close() / closeSync() causes SIGSEGV or process hang after query execution on file-based databases

[omardoescode]

Description

Calling conn.closeSync() / db.closeSync() (or the async close() variants) on a file-based database after executing queries causes:

• Node.js: SIGSEGV (segfault / core dump) on process exit
• Electron: process hangs indefinitely, never exits

In-memory databases (:memory:) are not affected.

Environment

• @ladybugdb/core 0.15.3
• Node.js v22.22.2 (also reproduced on v24.14.0 via Electron 41.2.0)
• Linux x64 (Arch Linux, kernel 6.19.11)

Reproduction

const lbug = require('@ladybugdb/core');

  (async () => {
    const db = new lbug.Database('./test.lbdb');
    const conn = new lbug.Connection(db);
    await conn.query('CREATE NODE TABLE IF NOT EXISTS T(id STRING PRIMARY KEY)');
    const id = 'test-' + Date.now();
    await conn.query(`CREATE (:T {id: '${id}'})`);
    await conn.query('MATCH (t:T) RETURN t.id');
    conn.closeSync();
    db.closeSync();
    console.log('Done — process should exit');
  })();

$ node test.js
Done — process should exit
[1]    986506 segmentation fault (core dumped)  node test.js

[adsharma]

Looks like a double free bug related to NodeQueryResult:

https://gist.github.com/adsharma/57a18e9cb9cf8fc81a61efddaade6ff7

[ligon]

Reopening — original repro still SIGSEGVs on @ladybugdb/core@0.15.4, despite #10 having merged.

Repro (issue's original script, verbatim)

$ node test.js
Done — process should exit
[1]    7848 segmentation fault (core dumped)  node test.js
$ echo $?
139

Environment

• @ladybugdb/core 0.15.4 (Database.getVersion() confirms)
• Node.js v22.22.2
• Linux aarch64, Debian 12 (glibc 2.36)

Bisection of triggering conditions

Starting from the original repro and removing pieces one at a time:

Variation	Exit
RETURN 1 only, then c.closeSync(); db.closeSync()	0
CREATE NODE TABLE only (no DML), then both closes	0
CREATE NODE TABLE + CREATE (:T{...}), no closeSync	0
CREATE NODE TABLE + CREATE (:T{...}), then close + process.exit(0)	0
CREATE NODE TABLE + CREATE (:T{...}), only c.closeSync()	0
CREATE NODE TABLE + CREATE (:T{...}), only db.closeSync()	139
CREATE NODE TABLE + CREATE (:T{...}), both closes (original)	139

So the crash requires all three: a write (DML) actually hit a table + db.closeSync() was called + the process exits naturally (not via process.exit). It looks like a finalizer running on already-closed/freed Database state during Node's natural teardown — consistent with @adsharma's original NodeQueryResult double-free hypothesis, but apparently in a path #10 didn't cover (and reproducible without ever holding a query result reference — the discarded c.querySync(...) results trigger it).

Smallest repro:

const lbug = require('@ladybugdb/core');
const fs = require('fs'), os = require('os'), path = require('path');
const p = path.join(fs.mkdtempSync(path.join(os.tmpdir(),'lbug-')),'t.db');
const db = new lbug.Database(p, 64*1024*1024, true, false, 1*1024*1024*1024);
const c = new lbug.Connection(db);
c.querySync('CREATE NODE TABLE Person(id INT64 PRIMARY KEY, name STRING);');
c.querySync('CREATE (:Person {id:1, name:"alice"});');
db.closeSync();
console.log('OK');
// → "OK", then SIGSEGV, exit 139

Happy to gather a stack/gdb bt if useful — let me know.

[ligon]

The original repro still SIGSEGVs on @ladybugdb/core@0.15.4, despite #10 having merged — flagging in case a maintainer wants to reopen.

