rusty_racer 0.2.1 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 074b269481c924fc8e99f129e361d29fb4847c9c91ac4afee96378721fe9eebd
-  data.tar.gz: 68b312cba649752c393c0736e10efd8280f87ae0406ef7826b8d9fe3ec5505ce
+  metadata.gz: 9a799692e0bcc6c18bbba590786cd92b0f3cd5c05c65be4da085ec3a739ae2ee
+  data.tar.gz: 0ca41e25987f9f721437abbfc1278c43d7aa688c996a1824cb342d4b1672ed70
 SHA512:
-  metadata.gz: c3ff8f690a9ad98912f2328d7be4bc10c3d1f38499365f628fbe4dac5e782832323bfc86976ac05fbe9406f288b75191fac11f1eb4f920d1caae056561d0eceb
-  data.tar.gz: a13dad93b256b9f15eef3baa27e79a97e2d7da61ec20c29aefc66907cd1cef4916fb0c84d65742233d182d48fed1fa369b48e86105bba7fede8a6afdaa008133
+  metadata.gz: c63a41df38fbacdfc440a4bb61ff8f780315d2ce267a55d698505a7601557ba76a3762896dd12a4989aaf34d27ba2a7eb9c751a7249e7a71ae572a37d5af6133
+  data.tar.gz: e8deb0c3a86b25577996ee84d15f2163f6a2a8eab952d3c8592e4513f6e2cb483f3734ec7947dff22bad19cea9c5239284edd910473058baea5761921c510b8f

data/README.md

@@ -258,7 +258,12 @@ to one native thread (rusty_v8 exposes no `v8::Locker`), so using it from anothe
 thread raises `RustyRacer::WrongThreadError` rather than corrupting the VM.
 
 - **`Isolate#terminate` is the one exception** — it is safe to call from any
-  thread (it stops a runaway script on the owner thread).
+  thread (it stops a runaway script on the owner thread). It stops JavaScript at
+  V8's next interrupt check, which a runaway script reaches almost immediately
+  and a *short* one may never reach: terminating from inside a host function that
+  then returns to a script which simply finishes lets that script finish, and the
+  request is dropped rather than carried into the next operation. Use it to stop
+  code that is running away, not as a way to fail the call you are inside.
 - **Dispose on the owner thread.** `Isolate#dispose` must run on the owner
   thread. If the last reference to an isolate is instead garbage-collected on a
   *different* thread (e.g. its owner thread already exited), it cannot be
@@ -290,6 +295,80 @@ process on the next GC or thrown exception. So **don't call into an isolate from
 inside a Fiber on a worker thread**; drive isolate ops directly on the thread, or
 keep Fiber/Enumerator-mediated JS calls on the main thread.
 
