backup() only checked that the source argument was a BaseObject before
casting it to Database, so passing a Statement or Session caused a
type confusion. Check against the Database constructor template
instead.
Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66797
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
On a mounted VFS, `readlink()`, `realpath()` and `mkdtemp()` only
returned a Buffer for `{ encoding: 'buffer' }`. The string form
`'buffer'`, any other encoding, and a Buffer `mkdtemp()` prefix were
ignored. The `VirtualFileSystem` `readlink` and `realpath` methods
ignored the encoding with `MemoryProvider` and passed it on to
`RealFSProvider`, which threw `ERR_INVALID_ARG_TYPE` for `'buffer'`,
while for other encodings `realpath()` failed and `readlink()`
returned the host path of absolute targets.
Get these paths from the provider as strings and apply the encoding
to the result, normalizing the options with `getOptions()` and
converting with `encodeRealpathResult()` as `fs` does. The latter
moves to `internal/fs/utils` so the VFS can use it.
Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66352
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
`Channel` reads its subscriber count through a raw `BindingData*` that
was never cleared, so any native holder that outlives environment
cleanup reads a destroyed object. The null check in `HasSubscribers()`
could not fire, because the pointer was only ever assigned in the
constructor.
`node:sqlite` holds a strong `BaseObjectPtr<Channel>` for the lifetime
of a `Database`, which made this reachable from ordinary
JavaScript. A statement left mid-step at exit is finalized by the
destructor chain after `Environment::RunCleanup()` has destroyed the
binding, and `sqlite3_finalize()` invokes the profile callback for such
a statement. The result was a segfault at normal process exit; inside a
worker it took down the whole process.
Clear `binding_data_` on every `Channel` the binding owns whenever it
gives up that ownership, both in the destructor and in
`PrepareForSerialization()`, so that the existing null check in
`HasSubscribers()` does its job. The second check in `Publish()` is now
unreachable and is dropped. This protects any holder that is itself a
`BaseObject`, and so is destroyed later in the same cleanup. A holder
that is not a `BaseObject` still needs a cleanup hook or a weak
reference, because `Realm::~Realm()` checks that no `BaseObject`s
remain.
On the `node:sqlite` side, switch `Database::trace_channel_` to a
`BaseObjectWeakPtr`, so that it follows the same convention `permission`
documents, where `BindingData` is the sole owner of channels.
`TraceCallback` already null-checks, so this needs no other change
there.
Also check `AreTraceEventsSuppressed()` before the channel in
`TraceCallback()`, so that a suppressed callback does not dereference it
at all. `Statement::Finalize()` already suppresses trace events, so
the reported path was meant to be a no-op; only the order of the `||`
operands took it through the channel first.
Fixes: https://github.com/nodejs/node/issues/65858
Assisted-by: Claude Opus 5
Signed-off-by: Trevor Burnham <trevorburnham@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65860
Reviewed-By: Bryan English <bryan@bryanenglish.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Closing a virtual table cursor invoked the iterator's return() even
after next() had already reported done: true, deviating from for...of
semantics where return() only runs on abrupt termination. An empty
custom iterable with a throwing return() made an otherwise successful
query fail.
Only close the iterator when the scan stopped early, as with LIMIT, a
break, or a cursor re-filter; a normally finished iterator already ran
its cleanup.
Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
PR-URL: https://github.com/nodejs/node/pull/66519
Fixes: https://github.com/nodejs/node/issues/66518
Reviewed-By: Guilherme Araújo <arauujogui@gmail.com>
Run supported DH, ECDH, legacy TLS, TLS 1.2 PSK, cipher metadata,
raw key, and X.509 date cases with BoringSSL. Assert its DH flags,
curve format errors, and name-constraint behavior. Narrow key/cert
array exclusions to the failing multi-identity cases.
Use modp5 for the DH group setter checks and remove the unused legacy
protocol fallback helper.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66922
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Translate cipher-suite names into protocol IDs for BoringSSL's TLS 1.3
configuration API. Handle duplicates and unknown names, reject nonempty
lists without a supported suite, and implement honorCipherOrder through
preference flags.
Cover suite restrictions, explicit preference ordering, legacy-only
lists, runtime defaults, and command-line overrides.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66922
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Add SHA3-256, SHA3-384, and SHA3-512 to name lookup and getHashes().
BoringSSL exposes EVP_sha3_* descriptors but omits them from its
digest registry. Map the names directly to those descriptors so
node:crypto can use them too.
When using BoringSSL, limit WebCrypto SHA-3 support to digest
operations.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66922
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
When a peer sends GOAWAY(NO_ERROR), the session starts a graceful close
on its own, which disarmed the detection of nghttp2 internally
terminating the session after a protocol error. Instead, also treat it
as an internal termination when nghttp2 no longer wants to read or
write while we still have open streams.
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/66641
Reviewed-By: Tim Perry <pimterry@gmail.com>
Speed up creating and aborting signals, adding and removing abort
listeners, AbortSignal.any() and AbortSignal.timeout(), and stop the
default abort reason from retaining the aborting caller.
- Only allocate and dispatch the abort event when the signal has abort
listeners, and only allocate the dependent signal list when there
are dependent signals.
