René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"sqlite: memory leak and sqlite API misuse","articleBody":"### Version\n\nv24.16.0\n\n### Platform\n\n```text\nLinux e6fd926f804d 6.8.0-124-generic #124-Ubuntu SMP PREEMPT_DYNAMIC Tue May 26 13:00:45 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux\n```\n\n### Subsystem\n\nsqlite\n\n### What steps will reproduce the bug?\n\nExecute the following JS code, with sqlite compiled with `SQLITE_ENABLE_API_ARMOR`:\n\n```js\nconst { DatabaseSync } = require('node:sqlite');\nconst db = new DatabaseSync('/nonexistent-dir/x.db', { open: false, readOnly: true });\ntry { db.open(); } catch {}  // Can't open, now a \"sick\" handle\nconsole.log(db.isOpen);      // true\ndb.function('f', () =\u003e {});  // create_function_v2 -\u003e SQLITE_MISUSE_BKPT, `UserDefinedFunction* user_data` leaked\n```\n\nThis will trigger a leak via sqlite's API abuse detector. See below for the ASAN output.\n\n### How often does it reproduce? Is there a required condition?\n\nAlways if compiled with `SQLITE_ENABLE_API_ARMOR`\n\n### What is the expected behavior? Why is that the expected behavior?\n\nNo leak. In fact, it should not be possible to get into this situation in the first place: the API misuse guard of the sqlite API should _never_ trigger. Node.js should block getting into this situation.\n\n### What do you see instead?\n\n```\n=================================================================\n==370239==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 32 byte(s) in 1 object(s) allocated from:\n    #0 0x6391a602b411 in operator new(unsigned long) (/work/node/out/Debug/node+0xae2b411) (BuildId: af8ea042dbd52fe317d72d87d06d3dbfb9aa7fa9)\n    #1 0x6391a71cdaa7 in node::sqlite::DatabaseSync::CustomFunction(v8::FunctionCallbackInfo\u003cv8::Value\u003e const\u0026) /work/node/out/../src/node_sqlite.cc:1401:7\n    #2 0x714010e12f8c in Builtins_CallApiCallbackGeneric embedded.o\n    #3 0x714010e11512 in Builtins_InterpreterEntryTrampoline embedded.o\n    #4 0x714010e11512 in Builtins_InterpreterEntryTrampoline embedded.o\n    #5 0x714010e11512 in Builtins_InterpreterEntryTrampoline embedded.o\n    #6 0x714010e11512 in Builtins_InterpreterEntryTrampoline embedded.o\n    #7 0x714010e11512 in Builtins_InterpreterEntryTrampoline embedded.o\n    #8 0x714010e11512 in Builtins_InterpreterEntryTrampoline embedded.o\n    #9 0x714010e11512 in Builtins_InterpreterEntryTrampoline embedded.o\n    #10 0x714010e11512 in Builtins_InterpreterEntryTrampoline embedded.o\n    #11 0x714010e0df26 in Builtins_JSEntryTrampoline embedded.o\n    #12 0x714010e0dc66 in Builtins_JSEntry embedded.o\n    #13 0x6391a7e71586 in v8::internal::GeneratedCode\u003cunsigned long, unsigned long, unsigned long, unsigned long, unsigned long, long, unsigned long**\u003e::Call(unsigned long, unsigned long, unsigned long, unsigned long, long, unsigned long**) /work/node/out/../deps/v8/src/execution/simulator.h:212:12\n    #14 0x6391a7e71586 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const\u0026) /work/node/out/../deps/v8/src/execution/execution.cc:442:22\n    #15 0x6391a7e6e194 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle\u003cv8::internal::Object\u003e, v8::internal::DirectHandle\u003cv8::internal::Object\u003e, v8::base::Vector\u003cv8::internal::DirectHandle\u003cv8::internal::Object\u003e const\u003e) /work/node/out/../deps/v8/src/execution/execution.cc:532:10\n    #16 0x531000015287  (\u003cunknown module\u003e)\n\nSUMMARY: AddressSanitizer: 32 byte(s) leaked in 1 allocation(s).\n\n```\n\n### Additional information\n\nFound with an experimental static-dynamic hybrid analyzer I'm developing.","author":{"url":"https://github.com/ndossche","@type":"Person","name":"ndossche"},"datePublished":"2026-06-10T10:06:35.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/63831/node/issues/63831"}