pgbus 0.12.3 → 0.13.0

data/lib/pgbus/web/streamer/listener.rb

@@ -15,7 +15,12 @@ module Pgbus
       #     only running `wait_for_notify` — all LISTEN/UNLISTEN SQL goes
       #     through a command queue that the listener thread drains between
       #     notifies
-      #   - #stop joins the thread cleanly
+      #   - #stop clears @running and joins; it never touches the connection
+      #   - the connection is SINGLE-OWNER: the listener thread is the only
+      #     thread that may exec, wait, or close on it, from construction
+      #     through teardown. PG::Connection is not thread-safe and #close is
+      #     PQfinish — freeing the PGconn under a concurrent libpq call is a
+      #     process-killing SEGV, not a rescuable PG::Error (issue #375)
       #
       # Health check: `wait_for_notify(timeout)` returns nil on timeout. When
       # it does, the listener runs `SELECT 1` as a TCP keepalive. If that
@@ -41,6 +46,10 @@ module Pgbus
 
         RECONNECT_BACKOFF_SECONDS = 0.5
 
+        # Grace added to one health-check cycle when #stop joins the listener
+        # thread. See #stop_join_timeout.
+        STOP_JOIN_GRACE_SECONDS = 5
+
         attr_reader :listening_to
 
         # @param connection_factory [#call] builds a FRESH PG connection on each
@@ -98,18 +107,16 @@ module Pgbus
 
           @running = false
           @commands << [:stop]
-          # Interrupt the blocking wait_for_notify by closing the PG
-          # connection. Without this, the listener thread would sit
-          # inside wait_for_notify until a NOTIFY arrived, which may
-          # never happen. Closing the socket raises PG::Error inside
-          # wait_for_notify; our rescue clause sees @running == false
-          # on the next iteration and exits cleanly.
-          begin
-            @conn.close if @conn.respond_to?(:close)
-          rescue StandardError
-            # best effort — connection may already be gone
-          end
-          @thread&.join(5)
+          # Deliberately does NOT touch @conn. PG::Connection is not
+          # thread-safe and #close is PQfinish: it frees the PGconn and its
+          # OpenSSL objects out from under whatever libpq call the listener
+          # thread is making on the same connection. That is a use-after-free —
+          # a process-killing SEGV, not a rescuable PG::Error (issue #375).
+          # The listener thread is the sole owner of @conn and closes it in
+          # run_loop's ensure; clearing @running above is the whole stop signal.
+          # It is observed within one wait_for_notify timeout (health_check_ms),
+          # which is what the join budget below is sized against.
+          @thread&.join(stop_join_timeout)
           @thread = nil
           self
         end
@@ -148,13 +155,18 @@ module Pgbus
 
             timeout_s = @health_check_ms / 1000.0
             begin
-              @conn.wait_for_notify(timeout_s) do |channel, _pid, payload|
+              got_notify = @conn.wait_for_notify(timeout_s) do |channel, _pid, payload|
                 handle_notify(channel, payload)
-              end || run_health_check
+              end
+              # Skip the keepalive when a stop landed during the wait: the loop
+              # is about to exit and close this connection anyway, so the
+              # round-trip would only add latency to shutdown.
+              run_health_check if !got_notify && @running
             rescue IOError => e
-              # #stop closes the PG connection to interrupt
-              # wait_for_notify, which raises IOError ("stream closed
-              # in another thread"). This is expected — exit cleanly.
+              # #stop no longer closes the connection to interrupt the wait
+              # (issue #375), so an IOError here is a genuine socket failure,
+              # not the expected shutdown signal. Reconnect unless we're
+              # stopping, in which case exit cleanly.
               break unless @running
 
               @logger.warn { "[Pgbus::Streamer::Listener] IO error (#{e.class}: #{e.message}) — reconnecting" }
@@ -167,7 +179,15 @@ module Pgbus
             end
           end
         ensure
-          safe_unlisten_all
+          # Bookkeeping only — no UNLISTEN round-trip. We close the connection
+          # on the next line and closing the session deregisters every LISTEN
+          # server-side, so the exec bought nothing while being the statement
+          # that raced #stop's PQfinish into a SEGV (issue #375).
+          @listening_to.clear
+          # The listener thread owns this connection, so the listener thread is
+          # the one that closes it — #stop only clears @running.
+          close_quietly(@conn)
+          @conn = nil
         end
 
         def drain_commands
@@ -204,6 +224,16 @@ module Pgbus
           (@health_check_ms / 1000.0) + 1.0
         end
 
+        # How long #stop waits for the listener thread to notice the cleared
+        # @running and finish teardown. The thread can be parked in
+        # wait_for_notify for one full health-check cycle before it re-checks
+        # the flag, so the budget is that cycle plus grace — a flat timeout
+        # would expire before a listener with a large health_check_ms had even
+        # one chance to observe the stop.
+        def stop_join_timeout
+          (@health_check_ms / 1000.0) + STOP_JOIN_GRACE_SECONDS
+        end
+
         def do_listen(queue_name)
           channel = channel_for(queue_name)
           return if @listening_to.include?(channel)
@@ -322,17 +352,6 @@ module Pgbus
           nil
         end
 
-        def safe_unlisten_all
-          @listening_to.each do |channel|
-            # @conn may be nil if #stop interrupted the reconnect loop between
-            # closing the old connection and publishing a new one.
-            @conn&.exec(%(UNLISTEN "#{channel}"))
-          rescue PG::Error
-            # connection may be dead; nothing we can do
-          end
-          @listening_to.clear
-        end
-
         def channel_for(queue_name)
           "#{CHANNEL_PREFIX}#{queue_name}#{CHANNEL_SUFFIX}"
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pgbus
 version: !ruby/object:Gem::Version
-  version: 0.12.3
+  version: 0.13.0
 platform: ruby
 authors:
 - Mikael Henriksson
@@ -328,13 +328,16 @@ files:
 - lib/pgbus/process/heartbeat.rb
 - lib/pgbus/process/lifecycle.rb
 - lib/pgbus/process/memory_usage.rb
+- lib/pgbus/process/notify_hub.rb
 - lib/pgbus/process/notify_listener.rb
 - lib/pgbus/process/notify_probe.rb
 - lib/pgbus/process/primary_validator.rb
 - lib/pgbus/process/queue_lock.rb
 - lib/pgbus/process/signal_handler.rb
 - lib/pgbus/process/supervisor.rb
+- lib/pgbus/process/wake_pipe.rb
 - lib/pgbus/process/wake_signal.rb
+- lib/pgbus/process/wildcard_queue_resolver.rb
 - lib/pgbus/process/worker.rb
 - lib/pgbus/queue_factory.rb
 - lib/pgbus/queue_name_validator.rb