René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Accessing `Storage.prototype.length` crashes the process","articleBody":"### Version\n\nv26.0.0\n\n### Platform\n\n```text\nLinux eric-cornelissen-Latitude-7640 6.17.0-29-generic #29~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Mon May 11 10:30:58 UTC 2 x86_64 x86_64 x86_64 GNU/Linux\n```\n\n### Subsystem\n\n_No response_\n\n### What steps will reproduce the bug?\n\n```\nnode -e 'globalThis.sessionStorage.setItem.length;globalThis.Storage.prototype.length'\n```\n\nor\n\n```\necho 'globalThis.sessionStorage.setItem.length;globalThis.Storage.prototype.length' \u003eminimal_repro.js\nnode minimal_repro.js\n```\n\n### How often does it reproduce? Is there a required condition?\n\nAlways\n\n### What is the expected behavior? Why is that the expected behavior?\n\nNo segfault, for this particular program not output.\n\n### What do you see instead?\n\n```\n$ node -e 'globalThis.sessionStorage.setItem.length;globalThis.Storage.prototype.length'\n[1]    42883 segmentation fault (core dumped)  node -e\n```\n\nor\n\n```\n$ echo 'globalThis.sessionStorage.setItem.length;globalThis.Storage.prototype.length' \u003eminimal_repro.js\n$ node minimal_repro.js\n[1]    44038 segmentation fault (core dumped)  node minimal_repro.js\n```\n\n### Additional information\n\nI initially found this (and my previous bug report) using this script: https://github.com/ericcornelissen/pp-runtime-gadgets/blob/e2db81d895df5255628451ae0dac77fda2cd4e79/iterate/main.js (with the commented code in https://github.com/ericcornelissen/pp-runtime-gadgets/blob/e2db81d895df5255628451ae0dac77fda2cd4e79/iterate/keys.js uncommented). The report here is a minimal reproduction.\n\nRunning just `globalThis.Storage.prototype.length` doesn't cause a crash, reversing the access order also does not. It could be that another pair of accesses causes a segfault too, I haven't tested that.\n\n\nIn case it's helpful, here's the gdb output of running `minimal_repro.js`:\n\n```\n$ gdb --args node minimal_repro.js\nGNU gdb (Ubuntu 15.1-1ubuntu1~24.04.1) 15.1\nCopyright (C) 2024 Free Software Foundation, Inc.\nLicense GPLv3+: GNU GPL version 3 or later \u003chttp://gnu.org/licenses/gpl.html\u003e\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law.\nType \"show copying\" and \"show warranty\" for details.\nThis GDB was configured as \"x86_64-linux-gnu\".\nType \"show configuration\" for configuration details.\nFor bug reporting instructions, please see:\n\u003chttps://www.gnu.org/software/gdb/bugs/\u003e.\nFind the GDB manual and other documentation resources online at:\n    \u003chttp://www.gnu.org/software/gdb/documentation/\u003e.\n\nFor help, type \"help\".\nType \"apropos word\" to search for commands related to \"word\"...\nReading symbols from node...\n(gdb) run\nStarting program: /home/eric-cornelissen/.nvm/versions/node/v26.0.0/bin/node minimal_repro.js\n[Thread debugging using libthread_db enabled]\nUsing host libthread_db library \"/lib/x86_64-linux-gnu/libthread_db.so.1\".\n[New Thread 0x7ffff77ff6c0 (LWP 45648)]\n[New Thread 0x7ffff6ffe6c0 (LWP 45649)]\n[New Thread 0x7ffff67fd6c0 (LWP 45650)]\n[New Thread 0x7ffff5ffc6c0 (LWP 45651)]\n[New Thread 0x7ffff57fb6c0 (LWP 45652)]\n[New Thread 0x7ffff4ffa6c0 (LWP 45653)]\n\nThread 1 \"node-MainThread\" received signal SIGSEGV, Segmentation fault.\n0x0000000002174730 in sqlite3LockAndPrepare ()\n(gdb) bt\n#0  0x0000000002174730 in sqlite3LockAndPrepare ()\n#1  0x0000000002165d4c in sqlite3_prepare_v2 ()\n#2  0x0000000000b435e8 in node::webstorage::Storage::Length() ()\n#3  0x0000000000b44e04 in node::webstorage::StorageLengthGetter(v8::FunctionCallbackInfo\u003cv8::Value\u003e const\u0026) ()\n#4  0x00007fffe7dcfae9 in ?? ()\n#5  0x0000000000000000 in ?? ()\n```","author":{"url":"https://github.com/ericcornelissen","@type":"Person","name":"ericcornelissen"},"datePublished":"2026-05-23T14:30:00.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/63514/node/issues/63514"}