Skip to content

ffi: reject non-leading buffer args in fast trampolines - #67045

Closed
trivikr wants to merge 1 commit into
nodejs:mainfrom
trivikr:ffi-arm64-fast-api-buffer-trampoline-args
Closed

trivikr wants to merge 1 commit into
nodejs:mainfrom
trivikr:ffi-arm64-fast-api-buffer-trampoline-args

Conversation

@trivikr

@trivikr trivikr commented Oct 27, 2026

Copy link
Copy Markdown
Member

The arm64 and x86_64 SysV Fast API emitters convert a buffer argument by calling node_ffi_fast_buffer_data(). Arguments before the buffer are already in their target registers at that point, and the call clobbers them. For (i32, buffer) on arm64, the target receives (ptr, ptr).

No JS call can reach this today. Buffer-typed trampolines are only generated for single-argument signatures (SignatureNeedsFastBufferInvoke()), and the primary trampoline rewrites buffer to pointer.

This change makes both emitters reject a buffer argument that isn't the first GP argument. A future multi-argument caller then falls back to another call path instead of getting a broken trampoline. Win64 already rejects buffer arguments.

No test is added because no JS call can reach the rejected signature.


Assisted-by: claude:opus-5.5

The arm64 and x86_64 SysV emitters convert each buffer argument with a
helper call after loading earlier arguments into their target registers.
The call clobbers those registers, so the target would receive wrong
values for every argument before the buffer.

This is not reachable today: buffer-typed trampolines are generated only
for single-argument signatures. Reject the unsupported shape in the
emitters so a future caller falls back instead of miscompiling.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/ffi

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels Oct 27, 2026
@trivikr trivikr closed this Oct 27, 2026
@trivikr
trivikr deleted the ffi-arm64-fast-api-buffer-trampoline-args branch October 27, 2026 05:50
@trivikr

trivikr commented Oct 27, 2026

Copy link
Copy Markdown
Member Author

Superseded by #67046, which rejects buffer trampolines with more than one argument instead of only those where the buffer isn't first.

@codecov

codecov Bot commented Oct 27, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.65%. Comparing base (640ce85) to head (67e4028).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
src/ffi/platforms/arm64.cc 0.00% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #67045      +/-   ##
==========================================
- Coverage   90.66%   90.65%   -0.01%     
==========================================
  Files         797      797              
  Lines      278268   278270       +2     
  Branches    53521    53521              
==========================================
- Hits       252280   252259      -21     
- Misses      16382    16386       +4     
- Partials     9606     9625      +19     
Files with missing lines Coverage Δ
src/ffi/platforms/arm64.cc 84.49% <0.00%> (-0.92%) ⬇️

... and 33 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants