diff --git a/src/ffi/platforms/arm64.cc b/src/ffi/platforms/arm64.cc index df215ecafed3..25221958933c 100644 --- a/src/ffi/platforms/arm64.cc +++ b/src/ffi/platforms/arm64.cc @@ -257,6 +257,11 @@ extern "C" bool node_ffi_create_fast_trampoline( if (has_buffer_args && fp_count != 0) { return false; } + // The buffer helper call clobbers target registers already loaded for + // earlier arguments, so buffer trampolines support a single argument only. + if (has_buffer_args && argc > 1) { + return false; + } const size_t incoming_gp_count = gp_count + (has_buffer_args ? 1 : 0); // When V8 passes FastApiCallbackOptions, it consumes one additional GP diff --git a/src/ffi/platforms/x64.cc b/src/ffi/platforms/x64.cc index d5c15c381574..f9700ac0211b 100644 --- a/src/ffi/platforms/x64.cc +++ b/src/ffi/platforms/x64.cc @@ -378,6 +378,11 @@ extern "C" bool node_ffi_create_fast_trampoline( if (has_buffer_args && fp_count != 0) { return false; } + // The buffer helper call clobbers target registers already loaded for + // earlier arguments, so buffer trampolines support a single argument only. + if (has_buffer_args && argc > 1) { + return false; + } const size_t incoming_gp_count = gp_count + (has_buffer_args ? 1 : 0); // rdi is occupied by the V8 receiver, leaving rsi, rdx, rcx, r8, and r9 for