René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"node:sqlite: process crash (SIGSEGV) when a Session outlives its garbage-collected DatabaseSync","articleBody":"### Version\n\nv27.0.0-pre\n\n### Platform\n\n```text\nLinux x64 (platform-independent)\n```\n\n### Subsystem\n\nsqlite\n\n### What steps will reproduce the bug?\n\n`database.createSession()` returns a `Session` that holds only a weak reference to its `DatabaseSync`. If the database becomes unreachable and is garbage-collected while the session is still alive, calling any session method dereferences the now-null weak pointer and crashes the process.\n\n```\n// run with: node --expose-gc --experimental-sqlite repro.js\nconst { DatabaseSync } = require('node:sqlite');\n\nfunction createSession() {\n  const db = new DatabaseSync(':memory:');\n  db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');\n  return db.createSession();   // session keeps only a WEAK ref to db\n}\n\nconst session = createSession(); // no strong reference to db survives\nglobal.gc();                     // DatabaseSync is collected here\n\nsession.changeset();       // SIGSEGV (also: .patchset(), .close(), Symbol.dispose)\n```\n\n### How often does it reproduce? Is there a required condition?\n\nDeterministically, once the `DatabaseSync` has actually been collected.\n\n\n\n### What is the expected behavior? Why is that the expected behavior?\n\nA thrown Error (code: 'ERR_INVALID_STATE', message \"database is not open\"), consistent with database.limits and other post-close paths... not a process crash.\n\n\n\n### What do you see instead?\n\nSegmentation fault (core dumped)   # exit 139\nGDB shows the fault in `node::sqlite::Session::Changeset` at instruction `cmpq $0x0,0xc0(%rax)` with `%rax = 0`\n\n### Additional information\n\nRoot cause: Session held only a weak reference to its DatabaseSync, unlike StatementSync (from database.prepare()), which holds a strong reference and keeps its database alive. When the database handle is dropped and collected while the session is still reachable, the weak pointer is nulled and Session::Changeset/Close dereference it via !session->database_->IsOpen(), reading connection_ through a null this. The session should instead keep the database alive, collection of the db handle is not the same as the user calling database.close().\n\n\n","author":{"url":"https://github.com/3zrv","@type":"Person","name":"3zrv"},"datePublished":"2026-06-08T16:20:57Z","url":"https://github.com/nodejs/node/issues/63796"}