Repro (issue's original script, verbatim)

$ node test.js
Done — process should exit
[1]    7848 segmentation fault (core dumped)  node test.js
$ echo $?
139

Environment

• @ladybugdb/core 0.15.4 (Database.getVersion() confirms)
• Node.js v22.22.2
• Linux aarch64, Debian 12 (glibc 2.36)

Bisection of triggering conditions

Starting from the original repro and removing pieces one at a time:

Variation	Exit
RETURN 1 only, then c.closeSync(); db.closeSync()	0
CREATE NODE TABLE only (no DML), then both closes	0
CREATE NODE TABLE + CREATE (:T{...}), no closeSync	0
CREATE NODE TABLE + CREATE (:T{...}), then close + process.exit(0)	0
CREATE NODE TABLE + CREATE (:T{...}), only c.closeSync()	0
CREATE NODE TABLE + CREATE (:T{...}), only db.closeSync()	139
CREATE NODE TABLE + CREATE (:T{...}), both closes (original)	139

The crash needs all three: a write (DML) actually hit a table + db.closeSync() was called + the process exits naturally (not via process.exit). Looks like a finalizer running on already-closed/freed Database state during Node's natural teardown — consistent with @adsharma's original NodeQueryResult double-free hypothesis, but in a path #10 didn't cover (reproducible without ever holding a query result reference — the discarded c.querySync(...) results trigger it).

Smallest repro:

const lbug = require('@ladybugdb/core');
const fs = require('fs'), os = require('os'), path = require('path');
const p = path.join(fs.mkdtempSync(path.join(os.tmpdir(),'lbug-')),'t.db');
const db = new lbug.Database(p, 64*1024*1024, true, false, 1*1024*1024*1024);
const c = new lbug.Connection(db);
c.querySync('CREATE NODE TABLE Person(id INT64 PRIMARY KEY, name STRING);');
c.querySync('CREATE (:Person {id:1, name:"alice"});');
db.closeSync();
console.log('OK');
// → "OK", then SIGSEGV, exit 139

Happy to gather a stack/gdb bt if useful.

[adsharma]

Backtrace:

(lldb) bt
* thread #1, name = 'node-MainThread', queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
  * frame #0: 0x000000010343cd18 lbugjs.node`lbug::processor::FactorizedTable::~FactorizedTable() + 36
    frame #1: 0x00000001032899ac lbugjs.node`lbug::main::MaterializedQueryResult::~MaterializedQueryResult() + 148
    frame #2: 0x0000000102e1ac4c lbugjs.node`NodeQueryResult::~NodeQueryResult() + 148
    frame #3: 0x0000000102e1ae60 lbugjs.node`NodeQueryResult::~NodeQueryResult() + 12
    frame #4: 0x0000000102e1f704 lbugjs.node`Napi::ObjectWrap<NodeQueryResult>::FinalizeCallback(napi_env__*, void*, void*) + 80
    frame #5: 0x0000000104271a2c libnode.141.dylib`void napi_env__::CallIntoModule<void node_napi_env__::CallFinalizer<true>(void (*)(napi_env__*, void*, void*), void*, void*)::'lambda'(napi_env__*)&, void node_napi_env__::CallbackIntoModule<true, void node_napi_env__::CallFinalizer<true>(void (*)(napi_env__*, void*, void*), void*, void*)::'lambda'(napi_env__*)>(void node_napi_env__::CallFinalizer<true>(void (*)(napi_env__*, void*, void*), void*, void*)::'lambda'(napi_env__*)&&)::'lambda'(napi_env__*, v8::Local<v8::Value>)>(void node_napi_env__::CallFinalizer<true>(void (*)(napi_env__*, void*, void*), void*, void*)::'lambda'(napi_env__*)&, void node_napi_env__::CallFinalizer<true>(void (*)(napi_env__*, void*, void*), void*, void*)::'lambda'(napi_env__*)&&) + 64
    frame #6: 0x000000010521c050 libnode.141.dylib`void node_napi_env__::CallFinalizer<true>(void (*)(napi_env__*, void*, void*), void*, void*) + 116
    frame #7: 0x0000000104257054 libnode.141.dylib`v8impl::Reference::Finalize() + 88
    frame #8: 0x000000010426ebac libnode.141.dylib`napi_env__::DeleteMe() + 36
    frame #9: 0x0000000104216380 libnode.141.dylib`node::CleanupQueue::Drain() + 68
    frame #10: 0x0000000104249bf8 libnode.141.dylib`node::Environment::RunCleanup() + 332
    frame #11: 0x00000001051f5fc0 libnode.141.dylib`node::FreeEnvironment(node::Environment*) + 144
    frame #12: 0x00000001042c8bac libnode.141.dylib`node::NodeMainInstance::Run() + 164
    frame #13: 0x000000010426ccd0 libnode.141.dylib`node::Start(int, char**) + 676
    frame #14: 0x000000019d689d54 dyld`start + 7184