Fix Bun.inspect null deref with Proxy prototypes; stop reporting from inside the sql lazy-property builders

src/jsc/bindings/BunObject.cpp

@@ -317,10 +317,16 @@
     auto* globalObject = defaultGlobalObject(bunObject->globalObject());
     JSValue sqlValue = globalObject->internalModuleRegistry()->requireId(globalObject, vm, InternalModuleRegistry::BunSql);
 #if BUN_DEBUG
-    if (scope.exception()) globalObject->reportUncaughtExceptionAtEventLoop(globalObject, scope.exception());
+    if (auto* exception = scope.exception()) {
+        globalObject->reportUncaughtExceptionAtEventLoop(globalObject, exception);
+        if (!scope.exception()) throwException(globalObject, scope, exception);
+    }
 #endif
-    RETURN_IF_EXCEPTION(scope, {});
-    RELEASE_AND_RETURN(scope, sqlValue.getObject()->get(globalObject, vm.propertyNames->defaultKeyword));
+    RETURN_IF_EXCEPTION(scope, jsUndefined());
+    if (!sqlValue || !sqlValue.isObject()) [[unlikely]] return jsUndefined();
+    JSValue result = sqlValue.getObject()->get(globalObject, vm.propertyNames->defaultKeyword);
+    RETURN_IF_EXCEPTION(scope, jsUndefined());
+    return result ? result : jsUndefined();
 }
 
 static JSValue constructBunSQLObject(VM& vm, JSObject* bunObject)
@@ -329,11 +335,17 @@
     auto* globalObject = defaultGlobalObject(bunObject->globalObject());
     JSValue sqlValue = globalObject->internalModuleRegistry()->requireId(globalObject, vm, InternalModuleRegistry::BunSql);
 #if BUN_DEBUG
-    if (scope.exception()) globalObject->reportUncaughtExceptionAtEventLoop(globalObject, scope.exception());
+    if (auto* exception = scope.exception()) {
+        globalObject->reportUncaughtExceptionAtEventLoop(globalObject, exception);
+        if (!scope.exception()) throwException(globalObject, scope, exception);
+    }
 #endif
-    RETURN_IF_EXCEPTION(scope, {});
+    RETURN_IF_EXCEPTION(scope, jsUndefined());
+    if (!sqlValue || !sqlValue.isObject()) [[unlikely]] return jsUndefined();
     auto clientData = WebCore::clientData(vm);
-    RELEASE_AND_RETURN(scope, sqlValue.getObject()->get(globalObject, clientData->builtinNames().SQLPublicName()));
+    JSValue result = sqlValue.getObject()->get(globalObject, clientData->builtinNames().SQLPublicName());
+    RETURN_IF_EXCEPTION(scope, jsUndefined());
+    return result ? result : jsUndefined();
 }
 
 extern "C" JSC::EncodedJSValue JSPasswordObject__create(JSGlobalObject*);

test/js/sql/sql-lazy-init-stack-overflow.test.ts

@@ -0,0 +1,26 @@
+import { test, expect } from "bun:test";
+import { bunEnv, bunExe } from "harness";
+
+// The lazy property callbacks for Bun.sql / Bun.SQL load the "bun:sql" internal
+// module on first access. If that load throws (e.g. stack overflow), the callback
+// previously returned an empty JSValue which JSC's reifyStaticProperty passed
+// straight into putDirect, crashing on a null JSCell dereference.
+test.each(["sql", "SQL"] as const)("accessing Bun.%s near stack overflow does not crash", async key => {
+  const src = `
+    function F() {
+      try { new F(); } catch {}
+      Bun.${key};
+    }
+    try { new F(); } catch {}
+    Bun.gc(true);
+  `;
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "-e", src],
+    env: bunEnv,
+    stdout: "ignore",
+    stderr: "ignore",
+  });
+  const exitCode = await proc.exited;
+  expect(proc.signalCode).toBeNull();
+  expect([0, 1]).toContain(exitCode);
+});