destination();

function detached(makeValue) {
 const buffer = new ArrayBuffer(1);
 const value = makeValue(buffer);
 structuredClone(buffer, { transfer: [buffer] });
 return value;
}

function run(name, fn) {
 try {
 fn();
 console.log(`${name}: accepted`);
 } catch (error) {
 console.log(`${name}: ${error.code ?? error.name}: ${error.message}`);
 }
}

run('ArrayBuffer', () => {
 exportArrayBuffer(detached((buffer) => buffer), pointer, 1);
});

run('Uint8Array', () => {
 exportArrayBufferView(
 detached((buffer) => new Uint8Array(buffer)),
 pointer,
 1,
 );
});

run('DataView', () => {
 exportArrayBufferView(
 detached((buffer) => new DataView(buffer)),
 pointer,
 1,
 );
});

lib.close();

Commands to run:

$ cc -dynamiclib -o repro.dylib repro.c
$ node --no-warnings --experimental-ffi repro.js

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

All detached inputs should be rejected consistently, preferably with Node.js’s ERR_INVALID_ARG_VALUE.

What do you see instead?

ArrayBuffer: ERR_INVALID_ARG_VALUE: ArrayBuffer is detached
Uint8Array: accepted
DataView: TypeError: Cannot perform get DataView.prototype.byteLength on a detached or out-of-bounds ArrayBuffer

A detached ArrayBuffer produces ERR_INVALID_ARG_VALUE, a detached Uint8Array is accepted, and a detached DataView produces a V8 TypeError

Additional information

Noticed while working on #65082