Back to jeffbrand.ca

The Wall of Shame

A small museum of bugs, footguns, and off-by-ones encountered while building things that should have just worked. Posted here so future-me (and maybe you) doesn’t pay the same toll twice.

None of these were catastrophic. All of them cost an hour I won’t get back. Every entry is a real bug shipped on, debugged on, or worked around on this site. Severity rates how badly the bug lied to me, not how bad the consequences were.

The 1010-byte linearization wall

Spicy
PDF speclinearization

Tried to produce a linearized 10 GB sample PDF for the streaming tests. Couldn’t. Spent an hour wondering if my build pipeline was broken before going to the spec.

The linearization profile requires classic xref tables, which use fixed 10-digit byte offsets. The math caps the entire file at 1010 bytes (~9.31 GiB). Above that, the spec itself precludes a compliant linearized PDF — no implementation can deliver one.

If you need files larger than ~9 GiB, you can’t linearize. The SampleDocs 10 GB variant ships unlinearized and the page explains why.

cerr << + _exit() = silence

Spicy
C++iostreams

Spent twenty minutes wondering why my error binary was “dying silently” on the worst inputs. The error path was right there. It was even reaching it. Just no output.

Because the error path was: cerr << "..." ; _exit(N);. _exit skips the iostream destructors. cerr’s buffer never flushes.

Error paths use fprintf(stderr, ...) + fflush(stderr) before _exit(). Always. The success path can use whatever, because nothing’s broken at the end of the happy path.

The cleanup log that wouldn’t stop

Mild
Pythonsession GC

Service log was filling up with Cleaned up session abc123 every five minutes. Same session ID. Different timestamps. Forever.

The cleanup task was calling shutil.rmtree(ignore_errors=True) — which, when something else has a file lock, returns successfully having done absolutely nothing — and then logging “cleaned up.” The sweep ran every 5 minutes. The lock held for hours.

ignore_errors=True is a recipe for confidently lying logs. Verify the directory is actually gone before logging success. If it’s still there, log a warning with the stragglers.

The endpoint that just vanished

Mild
FastAPIregression

A user reported {"detail":"Not Found"} on the rasterize demo. The engine module was still there. The binary was still there. The route handler was not.

Sometime during an unrelated feature add, the @app.post("/rasterize") decorator and its handler had been deleted from main.py. No tests caught it because the whole app is a thin shell — the contracts live in the front-end.

Before pushing a service that owns many tiny endpoints, grep -c @app.post main.py. If the count went down, something fell off the truck.