@pproenca/node-webcodecs 0.1.1-alpha.0 → 0.1.1-alpha.5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pproenca/node-webcodecs",
   "description": "WebCodecs API implementation for Node.js using FFmpeg",
-  "version": "0.1.1-alpha.0",
+  "version": "0.1.1-alpha.5",
   "author": "Pedro Proenca",
   "homepage": "https://github.com/pproenca/node-webcodecs",
   "repository": {
@@ -12,29 +12,48 @@
     "url": "https://github.com/pproenca/node-webcodecs/issues"
   },
   "scripts": {
-    "build": "npm run build:native && npm run build:ts",
-    "build:ts": "tsc",
+    "build": "node-gyp rebuild && tsc",
     "build:native": "node-gyp rebuild",
-    "build:native:debug": "node-gyp rebuild --debug",
-    "install": "node install/check.js || npm run build",
+    "build:ts": "tsc",
+    "build:debug": "node-gyp rebuild --debug && tsc",
+    "rebuild": "npm run clean && npm run build",
+    "install": "node-gyp-build",
     "clean": "rm -rf src/build/ .nyc_output/ coverage/ test/fixtures/output.*",
-    "test": "npm run lint && npm run test-unit",
-    "test-unit": "vitest run --config test/vitest.config.ts",
-    "lint": "npm run lint-cpp && npm run lint-js && npm run lint-types",
-    "lint-cpp": "cpplint --quiet src/*.h src/*.cc",
-    "lint-js": "biome lint",
-    "lint-types": "tsd",
-    "package-from-local-build": "node npm/from-local-build.js",
-    "package-release-notes": "node npm/release-notes.js"
+    "check": "npm run lint && npm test",
+    "test": "npm run test:fast && npm run test:guardrails",
+    "test:fast": "tsx --test --test-concurrency=1 --import ./test/setup.ts --test-timeout=30000 test/golden/*.test.ts test/unit/*.test.ts",
+    "test:golden": "tsx --test --test-concurrency=1 --import ./test/setup.ts --test-timeout=30000 test/golden/*.test.ts",
+    "test:unit": "tsx --test --test-concurrency=1 --import ./test/setup.ts --test-timeout=30000 test/unit/*.test.ts",
+    "test:stress": "tsx --test --test-concurrency=1 --import ./test/setup.ts --test-timeout=60000 test/stress/*.test.ts",
+    "test:contracts": "node test/contracts/video_encoder/state_machine.js && node test/contracts/audio_encoder/state_machine.js && node test/contracts/video_decoder/state_machine.js && node test/contracts/audio_decoder/state_machine.js",
+    "test:guardrails": "node test/guardrails/fuzzer.js && node test/guardrails/event_loop_lag.js",
+    "test:coverage": "c8 --check-coverage --lines 70 --branches 60 --functions 70 --statements 70 --include lib/**/*.ts --exclude lib/**/*.d.ts --exclude lib/types.ts npm run test:fast",
+    "lint": "npm run lint:cpp && npm run lint:ts && npm run lint:types && npm run lint:md",
+    "lint:cpp": "cpplint --quiet src/*.h src/*.cc",
+    "lint:ts": "biome lint",
+    "lint:types": "tsd",
+    "lint:md": "prettier --check \"**/*.md\"",
+    "format": "npm run format:md",
+    "format:md": "prettier --write \"**/*.md\"",
+    "version:bump": "node scripts/bump-version.js",
+    "create-platform-packages": "node scripts/create-platform-packages.mjs"
   },
   "type": "commonjs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
   "files": [
-    "install",
     "lib",
     "dist",
-    "src/*.{cc,h,gyp}"
+    "src/*.{cc,h,gyp}",
+    "binding.gyp"
   ],
   "keywords": [
     "webcodecs",
@@ -46,35 +65,33 @@
   "tsd": {
     "directory": "test/types"
   },
+  "optionalDependencies": {
+    "@pproenca/node-webcodecs-darwin-arm64": "0.1.1-alpha.5",
+    "@pproenca/node-webcodecs-darwin-x64": "0.1.1-alpha.5",
+    "@pproenca/node-webcodecs-linux-x64": "0.1.1-alpha.5"
+  },
   "dependencies": {
-    "detect-libc": "^2.0.3",
     "node-gyp-build": "^4.8.0"
   },
-  "optionalDependencies": {
-    "@pproenca/node-webcodecs-darwin-arm64": "0.1.0",
-    "@pproenca/node-webcodecs-darwin-x64": "0.1.0",
-    "@pproenca/node-webcodecs-linux-x64": "0.1.0",
-    "@pproenca/node-webcodecs-linuxmusl-x64": "0.1.0",
-    "@pproenca/node-webcodecs-win32-x64": "0.1.0"
-  },
   "devDependencies": {
     "@biomejs/biome": "^2.3.10",
     "@cpplint/cli": "^0.1.0",
-    "@types/node": "*",
-    "c8": "^10.1.2",
+    "@types/node": "^25.0.3",
+    "c8": "^10.1.3",
     "express": "^5.2.1",
-    "mediabunny": "^1.25.4",
-    "node-addon-api": "^8.0.0",
-    "node-gyp": "^10.0.0",
+    "mediabunny": "^1.27.3",
+    "node-addon-api": "^8.5.0",
+    "node-gyp": "^12.1.0",
+    "prebuildify": "^6.0.1",
+    "prettier": "^3.7.4",
     "tsd": "^0.33.0",
-    "tsx": "^4.20.6",
+    "tsx": "^4.21.0",
     "typedoc": "^0.28.15",
-    "typescript": "^5.6.3",
-    "vitest": "^4.0.15"
+    "typescript": "^5.9.3"
   },
   "license": "MIT",
   "engines": {
-    "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+    "node": "^20.17.0 || ^22.9.0 || >=24"
   },
   "publishConfig": {
     "access": "public",

