Rename regression test to follow issue number convention

The `defaultBunSQLObject` and `constructBunSQLObject` PropertyCallback
functions could crash when the bun:sql module failed to evaluate (e.g.
when globalThis.Array was tampered with, causing "The superclass is not
a constructor" in internal:sql/shared).

Two issues caused the crash:
1. In debug builds, `reportUncaughtExceptionAtEventLoop` was called
   before `RETURN_IF_EXCEPTION`, which cleared the VM exception as a
   side effect of re-entering JavaScript. This caused
   `RETURN_IF_EXCEPTION` to not trigger, falling through to
   `sqlValue.getObject()->get()` with a null object pointer.
2. `RETURN_IF_EXCEPTION(scope, {})` returned an empty JSValue (`{}`),
   but JSC's PropertyCallback mechanism (reifyStaticProperty) calls
   `putDirect` on the result without checking for empty values,
   causing undefined behavior.

Fix: Check for exceptions explicitly after `requireId`, clear the
exception (since PropertyCallbacks cannot propagate exceptions), and
return `jsUndefined()` as a safe fallback value.

src/bun.js/bindings/BunObject.cpp

@@ -314,10 +314,10 @@ static JSValue defaultBunSQLObject(VM& vm, JSObject* bunObject)
     auto scope = DECLARE_THROW_SCOPE(vm);
     auto* globalObject = defaultGlobalObject(bunObject->globalObject());
     JSValue sqlValue = globalObject->internalModuleRegistry()->requireId(globalObject, vm, InternalModuleRegistry::BunSql);
-#if BUN_DEBUG
-    if (scope.exception()) globalObject->reportUncaughtExceptionAtEventLoop(globalObject, scope.exception());
-#endif
-    RETURN_IF_EXCEPTION(scope, {});
+    if (scope.exception()) [[unlikely]] {
+        (void)scope.tryClearException();
+        return jsUndefined();
+    }
     RELEASE_AND_RETURN(scope, sqlValue.getObject()->get(globalObject, vm.propertyNames->defaultKeyword));
 }
 
@@ -326,10 +326,10 @@ static JSValue constructBunSQLObject(VM& vm, JSObject* bunObject)
     auto scope = DECLARE_THROW_SCOPE(vm);
     auto* globalObject = defaultGlobalObject(bunObject->globalObject());
     JSValue sqlValue = globalObject->internalModuleRegistry()->requireId(globalObject, vm, InternalModuleRegistry::BunSql);
-#if BUN_DEBUG
-    if (scope.exception()) globalObject->reportUncaughtExceptionAtEventLoop(globalObject, scope.exception());
-#endif
-    RETURN_IF_EXCEPTION(scope, {});
+    if (scope.exception()) [[unlikely]] {
+        (void)scope.tryClearException();
+        return jsUndefined();
+    }
     auto clientData = WebCore::clientData(vm);
     RELEASE_AND_RETURN(scope, sqlValue.getObject()->get(globalObject, clientData->builtinNames().SQLPublicName()));
 }

test/regression/issue/27308.test.ts

@@ -0,0 +1,60 @@
+import { expect, test } from "bun:test";
+import { bunEnv, bunExe } from "harness";
+
+// Regression test: Bun.sql property access should not crash when the SQL
+// module fails to load (e.g. due to globalThis.Array being tampered with).
+// The PropertyCallback for Bun.sql previously returned an empty JSValue on
+// exception, which caused a null pointer dereference in JSC's property
+// reification.
+
+test("Bun.sql does not crash when globalThis.Array is undefined", async () => {
+  await using proc = Bun.spawn({
+    cmd: [
+      bunExe(),
+      "-e",
+      `
+      const origArray = globalThis.Array;
+      globalThis.Array = undefined;
+      try {
+        const s = Bun.sql;
+      } catch(e) {}
+      globalThis.Array = origArray;
+      console.log("OK");
+    `,
+    ],
+    env: bunEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+  expect(stdout.trim()).toBe("OK");
+  expect(exitCode).toBe(0);
+});
+
+test("Bun.SQL does not crash when globalThis.Array is undefined", async () => {
+  await using proc = Bun.spawn({
+    cmd: [
+      bunExe(),
+      "-e",
+      `
+      const origArray = globalThis.Array;
+      globalThis.Array = undefined;
+      try {
+        const S = Bun.SQL;
+      } catch(e) {}
+      globalThis.Array = origArray;
+      console.log("OK");
+    `,
+    ],
+    env: bunEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+  expect(stdout.trim()).toBe("OK");
+  expect(exitCode).toBe(0);
+});