Fix use-after-free in Bun.Transpiler async transform() parse errors - #30020
Closed
robobun wants to merge 2 commits into
Closed
Fix use-after-free in Bun.Transpiler async transform() parse errors#30020robobun wants to merge 2 commits into
Bun.Transpiler async transform() parse errors#30020robobun wants to merge 2 commits into
Claude / Claude Code Review
completed
May 1, 2026 in 17m 22s
Code review found 1 potential issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/bun.js/api/JSTranspiler.zig:494-502 |
Memory leak: cloned log message buffers never freed |
Annotations
Check warning on line 502 in src/bun.js/api/JSTranspiler.zig
claude / Claude Code Review
Memory leak: cloned log message buffers never freed
Minor: `appendToWithRecycled` allocates a `StringBuilder` buffer and a `notes_buf` in `bun.default_allocator` to hold the cloned message text, but `Log.deinit()` only does `msgs.clearAndFree()` and never frees those buffers — so each async `transform()` parse error leaks the cloned error text. This is the same pre-existing pattern as every other `appendToWithRecycled` caller and trading a UAF for a small error-path leak is clearly the right call here; just flagging it as a candidate for a follow
Loading