+The other limit is on *where* a Fiber may switch. Operations on one isolate have
+to nest: everything V8 keeps per isolate — the frame chain, the handle scopes,
+the description of the stack — unwinds in the reverse of the order it was
+entered. Resuming a Fiber from inside a host function keeps that (the outer
+operation is simply blocked until the inner one returns, which is why
+`Capybara::Result#find` inside a callback works), but **yielding out of a host
+function** does not: it strands that operation mid-flight. That covers
+`Fiber.yield` and `Fiber#transfer`, an `Enumerator::Yielder#<<` from inside a
+callback, and any blocking call made under a Fiber scheduler (`async`, `falcon`),
+which yields out of the Fiber for you — the last of those without a `Fiber`
+keyword anywhere in your code.
+
+What happens next depends on what the stranded operation's Fiber does:
+
+- **Resumed while another operation is still running** — the two can now only
+  finish in the order they started, which V8 has no room for. There is no
+  exception to raise: raising *is* that unwind. So the binding prints what
+  happened, which host function did it, and where — then stops the process with
+  `SIGABRT` (exit 134). It is not rescuable and there is no opt-out; on a
+  threaded server that takes the whole worker with it.
+
+  ```
+  [rusty_racer] fatal: operations on this isolate stopped nesting.
+
+  The host function `hop` handed control to Ruby.
+  By the time it came back, the operations in flight on this isolate had
+  changed (now 2, was 1) — so they no longer nest. …
+  ```
+
+- **Resumed only after the other operation has finished** — memory-safe, and it
+  keeps working. But note that *while* an operation is stranded, every other
+  operation on that isolate runs as a **nested** one, and only an outermost
+  operation drains microtasks. So a promise queued in the meantime does not
+  settle until the stranded operation finishes. **This is the shape a Fiber
+  scheduler produces**: it resumes the stranded Fiber once the other fiber's
+  operation is done, so `async`/`falcon` get the quiet variant, not the abort.
+
+- **Never resumed** — Ruby frees an unresumed Fiber's stack without unwinding it,
+  so the operation's frames vanish while the isolate is still entered by them.
+  The isolate cannot be disposed after that; it is leaked, with a warning saying
+  why. If you still hold the Fiber, **`Fiber#kill` recovers it**: it resumes the
+  Fiber to unwind it, so the stranded operation finishes in order and the isolate
+  goes back to normal. The operation itself fails on the way out — see below for
+  why a kill reaches it as an ordinary error.
+
+### Killing a thread or Fiber inside a host function
+
+**A `Thread#kill` or `Fiber#kill` that lands while a host function's Ruby is
+running does not kill it.** It surfaces as `RustyRacer::RuntimeError: Error:
+Fatal` from the `eval`/`call` that was in flight, and the thread keeps going —
+and CRuby has already marked that thread as killed, so **a second `Thread#kill`
+is a no-op**. `Thread#raise` still works, and is the way out if you have to
+reach in from outside.
+
+A kill inside a **module resolver** is quieter still: the specifier it was
+resolving simply fails to link, so the error names the import
+(`failed to resolve module specifier "./dep.js" imported from /app.js`) with no
+mention of a kill at all.
+
+This is not a choice, it is the boundary. Ruby unwinds a kill with `TAG_FATAL`,
+which arrives while V8's C++ frames are on the stack — and a `longjmp` through
+those is not survivable, so the callback has to catch it like any other error.
+Nor can it be put back afterwards: `rb_jump_tag` does not carry the unwind with
+it, it re-enters whatever the VM still holds in `$!`, and anything protected
+that ran in between (one more host function raising is enough) has cleared it.
+Jumping into that is a segfault in the interpreter rather than a late kill. 0.2.2
+shipped an attempt at this and had to be withdrawn in 0.2.3.
+
+So: if you need to stop work that calls into an isolate, **stop it at a Ruby
+boundary you control** — a flag the host function checks, a `Queue` it reads —
+rather than by killing the thread from outside. `Isolate#terminate` stops the
+*JavaScript* (at V8's next interrupt check, see above), which is the other half
+of the same job.
+
 ## Installation
 
 Precompiled gems bundle V8 — no V8 build, no Rust toolchain — for Ruby 3.3, 3.4,

data/ext/rusty_racer/Cargo.toml

@@ -5,7 +5,7 @@
 # links and loads with no custom archive.
 [package]
 name = "rusty_racer"
-version = "0.2.1"
+version = "0.2.3"
 edition = "2024"
 publish = false
 

data/ext/rusty_racer/src/lib.rs

@@ -122,11 +122,14 @@ macro_rules! istate {
 pub(crate) use istate;
 
 // One attach()'d host fn: the realm it was attached into — so resetting or
-// disposing that realm can release the GC root — and the rooted proc itself
-// (None once released; the slot index stays valid as a host_fn_id).
+// disposing that realm can release the GC root — the rooted proc itself (None
+// once released; the slot index stays valid as a host_fn_id), and the name it
+// was attached under, kept only so a diagnostic can say which host function is
+// involved (one String per attach, never per call).
 struct ProcSlot {
     context_id: i32,
     proc: Option<RootedProc>,
+    name: String,
 }
 
