The crash was caused either by running out of memory or because malloc returned null, because the requested buffer size was too large. The large buffer size was requested because uninitialized memory was used as canvas rectangle.
It's hard to say if I found all missing initializations, or if some of the initializations aren't actually needed. I only have statistical evidence for the correctness of the patch: in blender-v3.0-release it crashed about every third time I tried in a release build, with this patch I didn't have a crash yet.

Some determine_canvas functions don't seem to initialize the output r_area but read from r_area. E.g. NodeOperationOutput::determine_canvas. The proper fix is probably to make sure that r_area is set everywhere, but initializing the variable at the declaration felt more safe for 3.0.

Reproducing the bug in a debug build was a bit more tricky, probably because more often memory is initialized to zero already.