sqlite: keep sessions alive across SQLite callbacks

[TrevorBurnham]

Session calls MakeWeak() and DatabaseSync::sessions_ holds raw Session*, so nothing keeps a session alive once JavaScript drops the reference. SQLite runs PRAGMA table_xinfo from inside its pre-update hook, which reaches JavaScript, so a GC during a callback invoked from there collects the session the hook is still walking:

db.createSession(); // return value dropped
db.setAuthorizer((a, p1) => {
  if (p1 === 'table_xinfo') globalThis.gc();
  return constants.SQLITE_OK;
});
db.exec('INSERT INTO t VALUES (1)'); // segfault in xPreUpdate

CallbackDepthGuard already wraps every point where SQLite hands control back to JavaScript (authorizer, trace subscriber, user-defined functions, aggregates, changeset apply), so it now also holds a BaseObjectPtr to each attached session for the callback's duration. BaseObjectPtr clears the weak handle on the first strong reference and restores it on the last, so a session that JavaScript no longer references simply becomes collectable again once the callback returns. Connections with no sessions allocate nothing.

Making sessions_ strong instead would create a cycle with Session::database_, which is deliberately strong (a session must keep its database alive), and leak both objects.

TraceCallback built its payload before entering the guard. That allocation can trigger a GC, so the guard moves above it. I could not get that window to crash on demand, even with --gc-interval=1, so treat it as defensive rather than a demonstrated fix.

Fixes: #65460

[nodejs-github-bot]

Review requested:

• @nodejs/sqlite

[codecov]

Codecov Report

❌ Patch coverage is 90.90909% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.13%. Comparing base (21f0f27) to head (7adc572).
⚠️ Report is 145 commits behind head on main.

Files with missing lines	Patch %	Lines
src/node_sqlite.cc	87.50%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65465      +/-   ##
==========================================
+ Coverage   90.12%   90.13%   +0.01%     
==========================================
  Files         752      751       -1     
  Lines      252315   252306       -9     
  Branches    47444    47436       -8     
==========================================
+ Hits       227395   227416      +21     
+ Misses      16217    16196      -21     
+ Partials     8703     8694       -9     

Files with missing lines	Coverage Δ
src/node_sqlite.h	86.40% <100.00%> (+0.13%)	⬆️
src/node_sqlite.cc	82.09% <87.50%> (+0.25%)	⬆️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76621/

[panva]

#65465 (comment)

Uff, 8 minutes too early :D next CQ run.

[nodejs-github-bot]

Landed in 76aeacf