 // The isolate's host-fn registry, indexed by host_fn_id. `free` lists slots
@@ -282,6 +285,39 @@ where
     job.r.unwrap()
 }
 
+// What handed control to Ruby. Carried through with_gvl for one reason: when
+// the op nesting breaks, the diagnostic can point at the caller's own code
+// instead of saying "a host function". Rendered only on that path, so an
+// ordinary callback pays for a pointer and nothing else.
+enum RubyCall<'a> {
+    // An attach()'d host function, by host_fn_id — the name it was attached
+    // under lives in the isolate's proc table.
+    HostFn(usize),
+    // A module resolver (a static instantiate block, a dynamic auto-link, or
+    // import()), named by the specifier it was handed.
+    Resolver(&'a str),
+}
+
+impl RubyCall<'_> {
+    fn describe(&self, core: &Core) -> String {
+        match self {
+            // try_lock, not lock: nothing holds this across a callback (call_proc
+            // takes the proc out under the lock and releases it before calling),
+            // but blocking here would turn a diagnostic into a hang.
+            Self::HostFn(id) => match core
+                .procs
+                .try_lock()
+                .ok()
+                .and_then(|procs| procs.slots.get(*id).map(|slot| slot.name.clone()))
+            {
+                Some(name) => format!("The host function `{name}`"),
+                None => "A host function".to_string(),
+            },
+            Self::Resolver(spec) => format!("The module resolver, resolving `{spec}`,"),
+        }
+    }
+}
+
 // The inverse trampoline: REACQUIRE the GVL to run |f| (a Ruby callback), then
 // release it again. Called from inside a V8 host callback / module resolver,
 // which runs GVL-released under the in-thread runner's `without_gvl`; the proc
@@ -289,20 +325,41 @@ where
 // the proc re-enters the runner, releasing the GVL again) is sound. |f| must
 // NOT let a Ruby exception escape as a longjmp — the callers convert proc
 // errors to a Result value and throw on the JS side instead.
-fn with_gvl<F, R>(f: F) -> R
+//
+// This is also the only place where control can leave an operation WITHOUT it
+// finishing: the Ruby we hand it to may switch Fibers, and a yield out of a
+// callback strands this op mid-flight while the resumer goes on to use the
+// isolate again. Everything V8 keeps per isolate nests strictly — the frame
+// chain, the handle scopes, the stack description — so `core.depth` (the ops in
+// flight on this isolate) coming back unchanged is exactly the condition that
+// they still do: every op started while Ruby held control has also finished.
+// Two atomic loads per callback, and a mismatch is fatal — see
+// fatal_nesting_broken. Both loads and the check live INSIDE the trampoline, so
+// they run with the GVL held and on the stranded op's own stack, which is what
+// lets the diagnostic there read a Ruby backtrace without taking the GVL again.
+fn with_gvl<F, R>(core: &Core, call: RubyCall<'_>, f: F) -> R
 where
     F: FnOnce() -> R,
 {
-    struct Job<F, R> {
+    struct Job<'a, F, R> {
+        core: &'a Core,
+        call: RubyCall<'a>,
         f: Option<F>,
         r: Option<R>,
     }
     unsafe extern "C" fn run<F: FnOnce() -> R, R>(data: *mut c_void) -> *mut c_void {
         let job = unsafe { &mut *(data as *mut Job<F, R>) };
+        let entry_depth = job.core.depth.load(Ordering::SeqCst);
         job.r = Some((job.f.take().unwrap())());
+        let exit_depth = job.core.depth.load(Ordering::SeqCst);
+        if exit_depth != entry_depth {
+            fatal_nesting_broken(job.core, &job.call, entry_depth, exit_depth);
+        }
         null_mut()
     }
     let mut job = Job::<F, R> {
+        core,
+        call,
         f: Some(f),
         r: None,
     };
@@ -312,6 +369,101 @@ where
     job.r.unwrap()
 }
 
