Add visitForGc to CompressionStream to fix zlib slow-path leak#6741
Open
guybedford wants to merge 1 commit intocloudflare:mainfrom
Open
Add visitForGc to CompressionStream to fix zlib slow-path leak#6741guybedford wants to merge 1 commit intocloudflare:mainfrom
guybedford wants to merge 1 commit intocloudflare:mainfrom
Conversation
The slow path of the sync zlib convenience methods (`{ info: true }`)
constructs a JSG-bound CompressionStream wrapper per call. The wrapper
holds a jsg::Function writeCallback that captures the JS handle (see
internal_zlib_base.ts), forming a JS<->C++ reference cycle. Without a
visitForGc, V8 cannot trace through the C++->JS edge, so the cycle is
uncollectable and every CompressionStream becomes immortal.
Reproducer: 20k iterations of inflateSync(input, { info: true }) leaks
~128 MB.
Adds visitForGc() to CompressionStream covering writeCallback,
writeResult, and errorHandler. Also clears these refs eagerly in
close() so callers that explicitly destroy don't have to wait on the
cycle collector.
The fast path (zlibUtil.zlibSync) is unaffected: it does the whole
compression in C++ without exposing a CompressionStream wrapper to JS.
Adds zlib-leak-nodejs-test asserting that engines returned via
{ info: true } are reclaimed after GC, using WeakRef and --expose-gc.
danlapid
approved these changes
May 7, 2026
jasnell
approved these changes
May 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This fixes a memory leak in the
node:zlibslow path of the synchronous convenience methods ({ info: true }).Each call constructs a JSG-bound
CompressionStreamwrapper that holds ajsg::Function writeCallbackanderrorHandlercapturing the JS handle (seeinternal_zlib_base.ts). This forms a JS<->C++ reference cycle. WithoutvisitForGc, V8 cannot trace through the C++->JS edge, so the cycle is uncollectable and everyCompressionStreambecomes immortal. 20k iterations ofinflateSync(input, { info: true })leaks ~128 MB.The fast path (
zlibUtil.zlibSync) is unaffected — it does the whole compression in C++ without exposing aCompressionStreamto JS.visitForGc()toCompressionStreamcoveringwriteCallback,writeResult, anderrorHandlerso V8 can collect the cycle once it's unreachable from JS roots.close()so callers that explicitly destroy the stream don't have to wait on the cycle collector.Before:
After:
Test coverage in
zlib-leak-nodejs-test:inflateSyncInfoCollects,deflateSyncInfoCollects,brotliSyncInfoCollects— exercise the eager-clear path throughclose().createInflateAbandonedCollects— exercises thevisitForGcpath specifically by abandoning acreateInflate()stream withoutend()/destroy()/close(). Without the visitor this case leaks 256 of 256 engines; with it, all are collected.Red-green verified across all three test variants (
@,@all-compat-flags,@all-autogates): removingvisitForGccauses onlycreateInflateAbandonedCollectsto fail, confirming the new test specifically catches the visitor regression while the other three are covered by the eager-clear fallback.