node:vm: enforce timeout as a wall-clock deadline that interrupts Atomics.wait #33764
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| #include "TimeoutWatchdog.h" | ||
|
|
||
| #include <JavaScriptCore/VM.h> | ||
| #include <JavaScriptCore/VMTraps.h> | ||
| #include <JavaScriptCore/WaiterListManager.h> | ||
| #include <JavaScriptCore/ExceptionScope.h> | ||
|
|
||
| namespace Bun { | ||
|
|
||
| TimeoutWatchdog::TimeoutWatchdog(JSC::VM& vm, std::optional<int64_t> timeoutMs) | ||
| : m_vm(vm) | ||
| { | ||
| if (!timeoutMs) | ||
| return; | ||
|
|
||
| // The worker thread requests termination via throwTerminationException() | ||
| // (reached from VMTraps::handleTraps / Atomics.wait Terminated). That | ||
| // path asserts the lazily-allocated termination exception exists, so | ||
| // create it now on the mutator thread. | ||
| vm.ensureTerminationException(); | ||
|
coderabbitai[bot] marked this conversation as resolved.
Outdated
|
||
|
|
||
| auto deadline = MonotonicTime::now() + Seconds::fromMilliseconds(static_cast<double>(*timeoutMs)); | ||
| m_thread = WTF::Thread::create("node:vm timeout"_s, [this, deadline] { | ||
| Locker locker { m_lock }; | ||
| while (!m_disarmed) { | ||
| if (m_cond.waitUntil(m_lock, deadline)) | ||
| continue; | ||
| if (m_disarmed) | ||
| return; | ||
| fire(); | ||
| // Keep nudging the sync waiter until the mutator disarms us: | ||
| // the first notify can be lost if it lands between the waiter | ||
| // evaluating its loop predicate and parking (we do not hold the | ||
| // waiter's list lock). | ||
| while (!m_disarmed) { | ||
| if (m_cond.waitUntil(m_lock, MonotonicTime::now() + 1_ms)) | ||
| continue; | ||
| m_vm.syncWaiter()->condition().notifyOne(); | ||
| } | ||
|
Check warning on line 39 in src/jsc/bindings/vm/TimeoutWatchdog.cpp
|
||
| return; | ||
| } | ||
| }); | ||
| } | ||
|
robobun marked this conversation as resolved.
|
||
|
|
||
| TimeoutWatchdog::~TimeoutWatchdog() | ||
| { | ||
| disarm(); | ||
| } | ||
|
|
||
| void TimeoutWatchdog::disarm() | ||
| { | ||
| if (!m_thread) | ||
| return; | ||
| { | ||
| Locker locker { m_lock }; | ||
| m_disarmed = true; | ||
| } | ||
| m_cond.notifyOne(); | ||
| m_thread->waitForCompletion(); | ||
| m_thread = nullptr; | ||
| } | ||
|
|
||
| void TimeoutWatchdog::fire() | ||
| { | ||
| m_fired.store(true, std::memory_order_release); | ||
| // Mark the VM as terminating so WaiterListManager::waitForSync's loop | ||
| // predicate (!vm.hasTerminationRequest()) falls through and a blocked | ||
| // Atomics.wait returns Terminated. m_hasTerminationRequest is a plain | ||
| // bool but the notify below is a full fence and the woken waiter | ||
| // reacquires its list lock (acquire), so the write is observable. | ||
| m_vm.setHasTerminationRequest(); | ||
| // Raise NeedTermination so running JS exits at the next back-edge. This | ||
| // path also reaches requestThreadStopIfNeeded which notifies the sync | ||
| // waiter, but that notify is skipped when a thread-stop is already | ||
| // pending, so deliver one unconditionally here as well. | ||
| m_vm.notifyNeedTermination(); | ||
|
robobun marked this conversation as resolved.
|
||
| m_vm.syncWaiter()->condition().notifyOne(); | ||
| } | ||
|
|
||
| void TimeoutWatchdog::clearTerminationState(JSC::VM& vm) | ||
| { | ||
| if (vm.hasPendingTerminationException()) { | ||
| auto scope = DECLARE_TOP_EXCEPTION_SCOPE(vm); | ||
| scope.clearException(); | ||
| } | ||
| vm.clearHasTerminationRequest(); | ||
| vm.traps().clearTrap(JSC::VMTraps::NeedTermination); | ||
| vm.traps().clearTrap(JSC::VMTraps::NeedWatchdogCheck); | ||
| } | ||
|
|
||
| } // namespace Bun | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| #pragma once | ||
|
|
||
| #include "root.h" | ||
|
|
||
| #include <wtf/Condition.h> | ||
| #include <wtf/Lock.h> | ||
| #include <wtf/Threading.h> | ||
|
|
||
| namespace Bun { | ||
|
|
||
| // Wall-clock watchdog for node:vm's `timeout` option. On fire it requests VM | ||
| // termination and wakes a blocked Atomics.wait so the guest cannot sit out the | ||
| // deadline in a futex. The destructor joins the worker thread, so the watchdog | ||
| // is always armed on the stack bracketing JSC::evaluate. | ||
|
coderabbitai[bot] marked this conversation as resolved.
Outdated
|
||
| class TimeoutWatchdog { | ||
| WTF_MAKE_NONCOPYABLE(TimeoutWatchdog); | ||
|
|
||
| public: | ||
| TimeoutWatchdog(JSC::VM& vm, std::optional<int64_t> timeoutMs); | ||
| ~TimeoutWatchdog(); | ||
|
|
||
| void disarm(); | ||
| bool didFire() const { return m_fired.load(std::memory_order_acquire); } | ||
|
|
||
| // Clears the VM's termination state (request flag + trap bits + pending | ||
| // exception) that this watchdog installed when it fired. Call from the | ||
| // mutator thread after evaluate returns. | ||
| static void clearTerminationState(JSC::VM&); | ||
|
|
||
| private: | ||
| void fire(); | ||
|
|
||
| JSC::VM& m_vm; | ||
| WTF::Lock m_lock; | ||
| WTF::Condition m_cond; | ||
| std::atomic<bool> m_fired { false }; | ||
| bool m_disarmed WTF_GUARDED_BY_LOCK(m_lock) { false }; | ||
| RefPtr<WTF::Thread> m_thread; | ||
| }; | ||
|
|
||
| } // namespace Bun | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.