René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"sqlite: use-after-free when Session.close() is called reentrantly","articleBody":"### Version\n\nmain\n\n### Platform\n\n```text\nN/A\n```\n\n### Subsystem\n\nsqlite\n\n### What steps will reproduce the bug?\n\n```js\nimport { DatabaseSync, constants } from 'node:sqlite';\n\nconst db = new DatabaseSync(':memory:');\ndb.exec('CREATE TABLE t(id INTEGER PRIMARY KEY, value TEXT)');\nconst session = db.createSession({ table: 't' });\ndb.exec(\"INSERT INTO t VALUES (1, 'a'), (2, 'b'), (3, 'c')\");\n\ndb.setAuthorizer(() => {\n  session.close();\n  return constants.SQLITE_OK;\n});\n\ntry {\n  console.log(session.changeset().length);\n} catch (err) {\n  console.log(`${err.name}: ${err.message}`);\n}\n```\n\n### How often does it reproduce? Is there a required condition?\n\nAlways\n\n### What is the expected behavior? Why is that the expected behavior?\n\nIt should fail without freeing the active native session out from under the in-progress operation.\n\n### What do you see instead?\n\n```console\nError: session is not open\n```\n\nCalling `changeset()` enters SQLite session changeset generation, which runs SQL internally and invokes the authorizer. The authorizer closes the same `Session` reentrantly, so native changeset generation continues after the underlying session has been deleted.\n\n### Additional information\n\n_No response_","author":{"url":"https://github.com/trivikr","@type":"Person","name":"trivikr"},"datePublished":"2026-08-17T06:17:45Z","url":"https://github.com/nodejs/node/issues/65347"}