Fix use-after-free in Bun.Transpiler async transform() parse errors - #30029
Closed
robobun wants to merge 1 commit into
Closed
Fix use-after-free in Bun.Transpiler async transform() parse errors#30029robobun wants to merge 1 commit into
robobun wants to merge 1 commit into
Claude / Claude Code Review
completed
May 1, 2026 in 19m 46s
Code review found 1 potential issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/bun.js/api/JSTranspiler.zig:493-500 |
Cloned log message text/notes leak on async transform error path |
Annotations
Check warning on line 500 in src/bun.js/api/JSTranspiler.zig
claude / Claude Code Review
Cloned log message text/notes leak on async transform error path
Note that `appendToWithRecycled` allocates a single `StringBuilder` buffer and a `notes_buf` in `bun.default_allocator`, and `Log.deinit()` only frees the `msgs` ArrayList — so the cloned message text/notes leak on every failing async `transform()`. This is the same pattern used by ~10 other call sites (RuntimeTranspilerStore, BundleThread, ParseTask, bundle_v2, etc.) and trading a UAF for a small error-path leak is clearly the right call here; just flagging it as a follow-up for the `Log` owner
Loading