fix(ext/node): fix use-after-free in StatementSync JS iterator

ext/node/ops/sqlite/statement.rs

@@ -692,6 +692,7 @@ impl StatementSync {
       RETURN = "return",
       DONE = "done",
       VALUE = "value",
+      __STATEMENT_REF = "__statement_ref",
     }
 
     self.reset()?;
@@ -797,8 +798,19 @@ impl StatementSync {
     let names = &[
       NEXT.v8_string(scope).unwrap().into(),
       RETURN.v8_string(scope).unwrap().into(),
+      __STATEMENT_REF.v8_string(scope).unwrap().into(),
     ];
-    let values = &[next_func.into(), return_func.into()];
+
+    // Get the cppgc wrapper object to keep the statement alive
+    // We store a reference to the statement object on the iterator to prevent
+    // the GC from collecting it while the iterator is still in use.
+    let statement_ref = if let Some(args) = params {
+      args.this().into()
+    } else {
+      v8::undefined(scope).into()
+    };
+
+    let values = &[next_func.into(), return_func.into(), statement_ref];
     let iterator = v8::Object::with_prototype_and_properties(
       scope,
       js_iterator_proto,

tests/unit_node/sqlite_test.ts

@@ -1035,3 +1035,17 @@ Deno.test("[node/sqlite] numbered parameters in different order (?2, ?1)", () =>
   // SQL puts ?2 in column a, ?1 in column b
   assertEquals(row, { a: "second_arg", b: "first_arg", __proto__: null });
 });
+
+// https://github.com/denoland/deno/issues/31744
+Deno.test("[node/sqlite] StatementSync alive while iterator", () => {
+  using db = new DatabaseSync(":memory:");
+  db.exec("create table if not exists t1(id integer primary key)");
+  const p = db.prepare(`insert into t1(id) values (?)`);
+  for (let id = 1; id <= 1_000_000; id++) {
+    p.run(id);
+  }
+  const iter = db.prepare(`select id from t1`).iterate();
+  for (const { id } of iter) {
+    assertEquals(typeof id, "number");
+  }
+});