Skip to content

Conversation

mszabo-wikia
Copy link
Contributor

When an AwaitAllWaitHandle is unblocked, it checks whether all its children are finished, and unblocks its parent if so. This can lead to a stack overflow if an extremely long chain of AwaitAllWaitHandles has formed. This is very easy to trigger e.g. by using a HSL Semaphore with a slow task:

async function bar(): Awaitable<void> {
	$s = new \HH\Lib\Async\Semaphore(10, async (bool $should_wait) ==> {
		if ($should_wait) {
			await Asio\usleep(100000 * 100000);
		} else {
			await Asio\later();
		}
	});

	concurrent {
		await $s->waitForAsync(true);
		await async {
			for ($i = 0; $i < 1000000; $i++) {
				await $s->waitForAsync(false);
			}
		};
	}
}

<<__EntryPoint>>
function mymain(): void {
	Asio\join(bar());
}

When this runs, we either crash in AsioBlockableChain::unblock as we recursively try to unblock each handle in the chain, or in the native destructor for AwaitAllWaitHandle as we recursively try to free the entire chain. ConcurrentWaitHandle is implemented in a similar vein and may thus also suffer from the same issue.

So:

  • When freeing AwaitAllWaitHandles or ConcurrentWaitHandles, iteratively decrement the refcount for any children that are themselves of the same type. and free their backing memory in a separate loop instead of deeply recursing via decRefObj(). Handle other children as before.
  • Avoid recursion in AsioBlockableChain::unblock via a worklist.

Open questions:

  • Should we also handle a chain that consists of mixed AwaitAllWaitHandles and ConcurrentWaitHandles? I haven't been able to create a reproducer that'd create such a chain.
  • The iterative AsioBlockableChain::unblock implementation now also leaves m_lastParent untouched, which is also how it was before f80acc289feb1a76029d08447c993138db397a29. (D3053017). If I'm reading the code correctly, this should not have an effect for most parentChain calls because those were operating on a copied value to begin with, but I'm not very confident about this.

When an `AwaitAllWaitHandle` is unblocked, it checks whether all its
children are finished, and unblocks its parent if so. This can lead
to a stack overflow if an extremely long chain of `AwaitAllWaitHandle`s
has formed. This is very easy to trigger e.g. by using a HSL `Semaphore`
with a slow task:

```hack
async function bar(): Awaitable<void> {
	$s = new \HH\Lib\Async\Semaphore(10, async (bool $should_wait) ==> {
		if ($should_wait) {
			await Asio\usleep(100000 * 100000);
		} else {
			await Asio\later();
		}
	});

	concurrent {
		await $s->waitForAsync(true);
		await async {
			for ($i = 0; $i < 1000000; $i++) {
				await $s->waitForAsync(false);
			}
		};
	}
}

<<__EntryPoint>>
function mymain(): void {
	Asio\join(bar());
}
```

When this runs, we either crash in `AsioBlockableChain::unblock`
as we recursively try to unblock each handle in the chain,
or in the native destructor for `AwaitAllWaitHandle` as we recursively
try to free the entire chain. `ConcurrentWaitHandle` is implemented
in a similar vein and may thus also suffer from the same issue.

So:
* When freeing `AwaitAllWaitHandle`s or `ConcurrentWaitHandle`s, iteratively
  decrement the refcount for any children that are themselves of the same type.
  and free their backing memory in a separate loop instead of deeply recursing
  via `decRefObj()`. Handle other children as before.
* Avoid recursion in `AsioBlockableChain::unblock` via a worklist.

Open questions:
* Should we also handle a chain that consists of mixed `AwaitAllWaitHandle`s
  and `ConcurrentWaitHandle`s? I haven't been able to create a reproducer
  that'd create such a chain.
* The iterative `AsioBlockableChain::unblock` implementation now also leaves
  `m_lastParent` untouched, which is also how it was before `f80acc289feb1a76029d08447c993138db397a29`.
  (D3053017). If I'm reading the code correctly, this should not have an
  effect for most `parentChain` calls because those were operating on a
  copied value to begin with, but I'm not very confident about this.
@meta-cla meta-cla bot added the CLA Signed label Oct 10, 2025
Copy link

meta-codesync bot commented Oct 10, 2025

@facebook-github-bot has imported this pull request. If you are a Meta employee, you can view this in D84352565. (Because this pull request was imported automatically, there will not be any future comments.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant