fix: prevent memory leaks in encode_stream callback and SkPixmap (#1200)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: Brooooooklyn

skia-c/skia_c.cpp

@@ -293,28 +293,28 @@ bool skiac_surface_encode_stream(skiac_surface* c_surface,
                                  int quality,
                                  write_callback_t write_callback,
                                  void* context) {
-  auto sk_pixmap = new SkPixmap();
-  if (!SURFACE_CAST->peekPixels(sk_pixmap)) {
+  SkPixmap sk_pixmap;
+  if (!SURFACE_CAST->peekPixels(&sk_pixmap)) {
     return false;
   }
   SkJavaScriptWStream stream(write_callback, context);
   std::unique_ptr<SkEncoder> encoder;
   if (format == int(SkEncodedImageFormat::kJPEG)) {
     SkJpegEncoder::Options options;
     options.fQuality = quality;
-    encoder = SkJpegEncoder::Make(&stream, *sk_pixmap, options);
+    encoder = SkJpegEncoder::Make(&stream, sk_pixmap, options);
   } else if (format == int(SkEncodedImageFormat::kPNG)) {
-    encoder = SkPngEncoder::Make(&stream, *sk_pixmap, SkPngEncoder::Options());
+    encoder = SkPngEncoder::Make(&stream, sk_pixmap, SkPngEncoder::Options());
   } else if (format == int(SkEncodedImageFormat::kWEBP)) {
     SkWebpEncoder::Options options;
     options.fCompression = quality == 100
                                ? SkWebpEncoder::Compression::kLossless
                                : SkWebpEncoder::Compression::kLossy;
     options.fQuality = quality == 100 ? 75 : quality;
-    return SkWebpEncoder::Encode(&stream, *sk_pixmap, options);
+    return SkWebpEncoder::Encode(&stream, sk_pixmap, options);
   }
   if (encoder) {
-    return encoder->encodeRows(sk_pixmap->height());
+    return encoder->encodeRows(sk_pixmap.height());
   }
   return false;
 }

src/lib.rs

@@ -447,12 +447,17 @@ impl<'c> CanvasElement<'c> {
     quality: u8,
     callback: F,
   ) -> bool {
-    self.ctx.context.surface.encode_stream(
+    let ptr = Box::into_raw(Box::new(callback));
+    let result = self.ctx.context.surface.encode_stream(
       mime,
       quality,
       Some(encode_image_stream_callback::<F>),
-      Box::into_raw(Box::new(callback)).cast(),
-    )
+      ptr.cast(),
+    );
+    // SAFETY: encode_stream is synchronous, so the callback is no longer referenced.
+    // Recover the Box to free the allocation.
+    unsafe { drop(Box::from_raw(ptr)) };
+    result
   }
 
   #[napi]
@@ -1056,6 +1061,10 @@ unsafe extern "C" fn encode_image_stream_callback<F: Fn(&[u8])>(
   size: usize,
   context: *mut c_void,
 ) {
-  let rust_callback: &mut F = unsafe { Box::leak(Box::from_raw(context.cast())) };
+  // SAFETY: context points to a live Box<F> owned by encode_image_inner.
+  // Borrow it rather than taking ownership, since this callback may be invoked
+  // multiple times during encoding. The Box is freed by encode_image_inner after
+  // encode_stream returns.
+  let rust_callback: &F = unsafe { &*context.cast() };
   rust_callback(unsafe { slice::from_raw_parts(data.cast(), size) });
 }