package/src/addon.cc

@@ -41,6 +41,45 @@ void ClearFFmpegWarningsJS(const Napi::CallbackInfo& info) {
   webcodecs::ClearFFmpegWarnings();
 }
 
+// Counter accessor functions (following sharp pattern for observability)
+Napi::Value GetCounterQueueJS(const Napi::CallbackInfo& info) {
+  return Napi::Number::New(info.Env(), webcodecs::counterQueue.load());
+}
+
+Napi::Value GetCounterProcessJS(const Napi::CallbackInfo& info) {
+  return Napi::Number::New(info.Env(), webcodecs::counterProcess.load());
+}
+
+Napi::Value GetCounterFramesJS(const Napi::CallbackInfo& info) {
+  return Napi::Number::New(info.Env(), webcodecs::counterFrames.load());
+}
+
+Napi::Value GetCountersJS(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Object counters = Napi::Object::New(env);
+
+  // New per-class counters
+  counters.Set("videoFrames",
+               static_cast<double>(webcodecs::counterVideoFrames.load()));
+  counters.Set("audioData",
+               static_cast<double>(webcodecs::counterAudioData.load()));
+  counters.Set("videoEncoders",
+               static_cast<double>(webcodecs::counterVideoEncoders.load()));
+  counters.Set("videoDecoders",
+               static_cast<double>(webcodecs::counterVideoDecoders.load()));
+  counters.Set("audioEncoders",
+               static_cast<double>(webcodecs::counterAudioEncoders.load()));
+  counters.Set("audioDecoders",
+               static_cast<double>(webcodecs::counterAudioDecoders.load()));
+
+  // Legacy counters (for backwards compatibility)
+  counters.Set("queue", webcodecs::counterQueue.load());
+  counters.Set("process", webcodecs::counterProcess.load());
+  counters.Set("frames", webcodecs::counterFrames.load());
+
+  return counters;
+}
+
 // Test helper for AttrAsEnum template
 Napi::Value TestAttrAsEnum(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
@@ -54,11 +93,22 @@ Napi::Value TestAttrAsEnum(const Napi::CallbackInfo& info) {
   return Napi::String::New(env, webcodecs::ColorPrimariesToString(primaries));
 }
 
+// Cleanup hook called when the Node.js environment is being torn down.
+// This prevents the static destruction order fiasco where FFmpeg's log
+// callback might access destroyed static objects during process exit.
+static void CleanupCallback(void* arg) {
+  webcodecs::ShutdownFFmpegLogging();
+}
+
 Napi::Object InitAll(Napi::Env env, Napi::Object exports) {
   // Thread-safe FFmpeg initialization
   webcodecs::InitFFmpeg();
   webcodecs::InitFFmpegLogging();
 
