René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"ffi: refCallback()/unrefCallback() crash (SIGSEGV) when called on a garbage-collected callback","articleBody":"### Version\n\nmain\n\n### Platform\n\n```text\nN/A\n```\n\n### Subsystem\n\nffi\n\n### What steps will reproduce the bug?\n\n`repro.c`\n```c\n#include \u003cstdint.h>\n\nint32_t noop(int32_t x) { return x; }\n```\n\nCompile it by running\n```sh\n$ cc -shared -o repro.so repro.c # or .dylib on macOS\n```\n\n`repro.js`\n```js\nimport { DynamicLibrary, suffix } from 'node:ffi';\n\nconst lib = new DynamicLibrary(`./repro.${suffix}`);\n\nlet cb = (x) => x + 1;\nconst ptr = lib.registerCallback({ arguments: ['i32'], return: 'i32' }, cb);\n\n// Allow GC to collect the callback backing function\nlib.unrefCallback(ptr);\ncb = null;\nglobalThis.gc();\n\n// Second unref (or refCallback) on the now-empty weak handle → SIGSEGV\nlib.unrefCallback(ptr);\n\nlib.close();\n```\n\nRun it using\n```sh\n$ node --experimental-ffi --expose-gc --no-warnings repro.js\n```\n\n### How often does it reproduce? Is there a required condition?\n\nAlways\n\n### What is the expected behavior? Why is that the expected behavior?\n\n`unrefCallback`/`refCallback` on a collected callback should throw `ERR_INVALID_ARG_VALUE(\"Callback not found\")`.\n\n### What do you see instead?\n\n```console\nsegmentation fault (core dumped)\n```\n\nThe process crashes with `SIGSEGV` inside `v8::PersistentBase::SetWeak()` (or `ClearWeak()` for refCallback) because the weak handle slot is already cleared after GC.\n\n### Additional information\n\n_No response_","author":{"url":"https://github.com/trivikr","@type":"Person","name":"trivikr"},"datePublished":"2026-07-31T20:00:52Z","url":"https://github.com/nodejs/node/issues/64880"}