fix(session-recorder): prevent unbounded error loop from corrupted TextDecoder in emit

[NickSolante]

Fixes #303

Problem

On Safari, the session recorder's emit() could enter a permanent, unbounded error loop: WebKit's TextDecoder can permanently corrupt after high cumulative decode volume and then throw RangeError: Bad value on valid input (WebKit #286266, wasm-bindgen report). emit() reused one module-level decoder for the page lifetime with no error handling, so a single corrupted instance turned every rrweb mutation flush into an uncaught error (~40/sec, observed 64,606 errors over 26 minutes from one session) until page unload. Full telemetry in #303.

Changes

• Single-chunk events (the overwhelmingly common case) skip the encode→decode round-trip entirely the JSON string is already in hand, so most events never touch TextDecoder. This also removes the cumulative decode volume that ages the decoder toward WebKit's corruption threshold.
• Multi-chunk events use a fresh per-event TextDecoder with { stream: true }, which also fixes a latent all-browser bug: byte-slice boundaries that bisected a multi-byte UTF-8 character previously produced U+FFFD replacement characters at chunk seams, silently corrupting reassembled replay JSON.
• A failed decode is retried once with a new decoder, restarting from chunk 0 so streaming state stays consistent.
• Circuit breaker: emit() failures are caught (each dropped event is surfaced via console.error), and after 10 consecutive failures the recorder stops instead of erroring on every event forever. init() resets the breaker state so a later recording lifetime starts clean.
• Chunks are all converted before any is sent, so a mid-loop failure can't export a partial, unreassemblable chunk set.

Tests

• splitIntoChunks unit tests: single-chunk identity (no decode), lossless multi-chunk reassembly, a multi-byte character bisected at the chunk boundary (fails against the old non-streaming decode), and recovery via the fresh-decoder retry (first decoder instance always throws RangeError: Bad value).
• emit() error-handling tests (mocked rrweb/exporter/tracer): failures don't throw into rrweb dispatch, the breaker trips on the 10th consecutive failure and stops recording, nothing is emitted after tripping, and recording works again after a re-init.

compile:tsc clean, jest 10/10 passing.

Notes

• Includes a changeset (patch bump for @hyperdx/otel-web-session-recorder).
• Pre-existing and untouched here: MutationRateLimiter's constructor starts a setInterval that is never cleared (it also survives deinit()); the emit tests use fake timers to work around it. Happy to fix in a follow-up.

[changeset-bot]

🦋 Changeset detected

Latest commit: e42b015

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@hyperdx/otel-web-session-recorder	Patch
@hyperdx/browser	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[greptile-apps]

Greptile Summary

This PR prevents persistent session-recorder emit failures caused by corrupted Safari TextDecoder instances and preserves UTF-8 data across chunk boundaries.

• Avoids unnecessary encoding and decoding for single-chunk events.
• Uses fresh streaming decoders with one retry for multi-chunk events.
• Adds a consecutive-failure circuit breaker and resets it on recorder initialization.
• Adds focused tests for decoding, failure handling, teardown, and reinitialization.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/session-recorder/src/index.ts	Adds guarded emit processing, OpenTelemetry diagnostics, circuit-breaker teardown, and clean state reset across recorder lifetimes.
packages/session-recorder/src/sessionrecording-utils.ts	Adds lossless UTF-8-aware chunking with a single-chunk fast path and fresh-decoder retry.
packages/session-recorder/tests/emit.test.ts	Covers successful emits, swallowed failures, breaker activation, post-breaker suppression, and reinitialization.
packages/session-recorder/tests/sessionrecording-utils.test.ts	Covers chunk identity, lossless reassembly, multibyte boundaries, and decoder recovery.
.changeset/session-recorder-decoder-crash-loop.md	Records the session-recorder patch and accurately describes the decoder and circuit-breaker changes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[rrweb emits event] --> B[Serialize and split into chunks]
  B -->|Success| C[Convert all chunks]
  C --> D[Queue logs]
  D --> E[Reset consecutive failures]
  B -->|Failure| F[Report through OpenTelemetry diagnostics]
  F --> G{10 consecutive failures?}
  G -->|No| H[Drop current event]
  G -->|Yes| I[Stop recorder]
  I --> J[init resets breaker state]

Loading

_{Reviews (5): Last reviewed commit: "Merge branch 'main' into fix/session-rec..." | Re-trigger Greptile}