Library callback trap leaks the final bytes argument under ASan on Linux

[newbpydev]

Summary

The library host-callback ASan test exits with LeakSanitizer errors for both C and LLVM emission on Linux. The happy-path probe eventually clears emitChunk, calls cb_stream, and recovers from the resulting SC4025 trap through the panic sink's supported longjmp path. The final bytes argument allocated for that call is not released.

This reproduces on current main at 73efea6ab38cfa8e63e15a66d28d279e3f17a2a7.

Reproduction

pnpm install --frozen-lockfile
pnpm -r build
SCRIPTC_NO_CACHE=1 pnpm vitest run tests/harness/library-callbacks.test.ts \
  -t "CB8: CB1/CB2 under ASan"

Both parameterized cases fail at tests/harness/library-callbacks.test.ts:455 because the probe exits with status 1 instead of 0.

LeakSanitizer output

Both backends report the same allocation path:

Direct leak of 40 byte(s) in 1 object(s) allocated from:
  malloc
  scr_bytes_new
  cb_stream

Indirect leak of 3 byte(s) in 1 object(s) allocated from:
  calloc
  scr_bytes_new
  cb_stream

SUMMARY: AddressSanitizer: 43 byte(s) leaked in 2 allocation(s).

As a control, disabling leak detection leaves the rest of the contract green:

ASAN_OPTIONS=detect_leaks=0 SCRIPTC_NO_CACHE=1 \
  pnpm vitest run tests/harness/library-callbacks.test.ts \
  -t "CB8: CB1/CB2 under ASan"

Result: 2 passed, 28 skipped.

Environment

• CachyOS Linux x86_64
• Clang 22.1.8
• Node 24.15.0
• pnpm 11.15.1

The current hosted run for this exact revision is green, but the complete plain/sanitized suites run on macOS; the Linux job only runs the host-clang static-build regression: https://github.com/vercel-labs/scriptc/actions/runs/33105203824

[newbpydev]

I would be happy to investigate this further and prepare a focused fix with regression coverage. Before I start, could a maintainer confirm that this is a contribution you would be interested in reviewing and that nobody is already working on it?

My earlier contribution in #41 has been awaiting maintainer review for some time, so I would prefer to confirm interest before investing in another implementation. If this is welcome, I can take ownership of it.