[memory-leak] Fix native use-after-free in SKRegion.SpanIterator (root the SKRegion)

[github-actions]

🤖 AI-generated fix. Produced automatically by the SkiaSharp Memory Leak Fixer agentic workflow using the memory-leak-fixer skill, and empirically validated (red→green) on linux-x64 against the milestone's pre-built natives.

The leak

SKRegion.SpanIterator (binding/SkiaSharp/SKRegion.cs) handed the region's handle to native sk_region_spanerator_new(...) but — unlike its sibling iterators RectIterator and ClipIterator — kept no managed reference to the SKRegion. Native SkRegion::Spanerator holds a raw pointer into the region's run data, and SKRegion is ISKSkipObjectRegistration (so it is not rooted by the HandleDictionary). If the SKRegion wrapper was finalized while a SpanIterator was still alive, the native runs were freed underneath the iterator → use-after-free.

The fix

Mirror the two sibling iterators: store the SKRegion in a private readonly SKRegion region; field and assign it in the constructor, so the region stays rooted for the iterator's whole lifetime. This is the idiomatic family-5 fix (add a managed root), matches RectIterator (:315) and ClipIterator (:347) exactly, and changes no public signature (ABI-safe).

public class SpanIterator : SKObject, ISKSkipObjectRegistration
{
    private readonly SKRegion region;

    internal SpanIterator (SKRegion region, int y, int left, int right)
        : base (SkiaApi.sk_region_spanerator_new (region.Handle, y, left, right), true)
    {
        this.region = region;
    }
    // ...
}

Proof (red → green)

Added regression test SpanIteratorKeepsItsRegionAlive (tests/Tests/SkiaSharp/SKRegionTest.cs): a [MethodImpl(NoInlining)] helper returns a live SpanIterator plus a WeakReference to its region (the iterator being the only strong root); the test forces GC and asserts the region is still alive and the iterator still yields the correct intercepts.

• Without the fix: failed: 1 — "The SKRegion was collected while its SpanIterator was still alive."
• With the fix: succeeded: 1; the whole SKRegionTest class is 22/22 green.

Commands (headless linux-x64; TFM pinned to avoid absent mobile workloads):

dotnet cake --target=externals-download
dotnet build tests/SkiaSharp.Tests.Console/SkiaSharp.Tests.Console.csproj \
  -p:AllTargetFrameworks=net10.0 -p:BasicTargetFrameworks=net10.0 -f net10.0
dotnet exec tests/SkiaSharp.Tests.Console/bin/Debug/net10.0/SkiaSharp.Tests.dll \
  --filter-method "*SpanIteratorKeepsItsRegionAlive*"

Scope

• Managed-C# only (binding/SkiaSharp/SKRegion.cs); no *.generated.cs, no externals/skia/**.
• No public API/ABI change (adds a private field + assignment in an internal ctor).
• Empirically proven, not just statically reasoned.

Fixes #4354

Generated by Fixer - Memory Leak · ● 64.8M · ◷

[Copilot]

Pull request overview

Fixes a native use-after-free hazard in SKRegion.SpanIterator by ensuring the iterator keeps its source SKRegion rooted for the iterator’s lifetime, aligning its retention behavior with RectIterator and ClipIterator.

Changes:

• Root SKRegion inside SKRegion.SpanIterator via a private readonly field assigned in the iterator constructor.
• Add a regression test that forces GC/finalization and validates the region remains alive while the iterator is alive and usable.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
binding/SkiaSharp/SKRegion.cs	Adds a private SKRegion field to SpanIterator to keep the source region alive and prevent native use-after-free.
tests/Tests/SkiaSharp/SKRegionTest.cs	Adds a regression test ensuring SpanIterator keeps its region alive across forced GC and remains functional.

[github-actions]

📖 Documentation Preview

The documentation for this PR has been deployed and is available at:

🔗 View Staging Site
🔗 View Staging Docs
🔗 View Staging Gallery (Blazor)
🔗 View Staging Gallery (Uno Platform)
🔗 View Staging SkiaFiddle

This preview will be updated automatically when you push new commits to this PR.

---

This comment is automatically updated by the documentation staging workflow.

[github-actions]

📦 Try the packages from this PR

Warning

Do not run these scripts without first reviewing the code in this PR.

Step 1 — Download the packages

bash / macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/mono/SkiaSharp/main/scripts/get-skiasharp-pr.sh | bash -s -- 4355

PowerShell / Windows:

iex "& { $(irm https://raw.githubusercontent.com/mono/SkiaSharp/main/scripts/get-skiasharp-pr.ps1) } 4355"

Step 2 — Add the local NuGet source

dotnet nuget add source ~/.skiasharp/hives/pr-4355/packages --name skiasharp-pr-4355

More options

Option	Description
--successful-only / -SuccessfulOnly	Only use successful builds
--force / -Force	Overwrite previously downloaded packages
--list / -List	List available artifacts without downloading
--build-id ID / -BuildId ID	Download from a specific build

Or download manually from Azure Pipelines — look for the nuget artifact on the build for this PR.

Remove the source when you're done:

dotnet nuget remove source skiasharp-pr-4355

[mattleibow]

Updated to root the SKRegion via SkiaSharp's built-in Referenced(this, region) helper instead of a hand-rolled private readonly SKRegion field. Applied to all three iterators (RectIterator/ClipIterator/SpanIterator) so the whole family uses the canonical keep-alive mechanism consistently rather than mixing styles.

Behaviour is unchanged and SpanIteratorKeepsItsRegionAlive still passes (full suite: same results as base — the only failure is the pre-existing ganesh-gl/DiagonalLines GPU golden flake, unrelated to this change). The keep-alive helper is documented in #4377.