diagnostics_channel: Channel::binding_data_ dangles after environment cleanup, crashing node:sqlite at exit

Open
#65,858 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
javascript, node.js, sqlite
Domain
backend, databases, observability

Research direction

Run the provided node:diagnostics_channel and node:sqlite reproduction first, then trace Channel::binding_data_ through Environment::RunCleanup() and the SQLite profile callback. Confirm the fix against the same exit scenario, including a statement left mid-step without explicit close(), and ensure the process exits without SIGSEGV.

Written by the indexing model from the issue text.

Description

Version

v27.0.0-pre (2dfdb6a4206)

Platform
Darwin 25.6.0 arm64
Subsystem

diagnostics_channel, sqlite

What steps will reproduce the bug?

Channel holds its BindingData as a raw pointer that is never cleared, so any native holder that outlives environment cleanup reads a destroyed object. Here's a replication case using node:sqlite:

const dc = require('node:diagnostics_channel');
const { DatabaseSync } = require('node:sqlite');

dc.subscribe('sqlite.db.query', () => {});

const db = new DatabaseSync(':memory:');
db.exec('CREATE TABLE t(x)');
const ins = db.prepare('INSERT INTO t VALUES (?)');
for (let i = 0; i < 200; i++) ins.run(i);

// Start iterating and abandon it: the statement stays mid-step, so the
// finalize that happens at teardown fires SQLite's profile callback.
const it = db.prepare('SELECT * FROM t').iterate();
it.next();
globalThis.keepAlive = { db, it };
console.log('reached end of script');
How often does it reproduce? Is there a required condition?

Three conditions are required (all included in the example above):

  1. A subscriber on sqlite.db.query, so the SQLite profile hook is installed.
  2. A statement left mid-step at exit, so that the finalize during teardown has a started statement to profile.
  3. No explicit close(), so the statement is finalized by the destructor chain after Environment::RunCleanup() rather than before it.
What is the expected behavior? Why is that the expected behavior?

Exiting a process that used node:sqlite with a sqlite.db.query subscriber
shouldn't crash.

What do you see instead?

SIGSEGV, exit 139, after the script has finished.

Dominant language
JavaScript
Stars
122k
Forks
37.4k
Avg merge
4d 4h
Merged PRs (30d)
276

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nodejs/node

All issues in nodejs/node

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.