ffi: reject multi-argument buffer fast trampolines

The arm64 and x86_64 SysV emitters convert each buffer argument with a
helper call after loading earlier arguments into their target registers.
The call clobbers those registers, so the target would receive wrong
values for every argument before the buffer.

This is not reachable today: buffer-typed trampolines are generated only
for single-argument signatures. Reject other shapes in the emitters so a
future caller falls back instead of miscompiling.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
PR-URL: #67046
Reviewed-By: Paolo Insogna <paolo@cowtech.it>

Author: trivikr

src/ffi/platforms/arm64.cc

@@ -257,6 +257,11 @@ extern "C" bool node_ffi_create_fast_trampoline(
   if (has_buffer_args && fp_count != 0) {
     return false;
   }
+  // The buffer helper call clobbers target registers already loaded for
+  // earlier arguments, so buffer trampolines support a single argument only.
+  if (has_buffer_args && argc > 1) {
+    return false;
+  }
 
   const size_t incoming_gp_count = gp_count + (has_buffer_args ? 1 : 0);
   // When V8 passes FastApiCallbackOptions, it consumes one additional GP

src/ffi/platforms/x64.cc

@@ -378,6 +378,11 @@ extern "C" bool node_ffi_create_fast_trampoline(
   if (has_buffer_args && fp_count != 0) {
     return false;
   }
+  // The buffer helper call clobbers target registers already loaded for
+  // earlier arguments, so buffer trampolines support a single argument only.
+  if (has_buffer_args && argc > 1) {
+    return false;
+  }
 
   const size_t incoming_gp_count = gp_count + (has_buffer_args ? 1 : 0);
   // rdi is occupied by the V8 receiver, leaving rsi, rdx, rcx, r8, and r9 for