localStorage: a malformed backing file aborts the process via CHECK

Version

v27.0.0-pre (9f7ae86d8b5)

Platform

Darwin 25.6.0 arm64

Subsystem

webstorage, sqlite

What steps will reproduce the bug?

src/node_webstorage.cc asserts the SQLite type of every column it reads, but the backing file is a user-specified path. Node's own tables are STRICT, but the DDL is CREATE TABLE IF NOT EXISTS, so a file that already contains tables of those names is adopted as-is, STRICT or not.

// craft.cjs
const { DatabaseSync } = require('node:sqlite');
const out = '/tmp/ws.db';
for (const s of ['', '-wal', '-shm']) require('node:fs').rmSync(out + s, { force: true });

// Node's schema, minus STRICT. BLOB has no affinity, so a TEXT value stays TEXT.
const db = new DatabaseSync(out);
db.exec(`
  CREATE TABLE nodejs_webstorage(
    key BLOB NOT NULL, value BLOB NOT NULL, PRIMARY KEY(key));
  CREATE TABLE nodejs_webstorage_state(
    max_size INTEGER NOT NULL DEFAULT 10485760, total_size INTEGER NOT NULL,
    schema_version INTEGER NOT NULL DEFAULT 1,
    single_row_ INTEGER NOT NULL DEFAULT 1 CHECK(single_row_ = 1),
    PRIMARY KEY(single_row_));
`);
// A real UTF-16LE key, so that lookups still match; only the value is TEXT.
db.prepare('INSERT INTO nodejs_webstorage (key, value) VALUES (?, ?)')
  .run(Buffer.from('greeting', 'utf16le'), 'hello');
db.prepare('INSERT INTO nodejs_webstorage_state (total_size, schema_version)' +
  ' VALUES (0, 1)').run();
db.close();

$ node craft.cjs
$ node --localstorage-file=/tmp/ws.db -e "localStorage.getItem('greeting')"

How often does it reproduce? Is there a required condition?

The only condition is that the file exists with the wrong stored type.

What is the expected behavior? Why is that the expected behavior?

A thrown error.

What do you see instead?

SIGABRT, exit 134:

#  node[96447]: MaybeLocal<Value> node::webstorage::Storage::Load(Local<Name>)
#     at ../src/node_webstorage.cc:354
#  Assertion failed: sqlite3_column_type(stmt.get(), 0) == 4

Additional information

Separately, line 187 re-runs init_sql_v0 and overwrites the result of the sqlite3_prepare_v2() five lines above it, so prepare failures go unreported. Given a nodejs_webstorage_state table with no schema_version column, the real error is replaced by Error: bad parameter or other API misuse.

Đọc src/node_webstorage.cc quanh dòng 187 và 354, sau đó chạy craft.cjs tiếp theo là lệnh node --localstorage-file để tái hiện việc abort. Hoàn tất có nghĩa là dữ liệu malformed của backing file tạo ra một lỗi được throw thay vì SIGABRT, và lỗi prepare được mô tả gần dòng 187 được báo cáo thay vì bị thay thế bởi một lỗi xảy ra sau đó.