napi: napi_is_arraybuffer returns false for SharedArrayBuffer

[robobun]

Problem

napi_is_arraybuffer returns true for a SharedArrayBuffer. Node returns false: in V8 (which N-API maps onto) napi_is_arraybuffer is value->IsArrayBuffer(), and a SharedArrayBuffer is a distinct type.

// addon.c, called from JS as add(new SharedArrayBuffer(1))
bool is;
napi_is_arraybuffer(env, args[0], &is);
printf("%d\n", is); // Node: 0, Bun: 1

$ node addon.js       $ bun addon.js
1                     1
0                     1   <- should be 0

Cause

In JSC both ArrayBuffer and SharedArrayBuffer carry the same cell type (JSType::ArrayBufferType), so the previous check in src/runtime/napi/napi_body.rs could not tell them apart:

*result = !value.is_number() && value.js_type_loose() == jsc::JSType::ArrayBuffer;

The only distinguisher is the backing buffer's isShared() flag, already surfaced to Rust as ArrayBuffer.shared.

Fix

Resolve the value as an array buffer and additionally require it to be non-shared, matching V8's IsArrayBuffer():

*result = value
    .as_array_buffer(env.to_js())
    .is_some_and(|ab| ab.typed_array_type == jsc::JSType::ArrayBuffer && !ab.shared);

napi_get_arraybuffer_info is left unchanged on purpose. Node's behavior there is asymmetric: it still accepts a SharedArrayBuffer and returns napi_ok, which Bun already matched. The regression test pins both behaviors.

Verification

Added test_is_arraybuffer to the napi-app fixture and a case in test/napi/napi.test.ts that diffs Bun's output against the ABI-matching Node for ArrayBuffer, SharedArrayBuffer, and a typed array (napi_ok is 0, napi_invalid_arg is 1):

napi_is_arraybuffer=true napi_get_arraybuffer_info=0   # ArrayBuffer
napi_is_arraybuffer=false napi_get_arraybuffer_info=0  # SharedArrayBuffer
napi_is_arraybuffer=false napi_get_arraybuffer_info=1  # Uint8Array

Fails before the fix (Bun reports napi_is_arraybuffer=true for the SharedArrayBuffer), passes after.

Fixes #32624

[robobun]

^{Updated 8:49 PM PT - Jun 22nd, 2026}

❌ @robobun, your commit 700ae3f has 2 failures in Build #64060 (All Failures):

• test/js/web/fetch/fetch-leak.test.ts - code 1 on 🍎 14 aarch64
• test/napi/napi.test.ts - code 1 on 🪟 2019 x64-baseline
• test/napi/napi.test.ts - code 1 on 🪟 2019 x64
• test/napi/napi.test.ts - code 1 on 🪟 11 aarch64

---

🧪   To try this PR locally:

bunx bun-pr 32629

That installs a local version of the PR into your bun-32629 executable, so you can run:

bun-32629 --bun

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 84d5a292-010a-4db2-bdb5-dbc186f6ad7a

📥 Commits

Reviewing files that changed from the base of the PR and between 23315f4 and 700ae3f.

📒 Files selected for processing (3)

• src/runtime/napi/napi_body.rs
• test/napi/napi-app/standalone_tests.cpp
• test/napi/napi.test.ts

---

Walkthrough

napi_is_arraybuffer in napi_body.rs is updated to use as_array_buffer and check typed_array_type == JSType::ArrayBuffer && !ab.shared, replacing a loose predicate that incorrectly matched SharedArrayBuffer. A new C++ standalone test and a TypeScript test suite are added to verify the corrected behavior.

Changes

napi_is_arraybuffer fix and tests

Layer / File(s)	Summary
napi_is_arraybuffer implementation fix src/runtime/napi/napi_body.rs	Replaces the js_type_loose/!is_number guard with an as_array_buffer conversion that checks typed_array_type == JSType::ArrayBuffer and !ab.shared, correctly excluding SharedArrayBuffer.
Standalone C++ test and TypeScript test suite test/napi/napi-app/standalone_tests.cpp, test/napi/napi.test.ts	Adds test_is_arraybuffer in standalone_tests.cpp to print napi_is_arraybuffer and napi_get_arraybuffer_info status per argument, registers it in register_standalone_tests, and adds a TypeScript describe block asserting exact output lines for ArrayBuffer, SharedArrayBuffer, and Uint8Array.

Possibly related issues

• napi_is_arraybuffer returns true for SharedArrayBuffer #32624: This PR directly fixes the reported bug where napi_is_arraybuffer incorrectly returned true for SharedArrayBuffer, implementing the as_array_buffer() + !ab.shared fix and accompanying test cases described in that issue.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main fix: correcting napi_is_arraybuffer to return false for SharedArrayBuffer, matching Node.js behavior.
Description check	✅ Passed	The description comprehensively covers the problem, root cause, fix, and verification, fully addressing the template sections.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

LGTM — targeted Node-compat fix with a test that diffs against Node.

Extended reasoning...

Overview

This PR fixes napi_is_arraybuffer in src/runtime/napi/napi_body.rs to return false for SharedArrayBuffer, matching Node/V8 semantics. The previous implementation only checked the JSC cell type, which is identical for ArrayBuffer and SharedArrayBuffer; the new code resolves the value via as_array_buffer and additionally requires !ab.shared. A C++ test fixture (test_is_arraybuffer) and a checkSameOutput case in test/napi/napi.test.ts pin the behavior for ArrayBuffer, SharedArrayBuffer, and Uint8Array, including the intentionally-asymmetric napi_get_arraybuffer_info status.

Security risks

None. This is a pure type-classification predicate over a JS value; no parsing, no allocation, no auth/permissions, no untrusted input handling. The underlying JSC__JSValue__asArrayBuffer helper is read-only and already used by other napi entry points (e.g. napi_get_arraybuffer_info).

Level of scrutiny

Low. The runtime change is three lines of logic plus a comment, scoped to a single N-API predicate, and follows an existing pattern (the shared flag is already populated by JSC__JSValue__asArrayBuffer in bindings.cpp:3313). The typed_array_type == ArrayBuffer guard preserves the prior false for typed arrays / DataView, and as_array_buffer returning None for non-cells preserves false for primitives. No CODEOWNERS cover this path.

Other factors

The test follows the established test_is_buffer / test_is_typedarray pattern in the same file and uses checkSameOutput to diff against the ABI-matching Node, which is the right harness for a Node-compat fix. The bug-hunting system found no issues, and there are no prior reviewer comments to address.

[Jarred-Sumner]

Move this to .cpp and it will simplify the. code