Raise exception if serving server is garbage collected (or maybe just shut it down?)

[nathanielmanistaatgoogle]

Right now there's no protection stopping the Python interpreter from garbage-collecting a serving server (and its completion queue). It's a great way to fail an assertion and crash the entire process. Probably the right thing to do is raise an exception indicating a programming defect if the garbage collector attempts to delete a serving server.

This came up in my recent testing and rather than code it up right away I want to take some time to think about it.

[ctiller]

Is it a python or C level crash?

If it's crashing in the core, it's probably my bug (and a repro and/or callstack would be great)

[nathanielmanistaatgoogle]

It's a C level crash but I'm not yet asking you to take any action because I think it comes after an illegal sequence of calls across the grpc.h API.

I'll work up a reproduction case at some point but this isn't blocking correct use of the system so it's low-priority for now.

[ctiller]

K. If its an ordering bug on shutdown I definitely want details though - we can't (in general) control destruction order because arbitrary garbage collectors.

[nathanielmanistaatgoogle]

I'm not so sure about this any more - in the last few weeks I've started to think that maybe the right thing to do if a serving server is garbage collected is just cancel all its RPCs and shut it down cleanly. Retitling this issue.

@soltanmm have you any feelings one way or the other?

[ctiller]

Just shutting down seems like the most predictable thing to do.

[nathanielmanistaatgoogle]

This is implemented in GA.