+  // Register cleanup hook to disable FFmpeg logging before static destructors.
+  // This fixes crashes on macOS x64 where FFmpeg logs during process exit.
+  napi_add_env_cleanup_hook(env, CleanupCallback, nullptr);
+
   InitVideoEncoder(env, exports);
   InitVideoDecoder(env, exports);
   InitVideoFrame(env, exports);
@@ -82,6 +132,13 @@ Napi::Object InitAll(Napi::Env env, Napi::Object exports) {
   exports.Set("clearFFmpegWarnings",
               Napi::Function::New(env, ClearFFmpegWarningsJS));
 
+  // Export global counter functions (following sharp pattern for observability)
+  exports.Set("getCounterQueue", Napi::Function::New(env, GetCounterQueueJS));
+  exports.Set("getCounterProcess",
+              Napi::Function::New(env, GetCounterProcessJS));
+  exports.Set("getCounterFrames", Napi::Function::New(env, GetCounterFramesJS));
+  exports.Set("getCounters", Napi::Function::New(env, GetCountersJS));
+
   // Export test helpers
   exports.Set("testAttrAsEnum", Napi::Function::New(env, TestAttrAsEnum));
 

package/src/async_decode_worker.cc

@@ -5,6 +5,9 @@
 
 #include "src/async_decode_worker.h"
 
+#include <chrono>
+#include <cmath>
+#include <cstdio>
 #include <string>
 #include <utility>
 #include <vector>
@@ -14,6 +17,7 @@ extern "C" {
 #include <libswscale/swscale.h>
 }
 
+#include "src/common.h"
 #include "src/video_decoder.h"
 #include "src/video_frame.h"
 
@@ -23,28 +27,44 @@ AsyncDecodeWorker::AsyncDecodeWorker(VideoDecoder* /* decoder */,
     : output_tsfn_(output_tsfn),
       error_tsfn_(error_tsfn),
       codec_context_(nullptr),
-      sws_context_(nullptr) {}
+      sws_context_(nullptr),
+      frame_(nullptr),
+      packet_(nullptr),
+      output_width_(0),
+      output_height_(0) {}
 
 AsyncDecodeWorker::~AsyncDecodeWorker() {
   Stop();
-  if (frame_) {
-    av_frame_free(&frame_);
-  }
-  if (packet_) {
-    av_packet_free(&packet_);
+  // frame_, packet_, and sws_context_ are RAII-managed, automatically cleaned up
+  // Note: codec_context_ is owned by VideoDecoder
+
+  // Clean up buffer pool
+  for (auto* buffer : buffer_pool_) {
+    delete buffer;
   }
-  // Note: codec_context_ and sws_context_ are owned by VideoDecoder
-  // They are cleaned up there, not here
+  buffer_pool_.clear();
 }
 
-void AsyncDecodeWorker::SetCodecContext(AVCodecContext* ctx, SwsContext* sws,
+void AsyncDecodeWorker::SetCodecContext(AVCodecContext* ctx,
+                                        SwsContext* /* sws_unused */,
                                         int width, int height) {
+  std::lock_guard<std::mutex> lock(codec_mutex_);
   codec_context_ = ctx;
-  sws_context_ = sws;
+  // sws_context_ is created lazily in EmitFrame when we know the frame format
+  sws_context_.reset();
   output_width_ = width;
   output_height_ = height;
-  frame_ = av_frame_alloc();
-  packet_ = av_packet_alloc();
+  frame_ = ffmpeg::make_frame();
+  packet_ = ffmpeg::make_packet();
+
+  // DARWIN-X64 FIX: Mark codec as valid only after successful initialization.
+  // ProcessPacket checks this flag to avoid accessing codec during shutdown.
+  codec_valid_.store(true, std::memory_order_release);
+}
+
+void AsyncDecodeWorker::SetMetadataConfig(const DecoderMetadataConfig& config) {
+  std::lock_guard<std::mutex> lock(codec_mutex_);
+  metadata_config_ = config;
 }
 
 void AsyncDecodeWorker::Start() {
@@ -55,9 +75,26 @@ void AsyncDecodeWorker::Start() {
 }
 
 void AsyncDecodeWorker::Stop() {
+  // DARWIN-X64 FIX: Use stop_mutex_ to prevent double-stop race.
+  // Cleanup() and destructor may both call Stop().
+  std::lock_guard<std::mutex> stop_lock(stop_mutex_);
+
   if (!running_.load()) return;
 
