Make runtime creation safe #450

jdm · 2018-12-02T20:12:18Z

The fundamental problem exposed in servo/servo#22342 is that our concept of a parent runtime did not match reality. Using the first JSContext's runtime as the global parent for all subsequent contexts only makes sense if that JSContext outlives every other context. This is not guaranteed, leading to crashes when trying to use those contexts if the first context (and therefore its runtime) was destroyed.

The new design incorporates several changes for safer, more clear context and runtime management:

in order to create a new context, either a handle to an initialized JS engine is required or a handle to an existing runtime
all runtimes track outstanding handles that have been created, and assert if a runtime is destroyed before all of its child runtimes
overall initialization and shutdown of the engine is controlled by the lifetime of a JSEngine value, so creating a Runtime value is now infallible

This change is


        Auto merge of #22353 - jdm:runtime-parent, r=<try>

Runtime parent These changes adjust our uses of the rust-mozjs APIs to accommodate the changes in servo/rust-mozjs#450. --- - [x] `./mach build -d` does not report any errors - [x] `./mach test-tidy` does not report any errors - [x] These changes fix #22342. - [x] There are tests for these changes

jdm · 2018-12-02T21:20:48Z

There is one hole that I've come up with so far - while the assertion in the Runtime drop implementation catches the point at which a parent runtime is dropped before all of its children are dropped, that only interrupts the thread on which the parent runtime is executing. The threads on which any child runtimes are executing have no signal that their parent runtime is now invalid. The best choice at this point would be to abort the whole program for the sake of safety, but this PR does not do that right now.

src/rust.rs

jdm · 2018-12-21T15:22:27Z

I fixed the racing issues by switching to a single mutex around an enum that represents the engine state. This is ready for review.

jdm · 2018-12-21T15:23:35Z

r? @asajeffrey

asajeffrey

Mostly nits, the main thing is it looks like you're assuming the JSEngine outlives all the JSContexts, but I'm not sure why that should be the case.

asajeffrey · 2018-12-21T16:16:44Z

Cargo.toml

@@ -42,9 +44,9 @@ doctest = false

 [features]
 debugmozjs = ['mozjs_sys/debugmozjs']
-init_once = []


asajeffrey · 2018-12-21T16:16:44Z

Cargo.toml


 [dependencies]
+integer-atomics = "1"


Why do we need this? Can we use AtomicUsize rather than AtomicU32?

src/rust.rs

asajeffrey · 2018-12-21T16:16:44Z

src/rust.rs

+impl Drop for JSEngine {
+    fn drop(&mut self) {
+        *ENGINE_STATE.lock().unwrap() = EngineState::ShutDown;
+        unsafe {


Check to see what the current state is before calling shutdown?

asajeffrey · 2018-12-21T16:16:44Z

src/rust.rs

+/// runtime can be dropped.
+pub struct ParentRuntime {
+    parent: *mut JSRuntime,
+    count: Arc<AtomicU32>,


Say what this is counting?

Also, looking through the code it looks like the counter is incremented when the arc is cloned, and decremented when the arc is dropped, so the counter is always the same as the refcount. This makes me suspect that there's a simplification, where ParentRuntime just contains an Arc<JSEngine> or some such.

asajeffrey · 2018-12-21T16:16:44Z

src/rust.rs

+    /// Unsafety:
+    /// If panicking does not abort the program, any threads with child runtimes will
+    /// continue executing after the thread with the parent runtime panics, but they
+    /// will be in an invalid and undefined state.


Hmm, this might be an issue for Servo when we do crash reporting? Not sure what we can do though, other than not put any JS on our crash reporting page and hope for the best.

jdm · 2019-01-14T20:28:10Z

@asajeffrey Review comments addressed. I've added more comments around the adjusted refcounting bits to hopefully make clear why it looks weird.

asajeffrey · 2019-01-14T20:37:12Z

LGTM. Squash and r=me?

jdm · 2019-01-14T20:39:01Z

@bors-servo r=asajeffrey

bors-servo · 2019-01-14T20:39:02Z

📌 Commit 5e3c3ba has been approved by asajeffrey

bors-servo · 2019-01-14T20:39:05Z

⌛ Testing commit 5e3c3ba with merge 35193f1...


        Auto merge of #450 - jdm:parent-refactor, r=asajeffrey

Make runtime creation safe The fundamental problem exposed in servo/servo#22342 is that our concept of a parent runtime did not match reality. Using the first JSContext's runtime as the global parent for all subsequent contexts only makes sense if that JSContext outlives every other context. This is not guaranteed, leading to crashes when trying to use those contexts if the first context (and therefore its runtime) was destroyed. The new design incorporates several changes for safer, more clear context and runtime management: * in order to create a new context, either a handle to an initialized JS engine is required or a handle to an existing runtime * all runtimes track outstanding handles that have been created, and assert if a runtime is destroyed before all of its child runtimes * overall initialization and shutdown of the engine is controlled by the lifetime of a JSEngine value, so creating a Runtime value is now infallible  --- This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/rust-mozjs/450)


        Separate parent runtime, engine initialization, engine shutdown, and …

…runtime creation concepts.


