crash on shutdown: "rpz: reload start" did not finish yet

Summary

named crashes if it is shutting down while

BIND version used

• Affects v9.19: BIND 9.19.8-dev: 9dea2b99
• I was not able to crash v9.18: 9.18.10-dev 8b8c761a - seems that it has different timing, and also the reaction to SIGINT does not interrupt rpz processing
• I was not able to crash v9.16: 9.16.36-dev 5b16afa3

For v9.16 and v9.18 the log looks like this:

09-Dec-2022 15:08:25.301 rpz: phish: reload start
^C09-Dec-2022 15:08:27.451 shutting down
09-Dec-2022 15:08:27.451 stopping command channel on 127.0.0.1#953
09-Dec-2022 15:08:28.161 rpz: phish: reload done

I.e. SIGINT does not seem to cut RPZ processing in the middle.

Steps to reproduce

1. Start named
2. Wait for "rpz: : reload start" line to show up
3. SIGINT server before it logs rpz: <zone>: reload done: success
4. Enjoy fireworks

What is the current bug behavior?

db.c:581: REQUIRE(nodep != ((void *)0) && *nodep != ((void *)0)) failed, back trace

#2  0x00007f1a53ad353d in abort () from /usr/lib/libc.so.6
#3  0x0000560c3c7522fa in assertion_failed (file=0x7f1a54cae499 "db.c", line=581, type=isc_assertiontype_require, cond=0x7f1a54caead0 "nodep != ((void *)0) && *nodep != ((void *)0)") at main.c:237
#4  0x00007f1a54d5d2ab in isc_assertion_failed (file=0x7f1a54cae499 "db.c", line=581, type=isc_assertiontype_require, cond=0x7f1a54caead0 "nodep != ((void *)0) && *nodep != ((void *)0)") at assertions.c:49
#5  0x00007f1a54aa0632 in dns_db_detachnode (db=0x7f1a4de22000, nodep=0x7f19ee9fd7f0) at db.c:581
#6  0x00007f1a54bf702f in update_nodes (rpz=0x7f1a511e2380, newnodes=0x7f19ea400000) at rpz.c:1740
#7  0x00007f1a54bf7c16 in update_rpz_cb (data=0x7f1a511e2380) at rpz.c:1919
#8  0x00007f1a54d9eecd in isc__work_cb (req=0x7f1a4de12be0) at work.c:27
#9  0x00007f1a546fa726 in uv__queue_work (w=<optimized out>) at src/threadpool.c:326
#10 0x00007f1a546fa8a9 in worker (arg=0x0) at src/threadpool.c:122

100 % reproducible, just use large enough RPZ zone so the processing takes a bit of time.

What is the expected correct behavior?

Does not crash.

Relevant configuration files

options {
	check-names primary ignore;
	check-names secondary ignore;
	recursion yes;
	response-policy {
		zone "phish" min-update-interval 1;
	};
	check-dup-records warn;
	check-integrity no;
	check-mx ignore;
	check-mx-cname ignore;
	check-sibling no;
	check-spf ignore;
	check-srv-cname ignore;
	check-wildcard no;
	notify no;
};
zone "phish" {
	type primary;
	file "phish";
};

Relevant logs and/or screenshots

09-Dec-2022 14:51:17.481 rpz: phish: reload start
^C09-Dec-2022 14:51:18.444 no longer listening on 127.0.0.1#53
09-Dec-2022 14:51:18.811 no longer listening on 127.0.0.111#53
...
09-Dec-2022 14:51:18.811 shutting down
09-Dec-2022 14:51:18.811 db.c:581: REQUIRE(nodep != ((void *)0) && *nodep != ((void *)0)) failed, back trace
09-Dec-2022 14:51:18.811 /tmp/main/sbin/named(+0x2814c) [0x560c3c75214c]
09-Dec-2022 14:51:18.811 /tmp/main/lib/libisc-9.19.8-dev.so(isc_assertion_failed+0x31) [0x7f1a54d5d2ab]
09-Dec-2022 14:51:18.811 /tmp/main/lib/libdns-9.19.8-dev.so(dns_db_detachnode+0x7d) [0x7f1a54aa0632]
09-Dec-2022 14:51:18.811 /tmp/main/lib/libdns-9.19.8-dev.so(+0x1a902f) [0x7f1a54bf702f]
09-Dec-2022 14:51:18.811 /tmp/main/lib/libdns-9.19.8-dev.so(+0x1a9c16) [0x7f1a54bf7c16]
09-Dec-2022 14:51:18.811 /tmp/main/lib/libisc-9.19.8-dev.so(+0x7eecd) [0x7f1a54d9eecd]
09-Dec-2022 14:51:18.811 /usr/lib/libuv.so.1(+0x9726) [0x7f1a546fa726]
09-Dec-2022 14:51:18.811 /usr/lib/libuv.so.1(+0x98a9) [0x7f1a546fa8a9]
09-Dec-2022 14:51:18.811 /usr/lib/libc.so.6(+0x868fd) [0x7f1a53b378fd]
09-Dec-2022 14:51:18.811 /usr/lib/libc.so.6(+0x108a60) [0x7f1a53bb9a60]
09-Dec-2022 14:51:18.811 exiting (due to assertion failure)