lib: fix shared buffer growability validation

[panva]

Use the intrinsic growable getter instead of buffer.growable so shadowed properties cannot bypass validation or reject fixed buffers.

cc @nodejs/web-standards

[Renegade334]

Is storing this and invoking with FunctionPrototypeCall definitely quicker than a fast binding that returns sab->GetBackingStore()->IsResizableByUserJavaScript()?

[panva]

I haven't benchmarked against a fast binding. Copilot tried that predicate first, but it wasn't equivalent. Shared Wasm memory can expose fixed and growable SAB wrappers over the same backing store.

node/deps/v8/src/objects/backing-store.h

Lines 142 to 146 in f16b556

	// For shared Wasm memories, this field never changes, but may differ from the
	// value of the is_resizable_by_js field of SharedArrayBuffers it backs.
	// WebAssembly.Memory can create multiple SharedArrayBuffers backed by the
	// same BackingStore, some of which are exposed as growable, and some of which
	// as fixed-length.

The getter checks the individual buffer's growability, which is what Web IDL requires.

[Renegade334]

Nice catch.

The flag check on the SAB itself would be sab.As<ArrayBuffer>()->IsResizableByUserJavaScript() – this checks the flag on the AB handle directly (https://github.com/v8/v8/blob/9f30cc5fc4ad6c3236c522fd23224ddc94591a20/src/api/api.cc#L4374-L4376). SAB handles are AB handles, so providing sab is known to be a SharedArrayBuffer, this should be directly equivalent to sab.growable.

Maybe worth a mini benchmark?

[panva]

Copilot ran a mini benchmark, about 10-24% faster for this check. But sab.As<ArrayBuffer>() fails with V8_ENABLE_CHECKS because the cast rejects shared buffers.

[Renegade334]

That's interesting, we already use this relationship elsewhere... although I think technically we cast v8::Value handles that are known to be SABs, rather than casting a v8::SharedArrayBuffer handle directly.

[codecov]

Codecov Report

❌ Patch coverage is 94.11765% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.18%. Comparing base (6f41e41) to head (4e6aadf).
⚠️ Report is 26 commits behind head on main.

Files with missing lines	Patch %	Lines
src/node_util.cc	92.30%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65845      +/-   ##
==========================================
+ Coverage   90.17%   90.18%   +0.01%     
==========================================
  Files         770      771       +1     
  Lines      264483   264633     +150     
  Branches    50262    50227      -35     
==========================================
+ Hits       238491   238671     +180     
+ Misses      16981    16958      -23     
+ Partials     9011     9004       -7     

Files with missing lines	Coverage Δ
lib/internal/webidl.js	100.00% <100.00%> (ø)
src/node_util.cc	81.79% <92.30%> (+0.39%)	⬆️

... and 35 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/77108/