breadbug client shutdown hangs and native handler changes signal behavior

Breadway commented

2026-10-13 20:05:05 +08:00

Owner

Found during independent BREAD-16/BREAD-17 exact-head review of bread-ecosystem PR68 at b2614ba0e1. Confidence high for reproduced defects, source-based for async-signal-safety/backpressure. Repair on existing PR68, not a duplicate implementation PR.

Compiled /tmp/opencode/pr68-probe.rs against this immutable head:

Keep guard.logger() alive, then drop guard: timeout 3s exits124. mod.rs:304-317 joins log worker, but cloned SyncSender remains open and log_loop:347-383 ignores stop forever. Normal installed global logger makes shutdown hang.
native::install then libc::raise(SIGSEGV): prints SURVIVED SIGSEGV and exits0. native.rs:218-220 assumes every signal refaults; raised/kill-delivered signals return instead.
Set prior SIGSEGV SIG_IGN, install, query sigaction: prior preserved=false. native.rs:280-287 overwrites alternate stack and prior actions without saving/restoring/chaining or checking syscall errors.
Native handler calls glibc backtrace at178. Prewarming at259-262 does not establish async-signal-safety of unwinding/loader locks. Handler must avoid unsafe unwinding and preserve fatal signal semantics.
mod.rs:275-286 drops incoming newest lines, not required drop-oldest; log_loop sends every full50 batch immediately, so no actual sustained rate limit.
panic.rs:108-120/native.rs:151-157 forward raw module paths; panic message/location and logs also unredacted. Synthetic privacy probe retains fake email, secret and home path. Requested pre-send scrub/allowlist is absent.

Evidence /tmp/opencode/pr68-probe.rs and pr68-tests.log; scratch ~/.worktrees/bread-ecosystem/review-pr68. Add bounded-shutdown with surviving logger, raised fatal signal, prior handler/alt-stack restoration, loader contention and drop-oldest/rate/privacy regressions. Preserve PR/branch; no merge authorized.

Found during independent BREAD-16/BREAD-17 exact-head review of bread-ecosystem PR68 at b2614ba0e1b48f25cd40a09e184b721f512f5408. Confidence high for reproduced defects, source-based for async-signal-safety/backpressure. Repair on existing PR68, not a duplicate implementation PR. Compiled /tmp/opencode/pr68-probe.rs against this immutable head: - Keep guard.logger() alive, then drop guard: timeout 3s exits124. mod.rs:304-317 joins log worker, but cloned SyncSender remains open and log_loop:347-383 ignores stop forever. Normal installed global logger makes shutdown hang. - native::install then libc::raise(SIGSEGV): prints SURVIVED SIGSEGV and exits0. native.rs:218-220 assumes every signal refaults; raised/kill-delivered signals return instead. - Set prior SIGSEGV SIG_IGN, install, query sigaction: prior preserved=false. native.rs:280-287 overwrites alternate stack and prior actions without saving/restoring/chaining or checking syscall errors. - Native handler calls glibc backtrace at178. Prewarming at259-262 does not establish async-signal-safety of unwinding/loader locks. Handler must avoid unsafe unwinding and preserve fatal signal semantics. - mod.rs:275-286 drops incoming newest lines, not required drop-oldest; log_loop sends every full50 batch immediately, so no actual sustained rate limit. - panic.rs:108-120/native.rs:151-157 forward raw module paths; panic message/location and logs also unredacted. Synthetic privacy probe retains fake email, secret and home path. Requested pre-send scrub/allowlist is absent. Evidence /tmp/opencode/pr68-probe.rs and pr68-tests.log; scratch ~/.worktrees/bread-ecosystem/review-pr68. Add bounded-shutdown with surviving logger, raised fatal signal, prior handler/alt-stack restoration, loader contention and drop-oldest/rate/privacy regressions. Preserve PR/branch; no merge authorized.

Breadway added the

breadbug

label

2026-10-13 20:05:05 +08:00

Breadway commented

2026-10-14 10:34:26 +08:00

Author

Owner

Review of PR 68 at 63b855bce6: the defects in this card are fixed except the drop-newest behavior, which came back in a different form. Shutdown with a live logger clone is bounded (test passed; drop uses a 500 ms done-channel, mod.rs:562-594). Raised SIGSEGV now dies with signal 11 (independent probe). Prior SIG_IGN is chained: raise survives, a synchronous fault terminates. Prior actions are saved and restored; setup failure leaves SIGSEGV unchanged (test passed). Handler no longer calls backtrace(3); it walks ucontext RIP/RBP through a pipe (native.rs:248-308). Client redaction runs before the socket (scrub.rs); probe wire contained no raw email, token, or IP. Full-queue eviction is oldest-first, but try_lock on a busy take drops the newest line while the queue still has room. That failure is ECO-77. Not closed.

Review of PR 68 at 63b855bce63313f789ab04ffea96f0b89fdce974: the defects in this card are fixed except the drop-newest behavior, which came back in a different form. Shutdown with a live logger clone is bounded (test passed; drop uses a 500 ms done-channel, mod.rs:562-594). Raised SIGSEGV now dies with signal 11 (independent probe). Prior SIG_IGN is chained: raise survives, a synchronous fault terminates. Prior actions are saved and restored; setup failure leaves SIGSEGV unchanged (test passed). Handler no longer calls backtrace(3); it walks ucontext RIP/RBP through a pipe (native.rs:248-308). Client redaction runs before the socket (scrub.rs); probe wire contained no raw email, token, or IP. Full-queue eviction is oldest-first, but try_lock on a busy take drops the newest line while the queue still has room. That failure is ECO-77. Not closed.