- Track whether an event is trusted with a private field instead of a
WeakSet.
- Flatten addEventListener() options into locals instead of
allocating a normalized options object, only validate the signal
option when one is passed, and use the listener flags directly.
- Call the EventTarget kNewListener and kRemoveListener
implementations directly. V8 does not optimize keyed super property
access such as super[kNewListener]().
- Initialize the internal slots that AbortSignal.any() adds to its
sources up front, and the composite-only slots for composites, so
live signals don't change shape.
- Give every signal a single WeakRef that is shared by all the
composites that follow it, and register each composite and each
source once with their cleanup registries instead of registering
every (source, composite) pair with an unregister token. Registering
with an unregister token is several times more expensive.
- Register AbortSignal.timeout() timers through a holder that is
emptied when the timer fires, instead of using the signal as an
unregister token.
- Take positional arguments in AbortSignal's internal constructor
instead of destructuring an options object that defaults to
kEmptyObject. kEmptyObject is a null-prototype object, which V8 keeps
in dictionary mode, so each of those reads was an uncached dictionary
miss that cost more than the rest of the constructor.
- Create the default abort reason with Error.stackTraceLimit set to 0.
Until a captured stack is formatted, V8 keeps the call sites, which
retain the receivers and functions of the aborting caller's frames,
so a retained signal kept the aborted work alive. Formatting the
stack eagerly would fix that but costs several microseconds per
abort(). The default AbortError no longer shows where abort() was
called; callers that want that can pass their own reason.
- Add benchmarks for aborting, adding and removing abort listeners,
and AbortSignal.any().
Refs: https://github.com/nodejs/node/issues/66192
Refs: https://github.com/nodejs/node/pull/66265
Assisted-by: claude:opus-5.5
Signed-off-by: Robert Nagy <ronagy@icloud.com>
PR-URL: https://github.com/nodejs/node/pull/66789
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
When native code invokes a registered callback from the event loop,
no callback scope is active. A nextTick or microtask queued by the
callback only ran when an unrelated Node.js callback fired, or at
beforeExit.
Open an InternalCallbackScope in InvokeCallback when no scope is
active, so the queues are drained when the callback returns.
Callbacks invoked synchronously during a call into native code
already run inside the caller's scope and are left unchanged.
Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
PR-URL: https://github.com/nodejs/node/pull/66918
Fixes: https://github.com/nodejs/node/issues/66917
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Add --test-forbid-only and the forbidOnly run() option to detect
accidentally committed exclusive tests. Reject only declarations and
runOnly(true) in both isolation modes, and record a run-level failure
so TODO and expected failures cannot absorb the error.
Document the runtime-only detection and add regression coverage for
filtering, option inheritance, both isolation modes, and disabled
guards.
Refs: https://github.com/nodejs/node/issues/60917
Assisted-by: a coding agent
Signed-off-by: João Victor <joao.oliveira@softtor.com.br>
PR-URL: https://github.com/nodejs/node/pull/66578
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
The readBigInts, returnArrays, allowBareNamedParameters and
allowUnknownNamedParameters options were read with
`if (Get().ToLocal())`, so a throwing getter left an exception pending
while the constructor carried on. Option parsing continued, the
database was opened, and the exception was lost, leaving a database
file on disk for a constructor call that should have failed.
Return as soon as reading any of these options fails, matching how
every other option is handled.
Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
Assisted-by: Claude
PR-URL: https://github.com/nodejs/node/pull/66748
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
fs.promises.watch() over a virtual mount resolved the first next()
with { done: true } when the signal was already aborted, while native
fs.promises.watch() rejects with ABORT_ERR.
Buffer the AbortError in VFSWatchAsyncIterable so the first next()
rejects once and later calls behave like an exhausted iterator,
matching the native async generator. Concurrently pending next()
calls now resolve after the rejecting one instead of all rejecting.
Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: opencode
PR-URL: https://github.com/nodejs/node/pull/66254
Fixes: https://github.com/nodejs/node/issues/66253
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
A MemoryFileHandle snapshotted the file's buffer at open and never
checked the entry again. After the file changed through the provider
or another handle, an open handle served stale reads and fstat sizes,
and its writes went into the old copy, undoing other handles' changes.
Record the entry content each handle last saw or wrote, and adopt the
entry's content whenever another handle has replaced it, so an open
descriptor is a live view of the file as on a real filesystem.
Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
PR-URL: https://github.com/nodejs/node/pull/66356
Fixes: https://github.com/nodejs/node/issues/66355
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Blob sizes cross between C++ and JavaScript as uint32 values, while the
underlying DataQueue tracks them as uint64. openAsBlob() on a 5 GiB
file therefore returned a Blob of size 1073741824.
Reporting the real size is not enough on its own. The inbound direction
assumes a uint32 as well, so a correct size reaches CHECK(IsUint32())
in ToSlice() and StoreDataObject() and aborts blob.slice() and
URL.createObjectURL(). Pass the sizes as doubles and keep them as
uint64_t in C++. Everything below this boundary is already 64-bit, so
this only stops the narrowing at the edge.
Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66207
Fixes: https://github.com/nodejs/node/issues/52585
Refs: https://github.com/nodejs/node/pull/52588
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Filip Skokan