René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"ffi: `exportArrayBuffer` type check is fooled by `Symbol.toStringTag`","articleBody":"### Version\n\nmain\n\n### Platform\n\n```text\nmacOS 26.7.1\n```\n\n### Subsystem\n\nffi\n\n### What steps will reproduce the bug?\n\n```js\nimport ffi from 'node:ffi';\n\nconst dest = new ArrayBuffer(8);\nconst ptr = ffi.getRawPointer(dest);\n\n// Real ArrayBuffer with a custom tag: rejected.\nconst real = new ArrayBuffer(4);\nObject.defineProperty(real, Symbol.toStringTag, { value: 'Custom' });\ntry {\n  ffi.exportArrayBuffer(real, ptr, 8);\n} catch (err) {\n  console.log('real:', err.code, err.message);\n}\n\n// Fake object tagged as ArrayBuffer: passes the JS check.\nconst fake = { [Symbol.toStringTag]: 'ArrayBuffer', byteLength: 4 };\ntry {\n  ffi.exportArrayBuffer(fake, ptr, 8);\n} catch (err) {\n  console.log('fake:', err.code, err.message);\n}\n```\n\n### How often does it reproduce? Is there a required condition?\n\nAlways\n\n### What is the expected behavior? Why is that the expected behavior?\n\nThe `arrayBuffer` argument is documented as `{ArrayBuffer}`\nDocs https://github.com/nodejs/node/blob/main/doc/api/ffi.md#ffiexportarraybufferarraybuffer-pointer-length\n\nSo the check should depend on whether the value really is an `ArrayBuffer`, not on its tag. A real `ArrayBuffer` should be copied.\nThe fake object should be rejected in JS with `The \"arrayBuffer\" argument must be an instance of ArrayBuffer`.\n\n### What do you see instead?\n\n```console\nreal: ERR_INVALID_ARG_TYPE The \"arrayBuffer\" argument must be an instance of ArrayBuffer. Received an instance of ArrayBuffer\nfake: ERR_INVALID_ARG_TYPE The first argument must be a Buffer, ArrayBuffer, SharedArrayBuffer, or ArrayBufferView\n```\n\n### Additional information\n\n_No response_","author":{"url":"https://github.com/trivikr","@type":"Person","name":"trivikr"},"datePublished":"2026-10-02T03:41:48Z","url":"https://github.com/nodejs/node/issues/66454"}