Fix use-after-free in Bun.Transpiler async transform error messages - #30229
Closed
robobun wants to merge 2 commits into
Closed
Fix use-after-free in Bun.Transpiler async transform error messages#30229robobun wants to merge 2 commits into
robobun wants to merge 2 commits into
Claude / Claude Code Review
completed
May 4, 2026 in 11m 52s
Code review found 1 important issue
Found 3 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/bun.js/api/JSTranspiler.zig:507-509 |
Memory leak: cloned Location.file and line_text are never freed |
Annotations
Check failure on line 509 in src/bun.js/api/JSTranspiler.zig
claude / Claude Code Review
Memory leak: cloned Location.file and line_text are never freed
This introduces a memory leak: `msg.clone(bun.default_allocator)` deep-clones `Location.file` and `Location.line_text` (via `Location.clone`, src/logger.zig:113-123), but `Location.deinit` is a no-op (src/logger.zig:149), so the new `msg.deinit(bun.default_allocator)` in `TransformTask.deinit` never frees them. Every rejected async `transform()` now leaks at least two `bun.default_allocator` allocations per error message (and per note); previously these strings lived in the per-task arena and we
Loading