ffi: closed library still callable via fast path, SIGSEGV instead of ERR_FFI_LIBRARY_CLOSED

[trivikr]

Version

main

Platform

N/A

Subsystem

ffi

What steps will reproduce the bug?

repro.c

double multiply_f64(double a, double b) {
  return a * b;
}

Compile it with

$ cc -shared -fPIC -o repro.so repro.c   # macOS: -o repro.dylib

repro.js

import { dlopen, suffix } from 'node:ffi';

const { lib, functions } = dlopen(`./repro.${suffix}`, {
  multiply_f64: { arguments: ['f64', 'f64'], return: 'f64' },
});

function hot(a, b) { return functions.multiply_f64(a, b); }

%PrepareFunctionForOptimization(hot);
hot(2, 3);
%OptimizeFunctionOnNextCall(hot);

console.log('pre-close:', hot(2, 3));      // 6, now through the trampoline

lib.close();

console.log('after close:', hot(2, 3));    // SIGSEGV

Run it with

$ node --no-warnings --experimental-ffi --allow-natives-syntax repro.js

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

The call after close() throws ERR_FFI_LIBRARY_CLOSED

What do you see instead?

pre-close: 6
zsh: segmentation fault (core dumped)

The call after close() throws segmentation fault

Additional information

No response