ffi: optimized fast pointer BigInts bypass range validation

[trivikr]

Version

main

Platform

macOS 26.6.0

Subsystem

ffi

What steps will reproduce the bug?

repro.c

__attribute__((visibility("default")))
void* identity_pointer(void* ptr) {
  return ptr;
}

repro.js

import { dlopen } from 'node:ffi';

const { lib, functions } = dlopen('./repro.dylib', {
  identity_pointer: { arguments: ['pointer'], return: 'pointer' },
});

const identityPointer = functions.identity_pointer;

function show(label, fn) {
  try {
    console.log(`${label}:`, String(fn()));
  } catch (err) {
    console.log(`${label}:`, err.code || err.name);
  }
}

show('cold -1n', () => identityPointer(-1n));

%PrepareFunctionForOptimization(identityPointer);
identityPointer(0n);
identityPointer(0n);
%OptimizeFunctionOnNextCall(identityPointer);
identityPointer(0n);

show('optimized -1n', () => identityPointer(-1n));
show('optimized 2^64+5', () => identityPointer((1n << 64n) + 5n));

lib.close();

Run

$ cc -dynamiclib -o repro.dylib repro.c

$ node --no-warnings --experimental-ffi --allow-natives-syntax repro.js

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

cold -1n: ERR_INVALID_ARG_VALUE
optimized -1n: ERR_INVALID_ARG_VALUE
optimized 2^64+5: ERR_INVALID_ARG_VALUE

Optimized fast calls to match generic and shared-buffer validation and throw ERR_INVALID_ARG_VALUE.

What do you see instead?

cold -1n: ERR_INVALID_ARG_VALUE
optimized -1n: 18446744073709551615
optimized 2^64+5: 5

cold -1n throws, but after optimizing the FFI wrapper -1n is passed as 2^64 - 1 and 2^64 + 5 is passed as 5

Additional information

No response