lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(controller): a worker join that fails its commit barrier leaves nothing bound (bug-1728)

Browse source 
"ERROR incorrect worker idx -1" on every node after a worker-join commit
timeout (during a PreVote/election) was the visible end of a real
dangling pointer. init_worker/rejoin_worker bind the endpoint to the
worker (apply_join_state: w->ep = ep, UNAVAIL cleared) before the commit
barrier; on barrier failure handle_worker_join returned without setting
priv->u.idx, so when that connection closed handle_endpoint_error saw
idx -1, logged the ERROR and never ran handle_worker_leave -- the worker
kept w->ep pointing at the freed endpoint, available for dispatch, until
it rejoined.

- handle_worker_join: on barrier failure, clear w->ep (if still this
  endpoint) and mark the worker unavailable, as if the join never
  happened; the worker retries its join.
- handle_endpoint_error: an idx -1 worker endpoint is now the legitimate
  "closed before its join completed" case -- WARN, nothing to clean up.

test_worker_join_withheld_acks_replies_error also asserts the worker is
unbound and unavailable after the -ETIMEDOUT reply (RED before).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-09-27 05:48:49 +00:00
parent 7aac018c00
commit 33c4f28c6a
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
3 changed files with 39 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/controller/cluster.c
View file

@ -73,7 +73,12 @@ static void handle_endpoint_error(endpoint_t* ep)
if (priv->u.idx >= 0) {
handle_worker_leave(c, priv->u.idx);
} else {
ERROR("incorrect worker idx %d", priv->u.idx);
/* bug-1728: a worker connection whose join never completed
* (e.g. its commit barrier timed out during an election)
* has nothing bound to it -- handle_worker_join undoes the
* binding on failure -- so there is nothing to clean up. */
WARN("worker endpoint %p closed before its join completed",
ep);
}
break;
case HostRole_scheduler: