node:sqlite: backup() unwraps any object as a DatabaseSync, and a duck-typed URL aborts the process

Version

v27.0.0-pre (884f9cd62da)

Platform

Darwin 25.6.0 arm64

Subsystem

sqlite

What steps will reproduce the bug?

node:sqlite's backup() checks that its first argument is an object, then unwraps it. Passing anything other than a DatabaseSync results in a crash:

const { backup } = require('node:sqlite');
backup({}, '/tmp/c1a.db');

Similarly, the DatabaseSync constructor treats any object as a URL if it has a string href. If that href doesn't parse, it crashes:

const { DatabaseSync } = require('node:sqlite');
new DatabaseSync({ href: 'zzz' });

How often does it reproduce? Is there a required condition?

It's consistent.

What is the expected behavior? Why is that the expected behavior?

Both should raise a TypeError.

What do you see instead?

A segfault.

Additional information

No response

先从 node:sqlite 中 backup() 的实现和 DatabaseSync 构造函数入手，然后复现 issue 中的两个示例。当无效的 backup 参数和格式错误的类 URL 对象引发 TypeError 而不是导致 segfault，并且两个情况都有回归测试覆盖时，工作即完成。