+// Ruby handed control back to a callback whose operation is no longer the
+// innermost one on its isolate: the Ruby code switched Fibers, and an operation
+// that started later is still running. The two would now have to unwind in the
+// order they were STARTED rather than the reverse, and V8 has no room for that —
+// finishing this one pops its HandleScope out from under the other's live
+// handles, restores a frame chain that still has the other's frames linked into
+// it, and (at depth 0) exits an isolate the other is still running in.
+//
+// None of the gentler endings exist. Reporting it as a Ruby exception IS that
+// unwind, so raising is the corruption, not a report of it. Waiting for the
+// other operation deadlocks: it is blocked on the Fiber this one is standing in.
+// And refusing the second operation before it started was never possible either
+// — "a Fiber resumed from inside a callback" (supported, and common: every
+// Enumerator is a Fiber) and "a Fiber that yielded out of one" leave Ruby in the
+// same observable state, and CRuby exposes no way to tell a resuming Fiber from
+// a suspended one. The difference only shows up here, when control comes back.
+//
+// So the process stops, while the state is still intact and the cause can still
+// be named, rather than letting V8 abort later on `Check failed:
+// IsOnCentralStack()` — or worse, running JavaScript on freed handles. rb_raise
+// and rb_fatal would longjmp through V8's C++ frames, so this doesn't go through
+// Ruby's error path at all.
+fn fatal_nesting_broken(core: &Core, call: &RubyCall<'_>, entry_depth: u32, exit_depth: u32) -> ! {
+    eprintln!(
+        "\n[rusty_racer] fatal: operations on this isolate stopped nesting.\n\
+         \n\
+         {who} handed control to Ruby.\n\
+         By the time it came back, the operations in flight on this isolate had\n\
+         changed (now {exit_depth}, was {entry_depth}) — so they no longer nest. The Ruby code\n\
+         switched Fibers and left this one stranded while the isolate was used\n\
+         again: `Fiber.yield` or `Fiber#transfer` out of the callback, or an\n\
+         `Enumerator::Yielder#<<` from inside it — anything that suspends the\n\
+         callback rather than returning from it.\n\
+         \n\
+         V8 requires the operations on one isolate to unwind in the reverse of the\n\
+         order they started, and that is now impossible: finishing this one would\n\
+         pop its handles out from under the other's. Raising a Ruby exception here\n\
+         would BE that unwind, and waiting is a deadlock — the other operation is\n\
+         blocked on the Fiber this one is standing in. Stopping now, while the\n\
+         state is still intact, is what is left.\n\
+         \n\
+         Resuming a Fiber from inside a callback IS supported, including calling\n\
+         back into the isolate from it. What isn't is yielding OUT of the callback\n\
+         and using the isolate before the Fiber is resumed again — let the Fiber\n\
+         run to completion inside the callback, or finish the operation first.\n\
+         \n\
+         See https://github.com/ursm/rusty_racer#fibers\n",
+        who = call.describe(core),
+    );
+    print_stranded_backtrace();
+    // Put SIGABRT back to the default. Ruby installs a handler for it that prints
+    // a [BUG] report — a Ruby-level backtrace, the loaded features, the whole
+    // memory map — which buries the explanation above under a page of noise that
+    // also reads as "Ruby crashed", which this is not. The process then dies of
+    // SIGABRT (exit 134); whether that leaves a core is the operator's ulimit to
+    // decide, not ours to override.
+    unsafe { libc::signal(libc::SIGABRT, libc::SIG_DFL) };
+    std::process::abort()
+}
+
+// The Ruby frames of the operation whose callback just came back — the one named
