Keep runtime schedulers safe through teardown - #254
Open
matthargett wants to merge 2 commits into
Open
matthargett wants to merge 2 commits into
matthargett wants to merge 2 commits into
Conversation
Share synchronized dispatch state with scheduler copies, close it before AppRuntime discards pending work, and release dispatch captures outside the lock. Preserve existing callable overload behavior while accepting mutable and environment-taking callbacks. Add bounded native regression tests with owned timeout state. Adapted from integration commits by Matt Hargett: Source-commit: 7093c83 Source-commit: 0a5d570
Author
|
Also validated this change in the integrated browser-polyfill stack on M4 Max/system JavaScriptCore with |
BabylonJS#257 moved the unit-test sources under Tests/UnitTests/Source, so the scheduler lifetime tests become Source/Tests.JsRuntimeScheduler.cpp, registered next to the other per-feature test files.
matthargett
added a commit
to rebeckerspecialties/JsRuntimeHost
that referenced
this pull request
Sep 29, 2026
…gh teardown) into the Worker stack A worker terminated right after construction dispatches its startup work into a runtime that has already been torn down; without BabylonJS#254 that lock lands on a destroyed mutex (mutex lock failed: Invalid argument) as soon as environment start-up takes a little longer, which BabylonJS#218's intrinsic capture made deterministic in Worker.UndefinedTypeMeansClassic.
matthargett
added a commit
to rebeckerspecialties/JsRuntimeHost
that referenced
this pull request
Sep 29, 2026
The worker thread posts to the parent realm after terminate() and after close(): the deferred release of the parent-side Worker object, and message/error delivery. It did so through the parent's JsRuntime pointer, which is only valid while the parent runtime lives. A worker terminated as it is created, or a host tearing down while a worker closes, then dispatched into a destroyed runtime (mutex lock failed: Invalid argument, or a null dispatch state). BabylonJS#218's intrinsic capture made the race deterministic in Worker.UndefinedTypeMeansClassic. A JsRuntimeScheduler copy (BabylonJS#254) keeps the parent's dispatch state alive and discards work once the runtime has shut down, so the parent-realm dispatches are routed through one held in the worker state.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Napi::Envcallbacks while preserving existing const/zero-argument overload behavior. Add ten bounded native tests with owned timeout state.Validation
macOS 27.0 arm64, SDK 27.0, LLVM 23.1.1, real system JavaScriptCore. A native-only target compiled the committed scheduler test file and runtime, reusing dependency sources read-only:
JSC_collectContinuously=1 SchedulerTests --gtest_repeat=20: 200/200 passed.ENABLE_THREAD_SANITIZER=ON,TSAN_OPTIONS=halt_on_error=1: 200/200 passed, no TSan reports. System JSC itself is not instrumented.839b352reproduced post-destruction dispatch failure:mutex lock failed: Invalid argument. No ASan UAF diagnostic was emitted.git diff --checkpassed. No npm/polyfill suite or other engines were tested.Provenance
Adapted from Matt Hargett's integration commits
7093c83d3a29020fc52f070859b7f7514ed3195fand0a5d570d156d75f5fc01162f5fe6a7ccc891e3c3. This standalone commit preserves the original author/date and adds explicit host shutdown ordering, unlocked capture release, callable compatibility, and bounded tests on upstreammain.Note: this latent issue was discovered by the ChatGPT DayBreak model when I was doing adversarial testing on my webgpu branch.