Commit 226576305a5 for nodejs

commit 226576305a51499cdb7acce5fe1d0efdba855302
Author: Trivikram Kamat <trivikr.dev@gmail.com>
Date:   Mon Nov 2 16:34:58 2026 -0800

    ffi: define function pointer property as own data property

    `CreateFunction` assigned `pointer` with `Object::Set`, which walks
    `Function.prototype`. A non-writable inherited `pointer` turned the
    store into a silent no-op, so the function reported the inherited
    value instead of its native address. Use `CreateDataProperty`.

    Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
    Assisted-by: claude:opus-5.5
    PR-URL: https://github.com/nodejs/node/pull/67170
    Fixes: https://github.com/nodejs/node/issues/67169
    Reviewed-By: Anna Henningsen <anna@addaleax.net>
    Reviewed-By: Paolo Insogna <paolo@cowtech.it>

diff --git a/src/node_ffi.cc b/src/node_ffi.cc
index b988120606c..81b698a7530 100644
--- a/src/node_ffi.cc
+++ b/src/node_ffi.cc
@@ -364,7 +364,7 @@ MaybeLocal<Function> DynamicLibrary::CreateFunction(
   }
   ret->SetName(name_str.As<String>());

-  if (!ret->Set(
+  if (!ret->CreateDataProperty(
               context,
               env->pointer_string(),
               BigInt::NewFromUnsigned(
diff --git a/test/ffi/test-ffi-dynamic-library.js b/test/ffi/test-ffi-dynamic-library.js
index 62cc7e0b4d4..7dcbf175a86 100644
--- a/test/ffi/test-ffi-dynamic-library.js
+++ b/test/ffi/test-ffi-dynamic-library.js
@@ -92,11 +92,16 @@ test('DynamicLibrary exposes functions and symbols', () => {
   const lib = new ffi.DynamicLibrary(libraryPath);

   try {
+    // An inherited non-writable `pointer` must not shadow the address.
+    Object.defineProperty(Function.prototype, 'pointer', {
+      value: 1, writable: false, configurable: true,
+    });
     const addI32 = lib.getFunction('add_i32', fixtureSymbols.add_i32);
     const addU64 = lib.getFunction('add_u64', {
       return: 'u64',
       arguments: ['u64', 'u64'],
     });
+    delete Function.prototype.pointer;
     const addI32Ptr = lib.getSymbol('add_i32');

     assert.strictEqual(addI32(20, 22), 42);