René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"ffi: Fast API string buffer is corrupted by reentrant callbacks","articleBody":"### Version\n\nmain\n\n### Platform\n\n```text\nmacOS 26.5.2\n```\n\n### Subsystem\n\nffi\n\n### What steps will reproduce the bug?\n\n`repro.c`\n```c\n#include \u003cstdint.h>\n#include \u003cstring.h>\n\nint32_t inner(const char *text) {\n  return (int32_t)strlen(text);\n}\n\nint32_t outer(const char *text, void (*callback)(void)) {\n  callback();\n  return strcmp(text, \"OUTER\") == 0;\n}\n```\n\nCompile\n```sh\n$ clang -dynamiclib repro.c -o librepro.dylib\n```\n\n`repro.js`\n```js\nimport { dlopen } from 'node:ffi';\n\nconst { lib, functions } = dlopen('./librepro.dylib', {\n  inner: {\n    arguments: ['string'],\n    return: 'i32',\n  },\n  // `pointer` keeps this function eligible for the Fast API path.\n  outer: {\n    arguments: ['string', 'pointer'],\n    return: 'i32',\n  },\n});\n\nlet nestedLength;\nconst callback = lib.registerCallback(() => {\n  nestedLength = functions.inner('INNER');\n});\n\nconsole.log(\n  'outer string unchanged:',\n  functions.outer('OUTER', callback),\n);\nconsole.log('nested length:', nestedLength);\n\nlib.unregisterCallback(callback);\nlib.close();\n```\n\n### How often does it reproduce? Is there a required condition?\n\nAlways\n\n### What is the expected behavior? Why is that the expected behavior?\n\n```console\nouter string unchanged: 1\nnested length: 5\n```\n\nThe outer string remains valid and unchanged for the entire native call.\n\n### What do you see instead?\n\n```console\nouter string unchanged: 0\nnested length: 5\n```\n\nThe nested call overwrites the outer call’s argument-0 string buffer, so native code sees `\"INNER\"` instead of `\"OUTER\"`\n\n### Additional information\n\n_No response_","author":{"url":"https://github.com/trivikr","@type":"Person","name":"trivikr"},"datePublished":"2026-07-17T03:24:01Z","url":"https://github.com/nodejs/node/issues/64550"}