-  running_.store(false);
+  // DARWIN-X64 FIX: Invalidate codec FIRST, before signaling shutdown.
+  // This prevents ProcessPacket from accessing codec_context_ during the
+  // race window between setting running_=false and the worker thread exiting.
+  codec_valid_.store(false, std::memory_order_release);
+
+  {
+    // CRITICAL: Hold mutex while modifying condition predicate to prevent
+    // lost wakeup race on x86_64. Without mutex, there's a window where:
+    // 1. Worker checks predicate (running_==true), starts entering wait()
+    // 2. Main thread sets running_=false, calls notify_all()
+    // 3. Worker enters wait() after notification - blocked forever
+    std::lock_guard<std::mutex> lock(queue_mutex_);
+    running_.store(false, std::memory_order_release);
+  }
   queue_cv_.notify_all();
 
   if (worker_thread_.joinable()) {
@@ -74,13 +111,22 @@ void AsyncDecodeWorker::Enqueue(DecodeTask task) {
 }
 
 void AsyncDecodeWorker::Flush() {
-  flushing_.store(true);
+  // Enqueue a flush task to drain FFmpeg's internal frame buffers
+  DecodeTask flush_task;
+  flush_task.is_flush = true;
+  {
+    std::lock_guard<std::mutex> lock(queue_mutex_);
+    task_queue_.push(std::move(flush_task));
+  }
   queue_cv_.notify_one();
 
-  // Wait for queue to drain
+  flushing_.store(true);
+
+  // Wait for queue to drain AND all in-flight processing to complete
   std::unique_lock<std::mutex> lock(queue_mutex_);
-  queue_cv_.wait(lock,
-                 [this] { return task_queue_.empty() || !running_.load(); });
+  queue_cv_.wait(lock, [this] {
+    return (task_queue_.empty() && processing_.load() == 0) || !running_.load();
+  });
 
   flushing_.store(false);
 }
@@ -90,6 +136,28 @@ size_t AsyncDecodeWorker::QueueSize() const {
   return task_queue_.size();
 }
 
+std::vector<uint8_t>* AsyncDecodeWorker::AcquireBuffer(size_t size) {
+  std::lock_guard<std::mutex> lock(pool_mutex_);
+  for (auto it = buffer_pool_.begin(); it != buffer_pool_.end(); ++it) {
+    if ((*it)->capacity() >= size) {
+      auto* buffer = *it;
+      buffer_pool_.erase(it);
+      buffer->resize(size);
+      return buffer;
+    }
+  }
+  return new std::vector<uint8_t>(size);
+}
+
+void AsyncDecodeWorker::ReleaseBuffer(std::vector<uint8_t>* buffer) {
+  std::lock_guard<std::mutex> lock(pool_mutex_);
+  if (buffer_pool_.size() < 4) {  // Keep up to 4 buffers
+    buffer_pool_.push_back(buffer);
+  } else {
+    delete buffer;
+  }
+}
+
 void AsyncDecodeWorker::WorkerThread() {
   while (running_.load()) {
     DecodeTask task;
@@ -110,71 +178,211 @@ void AsyncDecodeWorker::WorkerThread() {
 
       task = std::move(task_queue_.front());
       task_queue_.pop();
+      processing_++;  // Track that we're processing this task
     }
 
     ProcessPacket(task);
 
-    if (task_queue_.empty()) {
-      queue_cv_.notify_all();
+    // Decrement counter and notify under lock (fixes race condition).
+    {
+      std::lock_guard<std::mutex> lock(queue_mutex_);
+      processing_--;
+      if (task_queue_.empty() && processing_.load() == 0) {
+        queue_cv_.notify_all();
+      }
     }
   }
 }
 
 void AsyncDecodeWorker::ProcessPacket(const DecodeTask& task) {
+  // DARWIN-X64 FIX: Check codec_valid_ BEFORE acquiring mutex.
+  // During shutdown, Stop() sets codec_valid_=false before running_=false.
+  // This creates a window where the worker thread could still be running
+  // but the codec is being destroyed. Early exit prevents the race.
+  if (!codec_valid_.load(std::memory_order_acquire)) {
+    return;
+  }
+
+  std::lock_guard<std::mutex> lock(codec_mutex_);
   if (!codec_context_ || !packet_ || !frame_) {
     return;
   }
 
