ffi: reject direct SharedArrayBuffer pointers

Reject direct SharedArrayBuffer pointer arguments in the JavaScript
wrapper and native fast-buffer helper. This keeps validation behavior
consistent before and after optimization.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol

Author: trivikr

lib/internal/ffi/fast-api.js

@@ -18,7 +18,6 @@ const {
 } = require('buffer');
 
 const {
-  isAnyArrayBuffer,
   isArrayBuffer,
   isArrayBufferView,
   isDataView,
@@ -130,7 +129,7 @@ function hasStringPointerArg(type, value) {
 
 function hasPointerMemoryArg(type, value) {
   return (needsRawPointerConversion(type) || needsStringPointerConversion(type)) &&
-         (isArrayBufferView(value) || isAnyArrayBuffer(value));
+         (isArrayBufferView(value) || isArrayBuffer(value));
 }
 
 function enterStringConversion(state) {
@@ -310,7 +309,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
         } finally {
           exitStringConversion(stringState);
         }
-      } else if (memory0 && (isArrayBufferView(arg) || isAnyArrayBuffer(arg))) {
+      } else if (memory0 && (isArrayBufferView(arg) || isArrayBuffer(arg))) {
         if (fastBufferInvoke !== undefined) {
           return fastBufferInvoke(arg);
         }

src/ffi/fast.cc

@@ -248,9 +248,10 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
   constexpr uintptr_t kInvalidBuffer = std::numeric_limits<uintptr_t>::max();
   v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 
-  // Accept only memory-backed JS values in the native helper. Other pointer
-  // conversions, including strings, stay in the JS wrapper so their temporary
-  // lifetime is explicit.
+  // Accept only the memory-backed JS values supported by ToFFIArgument in the
+  // native helper. Other pointer conversions, including strings and direct
+  // SharedArrayBuffers, stay in the JS wrapper so validation and temporary
+  // lifetimes match the generic path.
   if (value->IsArrayBufferView()) {
     v8::Local<v8::ArrayBufferView> view = value.As<v8::ArrayBufferView>();
     if (view->Buffer()->WasDetached()) {
@@ -281,9 +282,6 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
     }
     return PointerFromValue(value);
   }
-  if (value->IsSharedArrayBuffer()) {
-    return PointerFromValue(value);
-  }
 
   if (isolate != nullptr) {
     // No HandleScope is active during a Fast API call, so open one before

test/ffi/test-ffi-fast-buffer.js

@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-internals
+// Flags: --experimental-ffi --expose-internals --allow-natives-syntax
 'use strict';
 
 const common = require('../common');
@@ -70,6 +70,31 @@ test('fast FFI buffer arguments reject invalid values', () => {
   }
 });
 
+test('optimized pointer arguments reject direct SharedArrayBuffers', () => {
+  const lib = new ffi.DynamicLibrary(libraryPath);
+  const firstByte = lib.getFunction('first_byte', {
+    arguments: ['pointer'],
+    return: 'u8',
+  });
+  const regular = new ArrayBuffer(1);
+  const shared = new SharedArrayBuffer(1);
+  const expected = { code: 'ERR_INVALID_ARG_VALUE' };
+
+  try {
+    assert.throws(() => firstByte(shared), expected);
+
+    eval('%PrepareFunctionForOptimization(firstByte)');
+    firstByte(regular);
+    firstByte(regular);
+    eval('%OptimizeFunctionOnNextCall(firstByte)');
+    firstByte(regular);
+
+    assert.throws(() => firstByte(shared), expected);
+  } finally {
+    lib.close();
+  }
+});
+
 test('fast FFI string buffers survive reentrant callbacks', {
   // Bundled libffi callbacks crash on SmartOS.
   skip: common.isSunOS,