localStorage: a malformed backing file aborts the process via CHECK

[TrevorBurnham]

Version

v27.0.0-pre (9f7ae86d8b5)

Platform

Darwin 25.6.0 arm64

Subsystem

webstorage, sqlite

What steps will reproduce the bug?

src/node_webstorage.cc asserts the SQLite type of every column it reads, but the backing file is a user-specified path. Node's own tables are STRICT, but the DDL is CREATE TABLE IF NOT EXISTS, so a file that already contains tables of those names is adopted as-is, STRICT or not.

// craft.cjs
const { DatabaseSync } = require('node:sqlite');
const out = '/tmp/ws.db';
for (const s of ['', '-wal', '-shm']) require('node:fs').rmSync(out + s, { force: true });

// Node's schema, minus STRICT. BLOB has no affinity, so a TEXT value stays TEXT.
const db = new DatabaseSync(out);
db.exec(`
  CREATE TABLE nodejs_webstorage(
    key BLOB NOT NULL, value BLOB NOT NULL, PRIMARY KEY(key));
  CREATE TABLE nodejs_webstorage_state(
    max_size INTEGER NOT NULL DEFAULT 10485760, total_size INTEGER NOT NULL,
    schema_version INTEGER NOT NULL DEFAULT 1,
    single_row_ INTEGER NOT NULL DEFAULT 1 CHECK(single_row_ = 1),
    PRIMARY KEY(single_row_));
`);
// A real UTF-16LE key, so that lookups still match; only the value is TEXT.
db.prepare('INSERT INTO nodejs_webstorage (key, value) VALUES (?, ?)')
  .run(Buffer.from('greeting', 'utf16le'), 'hello');
db.prepare('INSERT INTO nodejs_webstorage_state (total_size, schema_version)' +
  ' VALUES (0, 1)').run();
db.close();

$ node craft.cjs
$ node --localstorage-file=/tmp/ws.db -e "localStorage.getItem('greeting')"

How often does it reproduce? Is there a required condition?

The only condition is that the file exists with the wrong stored type.

What is the expected behavior? Why is that the expected behavior?

A thrown error.

What do you see instead?

SIGABRT, exit 134:

#  node[96447]: MaybeLocal<Value> node::webstorage::Storage::Load(Local<Name>)
#     at ../src/node_webstorage.cc:354
#  Assertion failed: sqlite3_column_type(stmt.get(), 0) == 4

Additional information

Separately, line 187 re-runs init_sql_v0 and overwrites the result of the sqlite3_prepare_v2() five lines above it, so prepare failures go unreported. Given a nodejs_webstorage_state table with no schema_version column, the real error is replaced by Error: bad parameter or other API misuse.