René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"ffi reuses mutated temporary string buffer without restoring its contents","articleBody":"### Version\n\nmain\n\n### Platform\n\n```text\nmacOS 26.6.0\n```\n\n### Subsystem\n\nffi\n\n### What steps will reproduce the bug?\n\n`repro.c`\n```c\n#include \u003cstddef.h>\n#include \u003cstring.h>\n\nchar* overwrite(char* string, int byte, size_t count) {\n  return memset(string, byte, count);\n}\n```\n\n`repro.js`\n```js\nimport { DynamicLibrary, suffix, toString } from 'node:ffi';\n\nconst lib = new DynamicLibrary(`./repro.${suffix}`);\nconst overwrite = lib.getFunction('overwrite', {\n  arguments: ['string', 'i32', 'u64'],\n  return: 'pointer',\n});\n\nconsole.log(toString(overwrite('hello', 0x79, 1n))); // \"yello\"\nconsole.log(toString(overwrite('hello', 0, 0n))); // \"yello\"; expected \"hello\"\n\nlib.close();\n```\n\nRun commands\n```sh\n$ cc -dynamiclib -o repro.dylib repro.c\n$ node --experimental-ffi repro.js\n```\n\n### How often does it reproduce? Is there a required condition?\n\nAlways\n\n### What is the expected behavior? Why is that the expected behavior?\n\n```console\nyello\nhello\n```\n\neach call should populate temporary storage from the supplied JavaScript string, so reusing `\"hello\"` should produce `\"hello\"`.\n\n\n### What do you see instead?\n\n```console\nyello\nyello\n```\n\nthe second call receives `\"yello\"` because the cached temporary buffer retains the native mutation from the first call.\n\n### Additional information\n\n_No response_","author":{"url":"https://github.com/trivikr","@type":"Person","name":"trivikr"},"datePublished":"2026-08-05T14:57:41Z","url":"https://github.com/nodejs/node/issues/65050"}