[yxshee]

If the cookie options can't be turned into a Cookie, the request hangs instead of failing:

app.use(session({
  secret: 'keyboard cat',
  resave: false,
  saveUninitialized: true,
  cookie: { maxAge: '1000' }          // or cookie: (req) => ({ maxAge: '1000' })
}))
app.use((err, req, res, next) => res.status(500).end(err.message))

On master, GET / never gets a response. The client sees socket hang up, and the process logs TypeError: Cannot read properties of undefined (reading 'originalMaxAge').

Why: store.generate() assigns req.session = new Session(req) before new Cookie(options), so when the Cookie constructor throws ("maxAge must be a number or Date"), req.session is left without a cookie. The original error does reach the error handler, but the patched res.end() then calls req.session.touch(), which reads this.cookie.originalMaxAge and throws, so the response is never finished. Since 1.19 cookie options can come from a per-request function, this can't be fully caught when the middleware is created.

Fix: if building the cookie throws, remove the half-made req.session before rethrowing. The error handler's response then completes normally (500 with "maxAge must be a number or Date", no Set-Cookie). Option order and the cookie(req) call are unchanged.

Tests

• New test under cookie option / when "cookie" is a function: an Express app whose cookie function returns { maxAge: '1000' } must answer 500 with the error message and no Set-Cookie. It times out on master (with the originalMaxAge TypeError) and passes here.
• npm test: 174 passing. eslint clean. HISTORY entry added.

Note: #1151 (mine) also touches store.generate, so whichever lands second will need a small rebase; the two changes are independent.