Module render_worker 

Rendering PDF pages out-of-process, so a renderer crash cannot take the daemon with it.

Compiled unconditionally, unlike the rendering it performs. A binary that might be spawned as a worker has to recognise the worker argument even when it cannot render, or it falls through to its own argument parsing and answers a render request with usage text — which then surfaces as a per-item job failure reading Error: usage: cuttlefishd <spec> ... and says nothing about the real mismatch. Rendering PDF pages in a subprocess, so a crash cannot take the daemon down.

Why this exists

pdfium is a large C++ library, and it segfaults on input that other parsers accept — this project has a PDF that lopdf reads without complaint and pdfium dies on. That is not a bug to be fixed here; it is what handing untrusted bytes to a C++ parser is like.

In-process, a segfault kills the daemon. Not the job — the daemon, and with it every other job running alongside, plus their results. The whole system is otherwise built so that a failing job fails alone: capabilities are checked per job, contexts are per job, a wasm trap ends one job. A renderer that can take down the process is the one thing that breaks that property.

So rendering happens in a child process. A crash there becomes a signal on a wait status, which is a normal error the offending job reports and everything else survives.

How the child is chosen

Normally the child is this same executable, re-invoked with a hidden argument, which guarantees it is exactly the build the parent is running — a separately shipped binary can drift out of sync in ways that appear only at runtime.

That does not work for tests: a libtest binary cannot re-exec itself, because libtest would read the worker’s arguments as test filters. So WORKER_EXE_ENV can name an executable instead, and the crate ships a cuttlefish-render-worker binary for that purpose.

The cost is one process spawn per rendered page. Against the render itself and the vision-model inference that follows it, that is not measurable.

Constants

WORKER_ARG

The argument that turns this executable into a render worker.

WORKER_EXE_ENV

Names an executable to use as the render worker instead of re-execing this one.

Functions

render_page

Render a page in a child process, returning PNG bytes.

run_if_worker

If this process was spawned as a render worker, do that work and exit.