nodejs
diff --git a/‎lib/internal/ffi/fast-api.js‎
Lines changed: 2 additions & 3 deletions b/‎lib/internal/ffi/fast-api.js‎
Lines changed: 2 additions & 3 deletions
diff --git a/‎src/ffi/fast.cc‎
Lines changed: 4 additions & 6 deletions b/‎src/ffi/fast.cc‎
Lines changed: 4 additions & 6 deletions
diff --git a/‎test/ffi/test-ffi-fast-buffer.js‎
Lines changed: 30 additions & 1 deletion b/‎test/ffi/test-ffi-fast-buffer.js‎
Lines changed: 30 additions & 1 deletion
@@ -18,7 +18,6 @@ const {
 } = require('buffer');
 
 const {
-  isAnyArrayBuffer,
   isArrayBuffer,
   isArrayBufferView,
   isDataView,
@@ -130,7 +129,7 @@ function hasStringPointerArg(type, value) {
 
 function hasPointerMemoryArg(type, value) {
   return (needsRawPointerConversion(type) || needsStringPointerConversion(type)) &&
-         (isArrayBufferView(value) || isAnyArrayBuffer(value));
+         (isArrayBufferView(value) || isArrayBuffer(value));
 }
 
 function enterStringConversion(state) {
@@ -307,7 +306,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, owner) {
         } finally {
           exitStringConversion(stringState);
         }
-      } else if (memory0 && (isArrayBufferView(arg) || isAnyArrayBuffer(arg))) {
+      } else if (memory0 && (isArrayBufferView(arg) || isArrayBuffer(arg))) {
         if (fastBufferInvoke !== undefined) {
           return fastBufferInvoke(arg);
         }
 
@@ -248,9 +248,10 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
   constexpr uintptr_t kInvalidBuffer = std::numeric_limits<uintptr_t>::max();
   v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 
-  // Accept only memory-backed JS values in the native helper. Other pointer
-  // conversions, including strings, stay in the JS wrapper so their temporary
-  // lifetime is explicit.
+  // Accept only the memory-backed JS values supported by ToFFIArgument in the
+  // native helper. Other pointer conversions, including strings and direct
+  // SharedArrayBuffers, stay in the JS wrapper so validation and temporary
+  // lifetimes match the generic path.
   if (value->IsArrayBufferView()) {
     v8::Local<v8::ArrayBufferView> view = value.As<v8::ArrayBufferView>();
     if (view->Buffer()->WasDetached()) {
@@ -281,9 +282,6 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
     }
     return PointerFromValue(value);
   }
-  if (value->IsSharedArrayBuffer()) {
-    return PointerFromValue(value);
-  }
 
   if (isolate != nullptr) {
     // No HandleScope is active during a Fast API call, so open one before
 
@@ -1,4 +1,4 @@
-// Flags: --experimental-ffi --expose-internals
+// Flags: --experimental-ffi --expose-internals --allow-natives-syntax
 'use strict';
 
 const common = require('../common');
@@ -70,6 +70,35 @@ test('fast FFI buffer arguments reject invalid values', () => {
   }
 });
 
+test('optimized pointer arguments reject direct SharedArrayBuffers', () => {
+  const lib = new ffi.DynamicLibrary(libraryPath);
+  const firstByte = lib.getFunction('first_byte', {
+    arguments: ['pointer'],
+    return: 'u8',
+  });
+  const regular = new ArrayBuffer(1);
+  const shared = new SharedArrayBuffer(1);
+  const expected = { code: 'ERR_INVALID_ARG_VALUE' };
+
+  function callFirstByte(value) {
+    return firstByte(value);
+  }
+
+  try {
+    assert.throws(() => callFirstByte(shared), expected);
+
+    eval('%PrepareFunctionForOptimization(callFirstByte)');
+    callFirstByte(regular);
+    callFirstByte(regular);
+    eval('%OptimizeFunctionOnNextCall(callFirstByte)');
+    callFirstByte(regular);
+
+    assert.throws(() => callFirstByte(shared), expected);
+  } finally {
+    lib.close();
+  }
+});
+
 test('fast FFI string buffers survive reentrant callbacks', {
   // Bundled libffi callbacks crash on SmartOS.
   skip: common.isSunOS,