ffi: AllocateCodeNear() probes up to 2048 pages with a failing mmap each, costing ~790 µs per trampoline #64968

import { DynamicLibrary, suffix } from 'node:ffi';
import { stat } from 'node:fs/promises';

const libPath = new URL(`./repro.${suffix}`, import.meta.url).pathname;
await stat(libPath);

const fastEligible = { arguments: ['i32', 'i32'], return: 'i32' };
const fastIneligible = { arguments: Array(9).fill('i32'), return: 'i32' };

const lib = new DynamicLibrary(libPath);

function timeResolve(name, signature) {
  const start = performance.now();
  lib.getFunction(name, signature);
  return (performance.now() - start) * 1000;
}

// Warm up one-time initialization (libffi setup, executable-memory self-test)
// so it is not attributed to the first measured resolution.
lib.getFunction('add9', fastIneligible);
lib.getFunction('add2', fastEligible);

// Same symbol resolution work, but no trampoline is allocated.
console.log(`add9, no trampoline:  ${timeResolve('add9', fastIneligible).toFixed(1)} us`);
console.log(`add2, first probe:    ${timeResolve('add2', fastEligible).toFixed(1)} us`);

// Every fast-eligible resolution allocates another trampoline page next to the
// library, so the free pages inside AllocateCodeNear()'s +/- 1024 page probe
// window are steadily consumed. Once they are gone, each allocation walks the
// whole window, fails every MAP_FIXED_NOREPLACE probe, and takes the plain-mmap
// fallback it could have taken immediately.
const samples = [];
for (let i = 0; i < 1200; i++) samples.push(timeResolve('add2', fastEligible));

for (let i = 0; i < samples.length; i += 200) {
  const window = samples.slice(i, i + 200);
  const mean = window.reduce((a, b) => a + b, 0) / window.length;
  console.log(`add2, resolves ${i + 1}-${i + window.length}: mean ${mean.toFixed(1)} us`);
}

lib.close();