ffi: bool changes from uint8 to Boolean after Fast API optimization

[trivikr]

Version

main

Platform

macOS 26.5.2

Subsystem

ffi

What steps will reproduce the bug?

add.c

#include <stdint.h>

uint8_t add_u8(uint8_t a, uint8_t b) {
  return a + b;
}

Build the file

$ cc -dynamiclib add.c -o libadd.dylib

Use in repro.js

import { dlopen } from 'node:ffi';

const handle = dlopen(`./libadd.dylib`, {
  add_u8: {
    arguments: ['bool', 'bool'],
    return: 'bool',
  },
});

const native = handle.functions.add_u8;

function fn(a, b) {
  return native(a, b);
}

eval('%PrepareFunctionForOptimization(fn)');

let result = fn(1, 0);
console.log('unoptimized:', result, typeof result);

eval('%OptimizeFunctionOnNextCall(fn)');

result = fn(1, 0);
console.log('optimized:', result, typeof result);

result = fn(true, false);
console.log('booleans:', result, typeof result);

Run

$ node --experimental-ffi --allow-natives-syntax --no-warnings repro.js

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

unoptimized: 1 number
optimized: 1 number
TypeError: Argument 0 must be a uint8

The optimized numeric call should behave exactly like the unoptimized call.
The final fn(true, false) call should throw ERR_INVALID_ARG_VALUE.

What do you see instead?

unoptimized: 1 number
optimized: true boolean
booleans: true boolean

After JIT optimization, the return type changes from numeric uint8 to Boolean, and Boolean arguments become accepted

Additional information

No response