Creates a PNG → RGBA8 decoder whose Wasm memory maximum is set BEFORE any
codec code runs. memory.grow cannot exceed the ceiling, even during parsing
or decompression. No native browser decoder, DOM object, fetch, or executable
JavaScript glue is used. The six imports implement the pinned codec's small
wasm-bindgen ABI; they cannot allocate unbounded output on the host.
This caps one decoder's linear heap, not browser/process RSS, compiler memory,
the caller's encoded buffer, or retained decoded assets. The host RGBA copy is
independently bounded before allocation. Texture row flipping may retain a
second output-sized buffer. Reuse this function to reuse one bounded heap;
decoding is synchronous once the async factory resolves. Use a worker when
decode-time preemption is also needed.
A codec failure poisons the instance: construct a fresh decoder to recover.
Header/budget refusals before codec execution do not poison it. This avoids
reusing allocator state after a Wasm trap or exception crossing its stack.
Creates a PNG → RGBA8 decoder whose Wasm memory maximum is set BEFORE any codec code runs.
memory.growcannot exceed the ceiling, even during parsing or decompression. No native browser decoder, DOM object, fetch, or executable JavaScript glue is used. The six imports implement the pinned codec's small wasm-bindgen ABI; they cannot allocate unbounded output on the host.This caps one decoder's linear heap, not browser/process RSS, compiler memory, the caller's encoded buffer, or retained decoded assets. The host RGBA copy is independently bounded before allocation. Texture row flipping may retain a second output-sized buffer. Reuse this function to reuse one bounded heap; decoding is synchronous once the async factory resolves. Use a worker when decode-time preemption is also needed.
A codec failure poisons the instance: construct a fresh decoder to recover. Header/budget refusals before codec execution do not poison it. This avoids reusing allocator state after a Wasm trap or exception crossing its stack.