Add opt-in graceful bail-out for memory and content handler errors

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## v3.0.0
+
+- Added `MemorySettings::graceful_bail_out_on_memory_limit_exceeded`: when set, the rewriter
+  flushes every input byte it has received but not yet emitted to the sink (as-is) before
+  returning `MemoryLimitExceededError`, so callers can continue the response by writing
+  subsequent bytes directly to their downstream sink instead of breaking it.
+- Added `Settings::graceful_bail_out_on_content_handler_error`: symmetric to the memory flag
+  above, but for `RewritingError::ContentHandlerError`. When set, the rewriter flushes
+  remaining input bytes before propagating a handler error, preserving the response.
+  Currently exposed via the Rust API only; the C API still uses the original behavior.
+- Adding new fields to `MemorySettings` and `Settings` is a SemVer-breaking change for
+  existing struct-literal construction, hence the major version bump.
+
 ## v2.9.0
 
 - Added `OutputSink::set_encoding`

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lol_html"
-version = "2.9.0"
+version = "3.0.0"
 authors = ["Ivan Nikulin <inikulin@cloudflare.com, ifaaan@gmail.com>"]
 license = "BSD-3-Clause"
 description = "Streaming HTML rewriter/parser with CSS selector-based API"

c-api/include/lol_html.h

@@ -255,6 +255,27 @@ typedef struct {
     // `lol_html_rewriter_write` and `lol_html_rewriter_end` will return an error
     // if this limit is exceeded.
     size_t max_allowed_memory_usage;
+    // Controls how the rewriter recovers when `max_allowed_memory_usage` is
+    // exceeded.
+    //
+    // When `false` (the default), the rewriter aborts processing the response,
+    // returns an error, and leaves the output sink in a potentially inconsistent
+    // state (i.e. the sink will have received the transformed bytes the rewriter
+    // had already produced, but the remaining input bytes are lost). This
+    // typically results in a truncated, broken response.
+    //
+    // When `true`, before returning the error the rewriter flushes every input
+    // byte it has received but not yet emitted to the sink, *as-is* (i.e.
+    // without any transformation). The caller can then continue the response by
+    // writing any subsequent input bytes directly to its own downstream sink,
+    // bypassing the (now poisoned) rewriter. The resulting response will have
+    // the rewriter's transformations applied up to some boundary, followed by
+    // the original bytes after that boundary, but the response will not be
+    // broken.
+    //
+    // The rewriter is still poisoned after the error and must not be used again,
+    // regardless of this setting.
+    bool graceful_bail_out_on_memory_limit_exceeded;
 } lol_html_memory_settings_t;
 
 // Builds HTML-rewriter out of the provided builder. Can be called

c-api/src/rewriter.rs

@@ -61,6 +61,10 @@ fn lol_html_rewriter_build_inner(
         strict,
         enable_esi_tags,
         adjust_charset_on_meta_tag: false,
+        // TODO: expose `graceful_bail_out_on_content_handler_error` through the C API. Adding
+        // a new parameter to `lol_html_rewriter_build()` is a breaking ABI change, so it
+        // belongs behind a new function variant or a settings struct.
+        graceful_bail_out_on_content_handler_error: false,
     };
 
     let output_sink = ExternOutputSink::new(output_sink, output_sink_user_data);

fuzz/test_case/src/lib.rs

@@ -176,6 +176,7 @@ fn run_rewriter_iter(data: &[u8], selector: &str, encoding: &'static Encoding) {
             memory_settings: MemorySettings::new(),
             strict: false,
             adjust_charset_on_meta_tag: false,
+            graceful_bail_out_on_content_handler_error: false,
         },
         |_: &[u8]| {},
     );
@@ -199,6 +200,7 @@ fn run_c_api_rewriter_iter(data: &[u8], encoding: &str) {
             lol_html_memory_settings_t {
                 preallocated_parsing_buffer_size: 0,
                 max_allowed_memory_usage: usize::MAX,
+                graceful_bail_out_on_memory_limit_exceeded: false,
             },
             Some(empty_handler),
             output_data_ptr,

js-api/Cargo.toml

@@ -2,7 +2,7 @@
 name = "lol-html"
 description = "Streaming HTML rewriter/parser with CSS selector-based API"
 license = "BSD-3-Clause"
-version = "2.9.0"
+version = "3.0.0"
 authors = ["Ivan Nikulin <inikulin@cloudflare.com>", "Gus Caplan <me@gus.host>"]
 repository = "https://github.com/cloudflare/lol-html"
 edition = "2024"
@@ -14,7 +14,7 @@ crate-type = ["cdylib", "rlib"]
 
 [dependencies]
 js-sys = "0.3.97"
-lol_html_native = { package = "lol_html", path = "../", version = "2.9.0" }
+lol_html_native = { package = "lol_html", path = "../", version = "3.0.0" }
 serde = { version = "1.0.228", features = ["derive"] }
 encoding_rs = "0.8.35"
 serde-wasm-bindgen = "0.6.5"