parallel: a panicking `windows` body on a helper worker must not hang the join

orion commented

2026-10-09 07:25:05 +00:00

Collaborator

Goal

A panic in a windows body on a helper worker must not hang the join: today the owner of the region spins in torb_region_join forever.

Context

Split out of #253 (follow-up of #4 / PR #248, merged as f9b867d0, disclosed there). Located on main:

std/parallel/src/lib.trb windowsTaken claims a window (claimWindow), runs body, then calls finishWindow. A panic in body skips finishWindow.
runtime/task.c torb_region_join waits until finished >= next. A claimed window that never finishes keeps finished < next, so the join yields in a loop without end.
Under the recovering test harness (torb_resume_recovered / torb_task_panicked, runtime/task.c ~1050-1095) a helper that panics is completed as cancelled and its frames are gone, so nothing ever finishes its window. Outside a test the panic ends the process, so only the harness case hangs. A panic in the owner's own windowsTaken unwinds past joinRegion and leaks the region slot (no hang, but helpers keep running against a region nobody joins).

Design (decide in the PR, runtime only)

Account the in-flight claim to the task that holds it: torb_region_claim records the claiming task/worker in the region, and torb_task_panicked calls a new torb_region_abandon(task) that counts the window as finished (and the owner side of a recovered panic closes the region), so the join ends and the test reports the panic as its failure. No new native and no signature change: claimWindow, finishWindow, joinRegion stay as declared in std/parallel/src/lib.trb.

Acceptance criteria

A panic in a windows body on a helper worker ends the join; the test fails with the body's panic message instead of hanging (runtime/tests/pool_test.c: region_helper_panic_ends_join, with a timeout guard so a regression fails and does not hang CI).
A panic in the owner's own windows leaves the region slot reusable: a following windows call in the same test run works (region_owner_panic_frees_slot).
Windows that completed before the panic keep their writes; no double finished count when a task panics after finishWindow (region_panic_after_finish_counts_once).
Tier A and B green.

Dependencies

#4 (PR #248) is merged; none open. Independent of the generation-check issue.

Seed

None. Runtime-only change in runtime/task.c; no syntax, no new native, no std name looked up by the compiler.

Risk

Medium-low. Touches the panic path of the pool, which runs only under a test harness. The accounting must not double-count a window (join would end early while a body still writes). Keep the abandon under the region lock.

## Goal A panic in a `windows` body on a helper worker must not hang the join: today the owner of the region spins in `torb_region_join` forever. ## Context Split out of #253 (follow-up of #4 / PR #248, merged as f9b867d0, disclosed there). Located on `main`: - `std/parallel/src/lib.trb` `windowsTaken` claims a window (`claimWindow`), runs `body`, then calls `finishWindow`. A panic in `body` skips `finishWindow`. - `runtime/task.c` `torb_region_join` waits until `finished >= next`. A claimed window that never finishes keeps `finished < next`, so the join yields in a loop without end. - Under the recovering test harness (`torb_resume_recovered` / `torb_task_panicked`, `runtime/task.c` ~1050-1095) a helper that panics is completed as cancelled and its frames are gone, so nothing ever finishes its window. Outside a test the panic ends the process, so only the harness case hangs. A panic in the owner's own `windowsTaken` unwinds past `joinRegion` and leaks the region slot (no hang, but helpers keep running against a region nobody joins). ## Design (decide in the PR, runtime only) Account the in-flight claim to the task that holds it: `torb_region_claim` records the claiming task/worker in the region, and `torb_task_panicked` calls a new `torb_region_abandon(task)` that counts the window as finished (and the owner side of a recovered panic closes the region), so the join ends and the test reports the panic as its failure. No new native and no signature change: `claimWindow`, `finishWindow`, `joinRegion` stay as declared in `std/parallel/src/lib.trb`. ## Acceptance criteria - [ ] A panic in a `windows` body on a helper worker ends the join; the test fails with the body's panic message instead of hanging (`runtime/tests/pool_test.c`: `region_helper_panic_ends_join`, with a timeout guard so a regression fails and does not hang CI). - [ ] A panic in the owner's own windows leaves the region slot reusable: a following `windows` call in the same test run works (`region_owner_panic_frees_slot`). - [ ] Windows that completed before the panic keep their writes; no double `finished` count when a task panics after `finishWindow` (`region_panic_after_finish_counts_once`). - [ ] Tier A and B green. ## Dependencies #4 (PR #248) is merged; none open. Independent of the generation-check issue. ## Seed None. Runtime-only change in `runtime/task.c`; no syntax, no new native, no std name looked up by the compiler. ## Risk Medium-low. Touches the panic path of the pool, which runs only under a test harness. The accounting must not double-count a window (join would end early while a body still writes). Keep the abandon under the region lock.

orion added the

loop

label

2026-10-09 07:25:05 +00:00

orion referenced this issue

2026-10-09 07:25:18 +00:00

parallel: check a window handle's generation in torb_region_get/set #253

orion added the

ready

label

2026-10-09 07:25:18 +00:00

orion referenced this issue

2026-10-09 07:25:18 +00:00

parallel: check a window handle's generation in torb_region_get/set #253

orion commented

2026-10-09 07:25:18 +00:00

Author

Collaborator

[loop:torbscript] refine: both problems located on main by reading runtime/task.c and std/parallel. Generation check missing in torb_region_get/set (this issue); panic in a helper body skips finishWindow so torb_region_join spins forever (split into #258). Seed impact: none for both (runtime only). Criteria, tests, risk in the body. next: ready

orion referenced this issue

2026-10-09 07:54:25 +00:00

parallel: check a window handle's generation in torb_region_get/set #253

orion commented

2026-10-09 07:54:25 +00:00

Author

Collaborator

[loop:torbscript] claim implement by session:loop-torbscript-20261009 until 2026-10-09T13:55Z

orion referenced this issue from a commit

2026-10-09 08:04:39 +00:00

fix(runtime): a recovered panic in a window of `windows` ends the join

orion referenced this issue from a pull request that will close it,

2026-10-09 08:04:45 +00:00

fix(runtime): a recovered panic in a window of windows ends the join #260

argus closed this issue

2026-10-09 09:03:24 +00:00

argus referenced this issue from a commit

2026-10-09 09:03:25 +00:00

fix(runtime): a recovered panic in a window of `windows` ends the join

orion commented

2026-10-09 09:04:24 +00:00

Author

Collaborator

[loop:torbscript] close: PR #260 (a recovered panic in a window of windows ends the join) approved and merged by argus (merge commit f717f823), issue closed. Claim released.

[loop:torbscript] close: PR #260 (a recovered panic in a window of `windows` ends the join) approved and merged by argus (merge commit f717f823), issue closed. Claim released.

orion referenced this issue

2026-10-23 23:53:58 +00:00

windows: check the region generation in get/set, and survive a panic on a helper under a recovering harness #254

orion referenced this issue

2026-10-27 00:10:42 +00:00

language: a panic that ends its task, not the process (WEB F9) #107