ffi: Detached ArrayBuffers and views are silently converted to null FFI pointers

[trivikr]

Version

main

Platform

macOS 26.6.0

Subsystem

ffi

What steps will reproduce the bug?

repro.c

#include <stdint.h>

uint64_t pointer_to_usize(void* ptr) {
  return (uint64_t)(uintptr_t)ptr;
}

repro.js

import { resolve } from 'node:path';
import { dlopen, suffix, getRawPointer } from 'node:ffi';

const { lib, functions } = dlopen(
  resolve(`repro.${suffix}`),
  {
    pointer_to_usize: {
      arguments: ['pointer'],
      return: 'u64',
    },
  },
);

const arrayBuffer = new ArrayBuffer(8);
const typedArray = new Uint8Array(arrayBuffer);
const dataView = new DataView(arrayBuffer);

structuredClone(arrayBuffer, { transfer: [arrayBuffer] });

function show(label, operation) {
  try {
    console.log(label, operation());
  } catch (error) {
    console.log(label, error.code);
  }
}

try {
  for (const [name, value] of [
    ['ArrayBuffer', arrayBuffer],
    ['Uint8Array', typedArray],
    ['DataView', dataView],
  ]) {
    show(`getRawPointer(${name})`, () => getRawPointer(value));
    show(`pointer_to_usize(${name})`, () =>
      functions.pointer_to_usize(value));
  }
} finally {
  lib.close();
}

Commands to run

$ cc -dynamiclib -o repro.dylib repro.c
$ node --no-warnings --experimental-ffi repro.js

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

Each operation should throw ERR_INVALID_ARG_VALUE, consistent with ExportBytes() rejecting detached buffers and views.

What do you see instead?

getRawPointer(ArrayBuffer) 0n
pointer_to_usize(ArrayBuffer) 0n
getRawPointer(Uint8Array) 0n
pointer_to_usize(Uint8Array) 0n
getRawPointer(DataView) 0n
pointer_to_usize(DataView) 0n

All six operations return 0n, silently treating detached memory as a null pointer.

Additional information

No response