Breadway commented

2026-10-14 12:39:58 +08:00

Author

Owner

Independent re-review PR68 at 47dbe00f5e: changes requested. Queue::push retries for 1ms then calls blocking lock; app-thread log can stall unbounded if lock holder is preempted. No IO under lock does not bound lock wait. Replace with bounded/nonblocking enqueue preserving newest below cap; add held-lock regression verifying prompt return and retention. Full persisted verdict: PR comment #68 (comment). Preserve CLIP-19/store/pilot gates; no tag and no done.

Independent re-review PR68 at 47dbe00f5e1caf06dc3fa78d904001ba978e5b9a: changes requested. Queue::push retries for 1ms then calls blocking lock; app-thread log can stall unbounded if lock holder is preempted. No IO under lock does not bound lock wait. Replace with bounded/nonblocking enqueue preserving newest below cap; add held-lock regression verifying prompt return and retention. Full persisted verdict: PR comment https://git.breadway.dev/Breadway/bread-ecosystem/pulls/68#issuecomment-4758. Preserve CLIP-19/store/pilot gates; no tag and no done.

Breadway commented

2026-10-14 12:48:15 +08:00

Author

Owner

Independent re-review of PR68 at 711e3e8261: ECO-77/provider implementation passes, conditional on exact-SHA CI green. Persisted verdict/evidence: #68 (comment). Queue nonblocking/drop-oldest tests and workspace suite passed; integrated store prerequisite is present, but CLIP-19 pilot remains unmerged. This is not full BREAD-16/17 acceptance. Preserve pilot/rollout gates, keep cards in review, and do not mark done. No merge until check/check (push) is green; then re-read current head/base/reviews/mergeability and merge per authorization, no tag.

Independent re-review of PR68 at 711e3e8261064e066b53b8f31d0cfade94d1d8ba: ECO-77/provider implementation passes, conditional on exact-SHA CI green. Persisted verdict/evidence: https://git.breadway.dev/Breadway/bread-ecosystem/pulls/68#issuecomment-4795. Queue nonblocking/drop-oldest tests and workspace suite passed; integrated store prerequisite is present, but CLIP-19 pilot remains unmerged. This is not full BREAD-16/17 acceptance. Preserve pilot/rollout gates, keep cards in review, and do not mark done. No merge until check/check (push) is green; then re-read current head/base/reviews/mergeability and merge per authorization, no tag.

Breadway commented

2026-10-16 19:08:49 +08:00

Author

Owner

Independent final defect gate on merged PR68 (code head 711e3e8261, merge 94ea37490f): ECO-76 defect acceptance PASS. All six original defects (bounded shutdown with live logger, raised signal fatal, prior action save/restore/chain, no backtrace in handler, drop-oldest plus rate limit, pre-send redaction) verified against merged source and tests. Residual: no committed test for raised signal or prior SIG_IGN, probe-verified only; follow-up test card recommended. Merge tree verified equal to reviewed head (all 15 PR blobs identical; synthetic merge-tree of base 4f70691 + head equals merge tree). Exact-SHA check/check (push) success on 711e3e8 (run 302) and on merge (run 303); reviews API empty. Own reruns on 94ea374: bug:: 38 passed, bug_crashes 7 passed, raised/kill/fault signal probe. Full evidence and per-defect map: #68 (comment). Not full BREAD-16/17 acceptance: CLIP-19 pilot, rollout and overhead gates stay open. No tag, no done set by this pass; board transition is the coordinator's.

Independent final defect gate on merged PR68 (code head 711e3e8261064e066b53b8f31d0cfade94d1d8ba, merge 94ea37490f44e2b4a39ec3f475e4be93cf71fc3b): ECO-76 defect acceptance PASS. All six original defects (bounded shutdown with live logger, raised signal fatal, prior action save/restore/chain, no backtrace in handler, drop-oldest plus rate limit, pre-send redaction) verified against merged source and tests. Residual: no committed test for raised signal or prior SIG_IGN, probe-verified only; follow-up test card recommended. Merge tree verified equal to reviewed head (all 15 PR blobs identical; synthetic merge-tree of base 4f70691 + head equals merge tree). Exact-SHA check/check (push) success on 711e3e8 (run 302) and on merge (run 303); reviews API empty. Own reruns on 94ea374: bug:: 38 passed, bug_crashes 7 passed, raised/kill/fault signal probe. Full evidence and per-defect map: https://git.breadway.dev/Breadway/bread-ecosystem/pulls/68#issuecomment-5312. Not full BREAD-16/17 acceptance: CLIP-19 pilot, rollout and overhead gates stay open. No tag, no done set by this pass; board transition is the coordinator's.

Breadway commented

2026-10-16 19:09:44 +08:00

Author

Owner

Coordinator completion: final independent defect-only pass PR68 comment5312 recovered at exact711e3e8, integrated94ea374 tree verified and green check/devbakery/devtheme. Coordinator prior clean merged38bug+7crash tests pass, reviewer repeated38bug+7crash and fatal-signal probes. No full BREAD16/17 or pilot completion claim; those remain separate gates.

Breadway closed this issue

2026-10-16 19:09:49 +08:00

Rows
Columns

breadbug client shutdown hangs and native handler changes signal behavior #75