node:zlib: block worker shutdown on in-flight async compression (UAF) - #35155
Closed
robobun wants to merge 8 commits into
Closed
node:zlib: block worker shutdown on in-flight async compression (UAF)#35155robobun wants to merge 8 commits into
robobun wants to merge 8 commits into
Claude / Claude Code Review
completed
Jul 22, 2026 in 18m 35s
Code review found 1 important issue
Found 2 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/jsc/web_worker.rs:1315-1322 |
Zlib completion tasks posted at worker shutdown are not reclaimed (leak per terminate) |
Annotations
Check failure on line 1322 in src/jsc/web_worker.rs
claude / Claude Code Review
Zlib completion tasks posted at worker shutdown are not reclaimed (leak per terminate)
The comment says the completion each job posts is "reclaimed by `release_queued_tasks_for_shutdown`", but `__bun_release_task_at_shutdown` (dispatch.rs:1159) has no arm for `NativeZlib`/`NativeBrotli`/`NativeZstd` — they hit `_ => false`, get re-queued, and then the worker VM box is raw-`dealloc`'d without `Drop`, leaking the `CompressionStream<T>` box (with its +1 `ref_()`, live `StrongOptional`, ref'd `CountedKeepAlive`, and pinned ArrayBuffers) on every in-flight op at `terminate()`. This PR
Loading