Repository navigation
Node 24 crash when setting width/height on canvas: Check failed: static_cast<int64_t>(amount_before) >= -delta. #2514
Description
import { createCanvas } from 'canvas';
import fs from 'node:fs';
const canvas = createCanvas(500, 500);
const context = canvas.getContext('2d');
canvas.width = 1000; // <------- crashes
context.fillStyle = 'green';
context.fillRect(10, 10, 150, 100);
const pngStream = canvas.createPNGStream();
const out = fs.createWriteStream('./output.png');
pngStream.pipe(out);
out.once('finish', () => {
console.log('✓ saved as output.png');
});When setting the width/height of the canvas-element (version 3.1.0) after creating it, node 24 crashes. When running the code above with node 23.11.0, everything works as expected. When using 24.0.1, it crashes with the following stack trace:
stack trace
#
# Fatal error in , line 0
# Check failed: static_cast<int64_t>(amount_before) >= -delta.
#
#
#
#FailureMessage Object: 0x7ffc059c7910
----- Native stack trace -----
1: 0x111d431 [node]
2: 0x2ccf773 V8_Fatal(char const*, ...) [node]
3: 0x15cc9a5 [node]
4: 0x1357ce3 v8::Isolate::AdjustAmountOfExternalAllocatedMemory(long) [node]
5: 0x1015660 napi_adjust_external_memory [node]
6: 0x7736d02594df non-virtual thunk to ImageBackend::destroySurface() [/home/user/canvas-test/node_modules/canvas/build/Release/canvas.node]
7: 0x7736d024afca Backend::setWidth(int) [/home/user/canvas-test/node_modules/canvas/build/Release/canvas.node]
8: 0x7736d027b7a8 Canvas::SetWidth(Napi::CallbackInfo const&, Napi::Value const&) [/home/user/canvas-test/node_modules/canvas/build/Release/canvas.node]
9: 0x7736d02834bc napi_value__* Napi::InstanceWrap<Canvas>::WrappedMethod<&Canvas::SetWidth>(napi_env__*, napi_callback_info__*) [/home/user/canvas-test/node_modules/canvas/build/Release/canvas.node]
10: 0x1005e01 [node]
11: 0x1393362 v8::internal::Builtins::InvokeApiFunction(v8::internal::Isolate*, bool, v8::internal::DirectHandle<v8::internal::FunctionTemplateInfo>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>, v8::internal::DirectHandle<v8::internal::HeapObject>) [node]
12: 0x18f0185 v8::internal::Object::SetPropertyWithAccessor(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>) [node]
13: 0x1911ad4 v8::internal::Object::SetProperty(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) [node]
14: 0x16ce17b v8::internal::StoreIC::Store(v8::internal::Handle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver> >, v8::internal::Handle<v8::internal::Name>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::StoreOrigin) [node]
15: 0x16ceccd v8::internal::Runtime_StoreIC_Miss(int, unsigned long*, v8::internal::Isolate*) [node]
16: 0x7736b2636636
Trace/breakpoint trap (core dumped)
Activity
Whobeu commentedon May 13, 2025
I had upgraded a small server to Node.js 24.0.0 and started seeing Segment Fault crashes from various modules. I didn't have time to install the segfault-handler package and investigate further so downgraded to 22.15.0 and everything was normal again. I figured 24.0.0 doesn't go LTS until October so there is time to work on it,
[-]Node 24 crash: Check failed: static_cast<int64_t>(amount_before) >= -delta.[/-][+]Node 24 crash when setting width/height on canvas: Check failed: static_cast<int64_t>(amount_before) >= -delta.[/+]chearon commentedon Jun 16, 2025
When the canvas is re-allocated, we're reporting the new size as the freed memory size instead the old size. Apparently Node 24 is stricter about such errors, and crashes. I'm adding node 24 to CI, but for some reason, our tests don't trigger the crash (even though we have code similar to the snippet in the OP). I was able to trigger it locally though.
report correct freed size when resurfacing
Whobeu commentedon Jun 20, 2025
Upgraded to Canvas 3.1.1 as well as Node.js 24.2.0. With no changes to any of my code I am no longer seeing the Segmentation Fault's that were happening with 3.1.0 and Node.js 24.0.0 (which was the initial release I had upgraded to before dropping back to 22.x.x). This appears to have fixed the issue.