René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"sqlite: two reentrancy guard gaps let a callback free the object SQLite is still using","articleBody":"### Version\n\n`main` (03fb38410b2)\n\n### Platform\n\n```text\nDarwin fcb214bb6048 25.6.0 Darwin Kernel Version 25.6.0: Fri Jul 31 19:19:08 PDT 2026; root:xnu-12377.161.14~5/RELEASE_ARM64_T6050 arm64\n```\n\n### Subsystem\n\nsqlite\n\n### What steps will reproduce the bug?\n\nFree memory that SQLite is still using from a callback:\n\n```js\nimport { DatabaseSync, constants } from 'node:sqlite';\n\nconst db = new DatabaseSync(':memory:');\ndb.exec('CREATE TABLE t(a PRIMARY KEY)');\nconst session = db.createSession();\n\nlet once = true;\ndb.setAuthorizer((action, p1) => {\n  if (action === constants.SQLITE_PRAGMA && p1 === 'table_xinfo' && once) {\n    once = false;\n    session.close();\n  }\n  return constants.SQLITE_OK;\n});\n\ndb.exec('INSERT INTO t VALUES (1)');\n```\n\n### How often does it reproduce? Is there a required condition?\n\nThe fault always occurs, but it's not always visible under the default allocator. Run with\n`MallocScribble=1 MallocPreScribble=1 MallocNanoZone=0` on macOS and you get exit 139 deterministically; without it, the script can exit 0.\n\n### What is the expected behavior? Why is that the expected behavior?\n\n`statement.close()` should throw `ERR_INVALID_STATE`. Per `doc/api/sqlite.md`:\n\n> An `ERR_INVALID_STATE` error is thrown if this statement is currently executing, which happens\n> when the method is called from a callback that the statement itself triggered, such as a\n> user-defined function, an aggregate function, or a `'sqlite.db.query'` subscriber.\n\n### What do you see instead?\n\nA use-after-free. Under `MallocScribble`, lldb stops in `sqlite3VdbeMemSetNull(pMem=0xaaaaaaaaaaaaaaaa)` with `EXC_BAD_ACCESS`.\n\n### Additional information\n\n_No response_","author":{"url":"https://github.com/TrevorBurnham","@type":"Person","name":"TrevorBurnham"},"datePublished":"2026-08-20T12:55:12Z","url":"https://github.com/nodejs/node/issues/65428"}