+  // Handle flush task - send NULL packet to drain decoder
+  if (task.is_flush) {
+    avcodec_send_packet(codec_context_, nullptr);
+    // Drain all remaining frames from the decoder
+    while (avcodec_receive_frame(codec_context_, frame_.get()) == 0) {
+      EmitFrame(frame_.get());
+      av_frame_unref(frame_.get());
+    }
+    // Reset decoder to accept new packets after drain.
+    // Without this, decoder stays in drain mode and rejects further input.
+    avcodec_flush_buffers(codec_context_);
+    return;
+  }
+
   // Set up packet from task data
-  av_packet_unref(packet_);
+  av_packet_unref(packet_.get());
   packet_->data = const_cast<uint8_t*>(task.data.data());
   packet_->size = static_cast<int>(task.data.size());
   packet_->pts = task.timestamp;
 
-  int ret = avcodec_send_packet(codec_context_, packet_);
+  int ret = avcodec_send_packet(codec_context_, packet_.get());
   if (ret < 0 && ret != AVERROR(EAGAIN) && ret != AVERROR_EOF) {
     // Post error to main thread
     std::string error_msg = "Decode error: " + std::to_string(ret);
     error_tsfn_.NonBlockingCall(
         new std::string(error_msg),
         [](Napi::Env env, Napi::Function fn, std::string* msg) {
+          // If env is null, TSFN is closing during teardown. Just cleanup.
+          if (env == nullptr) {
+            delete msg;
+            return;
+          }
           fn.Call({Napi::Error::New(env, *msg).Value()});
           delete msg;
         });
     return;
   }
 
-  while (avcodec_receive_frame(codec_context_, frame_) == 0) {
-    EmitFrame(frame_);
-    av_frame_unref(frame_);
+  while (avcodec_receive_frame(codec_context_, frame_.get()) == 0) {
+    EmitFrame(frame_.get());
+    av_frame_unref(frame_.get());
   }
 }
 
 void AsyncDecodeWorker::EmitFrame(AVFrame* frame) {
-  if (!sws_context_) {
-    return;
+  // Initialize or recreate SwsContext if frame format/dimensions change
+  // (convert from decoder's pixel format to RGBA). RAII managed.
+  AVPixelFormat frame_format = static_cast<AVPixelFormat>(frame->format);
+
+  if (!sws_context_ || last_frame_format_ != frame_format ||
+      last_frame_width_ != frame->width ||
+      last_frame_height_ != frame->height) {
+    // RAII handles cleanup of old context automatically via reset()
+    sws_context_.reset(
+        sws_getContext(frame->width, frame->height, frame_format, frame->width,
+                       frame->height, AV_PIX_FMT_RGBA, SWS_BILINEAR, nullptr,
+                       nullptr, nullptr));
+
+    if (!sws_context_) {
+      std::string error_msg = "Could not create sws context";
+      error_tsfn_.NonBlockingCall(
+          new std::string(error_msg),
+          [](Napi::Env env, Napi::Function fn, std::string* msg) {
+            // If env is null, TSFN is closing during teardown. Just cleanup.
+            if (env == nullptr) {
+              delete msg;
+              return;
+            }
+            fn.Call({Napi::Error::New(env, *msg).Value()});
+            delete msg;
+          });
+      return;
+    }
+
+    last_frame_format_ = frame_format;
+    last_frame_width_ = frame->width;
+    last_frame_height_ = frame->height;
+    // Update output dimensions based on actual frame
+    output_width_ = frame->width;
+    output_height_ = frame->height;
   }
 
+  // Copy metadata under lock to prevent torn reads
+  // Note: codec_mutex_ is already held by ProcessPacket caller
+  DecoderMetadataConfig metadata_copy = metadata_config_;
+
   // Convert YUV to RGBA
   size_t rgba_size = output_width_ * output_height_ * 4;
-  auto* rgba_data = new std::vector<uint8_t>(rgba_size);
+  auto* rgba_data = AcquireBuffer(rgba_size);
 
   uint8_t* dst_data[1] = {rgba_data->data()};
   int dst_linesize[1] = {output_width_ * 4};
 