        Increase minor version for new runtime creation APIs.

jdm · 2019-01-14T21:33:40Z

@bors-servo r=asajeffrey

bors-servo · 2019-01-14T21:33:40Z

📌 Commit 981e266 has been approved by asajeffrey

bors-servo · 2019-01-14T21:33:46Z

⌛ Testing commit 981e266 with merge 7811094...


        Auto merge of #450 - jdm:parent-refactor, r=asajeffrey

Make runtime creation safe The fundamental problem exposed in servo/servo#22342 is that our concept of a parent runtime did not match reality. Using the first JSContext's runtime as the global parent for all subsequent contexts only makes sense if that JSContext outlives every other context. This is not guaranteed, leading to crashes when trying to use those contexts if the first context (and therefore its runtime) was destroyed. The new design incorporates several changes for safer, more clear context and runtime management: * in order to create a new context, either a handle to an initialized JS engine is required or a handle to an existing runtime * all runtimes track outstanding handles that have been created, and assert if a runtime is destroyed before all of its child runtimes * overall initialization and shutdown of the engine is controlled by the lifetime of a JSEngine value, so creating a Runtime value is now infallible  --- This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/rust-mozjs/450)

bors-servo · 2019-01-14T23:00:36Z

☀️ Test successful - checks-travis, status-appveyor
Approved by: asajeffrey
Pushing 7811094 to master...


        Auto merge of #22353 - jdm:runtime-parent, r=nox

Update rust-mozjs These changes adjust our uses of the rust-mozjs APIs to accommodate the changes in servo/rust-mozjs#450. --- - [x] `./mach build -d` does not report any errors - [x] `./mach test-tidy` does not report any errors - [x] These changes fix #22342. - [x] There are tests for these changes  --- This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/22353)

jdm mentioned this pull request Dec 2, 2018

Update rust-mozjs servo/servo#22353

Merged

4 of 4 tasks complete

jdm force-pushed the jdm:parent-refactor branch from bdd6e09 to d0a6288 Dec 2, 2018

jdm force-pushed the jdm:parent-refactor branch 2 times, most recently from 5c26260 to ac7f350 Dec 2, 2018

emilio reviewed Dec 2, 2018

View changes

src/rust.rs Show resolved Hide resolved

jdm force-pushed the jdm:parent-refactor branch from ac7f350 to 69cfd4a Dec 3, 2018

jdm force-pushed the jdm:parent-refactor branch 2 times, most recently from d10b181 to 6e9cc73 Dec 21, 2018

asajeffrey reviewed Dec 21, 2018

View changes

jdm mentioned this pull request Dec 21, 2018

Add some tests for default-initialized roots #411

Closed

jdm force-pushed the jdm:parent-refactor branch from 60ab9de to 5e3c3ba Jan 14, 2019

jdm force-pushed the jdm:parent-refactor branch from 5e3c3ba to 3e1ef3c Jan 14, 2019

jdm added 2 commits Dec 2, 2018

Separate parent runtime, engine initialization, engine shutdown, and …

59fce55

…runtime creation concepts.

Increase minor version for new runtime creation APIs.

Loading status checks…

981e266

jdm force-pushed the jdm:parent-refactor branch from 3e1ef3c to 981e266 Jan 14, 2019

servo / rust-mozjs

Make runtime creation safe #450

Make runtime creation safe #450

jdm commented Dec 2, 2018 •

edited by larsbergstrom

jdm commented Dec 2, 2018

jdm commented Dec 21, 2018

jdm commented Dec 21, 2018

asajeffrey left a comment

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

jdm commented Jan 14, 2019

asajeffrey commented Jan 14, 2019

jdm commented Jan 14, 2019

bors-servo commented Jan 14, 2019

bors-servo commented Jan 14, 2019

jdm commented Jan 14, 2019

bors-servo commented Jan 14, 2019

bors-servo commented Jan 14, 2019

bors-servo commented Jan 14, 2019

servo / rust-mozjs

Join GitHub today

Make runtime creation safe #450

Make runtime creation safe #450

Conversation

jdm commented Dec 2, 2018 • edited by larsbergstrom

jdm commented Dec 2, 2018

jdm commented Dec 21, 2018

jdm commented Dec 21, 2018

asajeffrey left a comment

This comment has been minimized.

asajeffrey Dec 21, 2018

This comment has been minimized.

asajeffrey Dec 21, 2018

This comment has been minimized.

asajeffrey Dec 21, 2018

This comment has been minimized.

asajeffrey Dec 21, 2018

This comment has been minimized.

asajeffrey Dec 21, 2018

This comment has been minimized.

asajeffrey Dec 21, 2018

jdm commented Jan 14, 2019

asajeffrey commented Jan 14, 2019

jdm commented Jan 14, 2019

bors-servo commented Jan 14, 2019

bors-servo commented Jan 14, 2019

jdm commented Jan 14, 2019

bors-servo commented Jan 14, 2019

bors-servo commented Jan 14, 2019

bors-servo commented Jan 14, 2019

jdm commented Dec 2, 2018 •

edited by larsbergstrom