Clear image.src on loadImage error to release partial cairo state - #2580
Closed
iurisilvio wants to merge 1 commit into
Closed
Clear image.src on loadImage error to release partial cairo state#2580iurisilvio wants to merge 1 commit into
iurisilvio wants to merge 1 commit into
Conversation
loadImage's onerror handler rejects the Promise but leaves image.src pointing at the input buffer. When libjpeg/libpng allocated a cairo surface before failing mid-decode, that surface stays attached to the Image until V8 GC — under sustained load on malformed inputs this delays cleanup arbitrarily. Assign Buffer.alloc(0) before reject so clearData() runs synchronously.
iurisilvio
added a commit
to iurisilvio/node-canvas
that referenced
this pull request
Jun 25, 2026
Trim the fork to only the memory leaks reproduced with before/after RSS: - JPEG EXIF rotation (rotate90/rotate270) leak (Automattic#2574, merged upstream) - RsvgHandle / partial cairo surface leak on SVG decode error paths (Automattic#2585) Revert everything else back to v3.2.3 after testing: image.src-on-error (Automattic#2580, no measurable effect), libjpeg longjmp data/src free (Automattic#2581, not reproducible on libjpeg-turbo), cairo_pattern_t refcount (Automattic#2582), CanvasPattern source-retention UAF guard (Automattic#2583), rare decoder error-path frees (Automattic#2587), and the node-addon-api 8 / NAPI_EXPERIMENTAL experiment. Built on node-addon-api 7. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2576.
loadImage()inindex.jsrejects the Promise on error but doesn't clearimage.src. The Image keeps a reference to the input buffer (and, depending on the format, any partial cairo surface) until V8 garbage-collects the Image wrapper. Under sustained load on malformed inputs that fail mid-decode, this delays cleanup arbitrarily.The fix assigns
image.src = Buffer.alloc(0)before rejecting, which triggersImage::SetSource()→clearData()synchronously — destroying any partial cairo surface and resetting the buffer reference.One-line change; the full rationale and a standalone repro are in #2576.