-  sws_scale(sws_context_, frame->data, frame->linesize, 0, frame->height,
+  sws_scale(sws_context_.get(), frame->data, frame->linesize, 0, frame->height,
             dst_data, dst_linesize);
 
   int64_t timestamp = frame->pts;
   int width = output_width_;
   int height = output_height_;
 
+  // Capture metadata for lambda
+  int rotation = metadata_copy.rotation;
+  bool flip = metadata_copy.flip;
+
+  // Calculate display dimensions based on aspect ratio (per W3C spec).
+  // If displayAspectWidth/displayAspectHeight are set, compute display
+  // dimensions maintaining the height and adjusting width to match ratio.
+  int disp_width = width;
+  int disp_height = height;
+  if (metadata_copy.display_width > 0 && metadata_copy.display_height > 0) {
+    // Per W3C spec: displayWidth = codedHeight * aspectWidth / aspectHeight
+    disp_width = static_cast<int>(
+        std::round(static_cast<double>(height) *
+                   static_cast<double>(metadata_copy.display_width) /
+                   static_cast<double>(metadata_copy.display_height)));
+    disp_height = height;
+  }
+  std::string color_primaries = metadata_copy.color_primaries;
+  std::string color_transfer = metadata_copy.color_transfer;
+  std::string color_matrix = metadata_copy.color_matrix;
+  bool color_full_range = metadata_copy.color_full_range;
+  bool has_color_space = metadata_copy.has_color_space;
+
+  // Increment pending BEFORE queueing callback for accurate tracking
+  (*pending_frames_)++;
+
+  // Capture shared_ptr to pending counter, NOT raw worker pointer.
+  // This ensures the counter remains valid even if the worker is destroyed
+  // before the TSFN callback executes on the main thread.
+  // Note: Buffer is managed via raw delete since buffer pool access is unsafe
+  // after worker destruction.
+  auto pending_counter = pending_frames_;
   output_tsfn_.NonBlockingCall(
-      rgba_data, [width, height, timestamp](Napi::Env env, Napi::Function fn,
-                                            std::vector<uint8_t>* data) {
-        Napi::Object frame_obj = VideoFrame::CreateInstance(
-            env, data->data(), data->size(), width, height, timestamp, "RGBA");
-        fn.Call({frame_obj});
+      rgba_data,
+      [pending_counter, width, height, timestamp, rotation, flip, disp_width,
+       disp_height, color_primaries, color_transfer, color_matrix,
+       color_full_range,
+       has_color_space](Napi::Env env, Napi::Function fn,
+                        std::vector<uint8_t>* data) {
+        // CRITICAL: If env is null, TSFN is closing during teardown.
+        // Must still clean up data and counters, then return.
+        // NOTE: Do NOT access static variables (like counterQueue) here - they may
+        // already be destroyed due to static destruction order during process exit.
+        if (env == nullptr) {
+          delete data;
+          (*pending_counter)--;
+          // Skip counterQueue-- : static may be destroyed during process exit
+          return;
+        }
+
+        // Always clean up, even if callback throws
+        try {
+          Napi::Object frame_obj;
+          if (has_color_space) {
+            frame_obj = VideoFrame::CreateInstance(
+                env, data->data(), data->size(), width, height, timestamp,
+                "RGBA", rotation, flip, disp_width, disp_height, color_primaries,
+                color_transfer, color_matrix, color_full_range);
+          } else {
+            frame_obj = VideoFrame::CreateInstance(
+                env, data->data(), data->size(), width, height, timestamp,
+                "RGBA", rotation, flip, disp_width, disp_height);
+          }
+          fn.Call({frame_obj});
+        } catch (const std::exception& e) {
+          // Log but don't propagate - cleanup must happen
+          fprintf(stderr, "AsyncDecodeWorker callback error: %s\n", e.what());
+        } catch (...) {
+          fprintf(stderr,
+                  "AsyncDecodeWorker callback error: unknown exception\n");
+        }
+        // Delete buffer directly (can't use pool after worker destruction)
         delete data;
+        // Decrement pending counter via shared_ptr (safe after worker destruction)
+        (*pending_counter)--;
+        webcodecs::counterQueue--;  // Decrement global queue counter
       });
 }