Repository navigation
ffi: Fast API string buffer is corrupted by reentrant callbacks #64550
Description
Version
main
Platform
macOS 26.5.2
Subsystem
ffi
What steps will reproduce the bug?
repro.c
#include <stdint.h>
#include <string.h>
int32_t inner(const char *text) {
return (int32_t)strlen(text);
}
int32_t outer(const char *text, void (*callback)(void)) {
callback();
return strcmp(text, "OUTER") == 0;
}Compile
$ clang -dynamiclib repro.c -o librepro.dylibrepro.js
import { dlopen } from 'node:ffi';
const { lib, functions } = dlopen('./librepro.dylib', {
inner: {
arguments: ['string'],
return: 'i32',
},
// `pointer` keeps this function eligible for the Fast API path.
outer: {
arguments: ['string', 'pointer'],
return: 'i32',
},
});
let nestedLength;
const callback = lib.registerCallback(() => {
nestedLength = functions.inner('INNER');
});
console.log(
'outer string unchanged:',
functions.outer('OUTER', callback),
);
console.log('nested length:', nestedLength);
lib.unregisterCallback(callback);
lib.close();How often does it reproduce? Is there a required condition?
Always
What is the expected behavior? Why is that the expected behavior?
outer string unchanged: 1
nested length: 5The outer string remains valid and unchanged for the entire native call.
What do you see instead?
outer string unchanged: 0
nested length: 5The nested call overwrites the outer call’s argument-0 string buffer, so native code sees "INNER" instead of "OUTER"
Additional information
No response
Activity
ffi: preserve strings during reentrant calls
ffi: preserve strings during reentrant calls
ffi: preserve strings during reentrant calls