Skip to content

[2a] Remove incorrect Module._free(debugBuffer) call #20

@kalwalt

Description

@kalwalt

Summary

Remove incorrect Module._free(debugBuffer) call that passes a typed-array view instead of a pointer

Environment

  • Product/Service: FeatureSET-Display — JavaScript API
  • Files: src/ARFset.js:144, js/arfset.api.js:114

Problem Description

Both src/ARFset.js:144 and js/arfset.api.js:114 call Module._free(debugBuffer) where debugBuffer is a Uint8ClampedArray view, not an integer heap pointer. Module._free expects a raw wasm memory address (integer). Passing a JS typed-array object is a no-op at best; if the JS engine coerces the object to a number that happens to land on a valid heap address, it silently corrupts the wasm heap.

The buffer itself is a view onto wasm memory owned and managed by the C++ side — JS must not free it.

Expected Behavior

No Module._free call is made from JS for this buffer. The C++ side manages its own memory.

Actual Behavior

Module._free is called with a Uint8ClampedArray object, which is either a silent no-op or a potential heap-corruption vector.

Tasks

  • Remove the bogus Module._free(debugBuffer) call from src/ARFset.js:144
  • Remove the bogus Module._free(debugBuffer) call from js/arfset.api.js:114

Impact

Medium — Potential wasm heap corruption if the coercion produces a valid-looking pointer; at minimum a latent correctness bug.

Additional Context

Small, isolated fix with no API surface change. Good candidate for an early "easy win" alongside 2b and 2c.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions