Regression in Node.js 26.8.0: aligned Buffer pool breaks multi-byte typed-array views

[cb1kenobi]

Version

26.8.0, 26.8.1

Platform

Linux, macOS, and Windows

Subsystem

Buffer

What steps will reproduce the bug?

const buffer = Buffer.allocUnsafe(8);

console.log({
  node: process.version,
  bufferLength: buffer.length,
  backingLength: buffer.buffer.byteLength,
  byteOffset: buffer.byteOffset,
});

new Uint32Array(buffer.buffer, buffer.byteOffset); // throws RangeError

How often does it reproduce? Is there a required condition?

Consistently when:

• The Buffer is allocated from the default pool.
• The typed-array element size does not divide the pool’s 65,599-byte backing allocation.
• The typed-array constructor omits its explicit length.

Small files returned by readFileSync() meet these conditions.

What is the expected behavior? Why is that the expected behavior?

Creating a typed-array view at the Buffer’s aligned byteOffset should not fail because of invisible padding after the Buffer view. This worked through Node.js 26.7.0.

What do you see instead?

RangeError: byte length of Uint32Array should be a multiple of 4

The Buffer is eight bytes, but its pooled backing ArrayBuffer is 65,599 bytes.

Additional information

This appears related to nodejs/node#65003, which changed the pool to an aligned allocation of poolSize + alignment - 1 bytes.

• This is a regression introduced in Node.js 26.8.0. The reproduction succeeds on 26.7.0 and consistently throws on 26.8.0 and 26.8.1.
  • Node.js 26.7.0: backing length 65,536; succeeds
  • Node.js 26.8.0+: backing length 65,599; throws
• V8 is unchanged: 14.6.202.34-node.28
• Supplying an explicit typed-array length works around the issue.
• This surfaced in rocksdb-js CI.