+// in the message above, which is usually the stranded one (it regains control
+// first) but is the resumer's if that one got here first. We hold the GVL and are
+// standing on that operation's own stack, so `caller` here is its eval/call. The
+// proc itself has already RETURNED — that return is what got us here — so the
+// yield's own line is not among these frames; naming the callback is what stands
+// in for it. rb_backtrace() would do this in one call, but prints
+// outermost-first, backwards from every backtrace a Ruby reader has seen.
+fn print_stranded_backtrace() {
+    use magnus::rb_sys::FromRawValue;
+    let Ok(raw) = magnus::rb_sys::protect(|| unsafe { rb_sys::rb_make_backtrace() }) else {
+        return;
+    };
+    let frames = magnus::RArray::from_value(unsafe { magnus::Value::from_raw(raw) })
+        .and_then(|a| a.to_vec::<String>().ok())
+        .unwrap_or_default();
+    // Drop the binding's own frames (`_eval` and the `eval` wrapping it, both at
+    // the same line of rusty_racer.rb) so the first line is the caller's. Keep
+    // everything if that would leave nothing to print.
+    let own = |f: &String| f.contains("/rusty_racer.rb:");
+    let user: Vec<&String> = frames.iter().filter(|f| !own(f)).collect();
+    let shown: Vec<&String> = if user.is_empty() {
+        frames.iter().collect()
+    } else {
+        user
+    };
+    if shown.is_empty() {
+        return;
+    }
+    eprintln!("That operation is here:");
+    for (i, frame) in shown.iter().enumerate() {
+        eprintln!("{}{frame}", if i == 0 { "\t" } else { "\tfrom " });
+    }
+}
+
 // Identity of the calling RUBY thread (its Thread VALUE, stable for the thread's
 // life) — used to bind an isolate to its owner thread. Unlike a native ThreadId,
 // this survives Ruby's M:N scheduler moving the thread between native threads.
@@ -381,9 +533,9 @@ fn host_fn_callback(
         throw_js_error(scope, "host function has no owner");
         return;
     }
-    let result: Result<JsVal, String> = with_gvl(|| {
+    let core = unsafe { &*core_ptr };
+    let result: Result<JsVal, String> = with_gvl(core, RubyCall::HostFn(host_fn_id), || {
         let ruby = Ruby::get().unwrap();
-        let core = unsafe { &*core_ptr };
         // rb_protect so a Ruby exception raised during arg/return marshalling
         // (ary_new_capa / jsval_to_ruby / ruby_to_jsval can raise on OOM etc.)
         // is CAUGHT here instead of longjmp-ing through V8's C++ frames. The
@@ -940,6 +1092,7 @@ fn resolve_imported<'s>(
     if core_ptr.is_null() {
         return None;
     }
+    let core = unsafe { &*core_ptr };
     // The static instantiate block parked for THIS op (Some) vs a dynamic
     // import's auto-link (None -> dynamic_import_resolver, with the initiating
     // realm so it can resolve per-realm).
@@ -950,8 +1103,8 @@ fn resolve_imported<'s>(
             // The error conversion happens INSIDE with_gvl: error_to_exception
             // calls into Ruby (so it can allocate, so it can GC) and BoxValue::new
             // registers a GC root — neither is safe with the GVL released.
-            match with_gvl(|| {
-                resolve_module_via_ruby(unsafe { &*core_ptr }, resolve, &spec, &ref_url, None)
+            match with_gvl(core, RubyCall::Resolver(&spec), || {
+                resolve_module_via_ruby(core, resolve, &spec, &ref_url, None)
                     .map_err(|e| error_to_exception(&e).map(BoxValue::new))
             }) {
                 Ok(id) => id,
@@ -965,24 +1118,18 @@ fn resolve_imported<'s>(
             }
         }
         None => {
-            let resolver = unsafe { &*core_ptr }
+            let resolver = core
                 .dynamic_import_resolver
                 .lock()
                 .unwrap()
                 .as_ref()
                 .map(|r| r.get());
             match resolver {
-                Some(p) => match with_gvl(|| {
-                    resolve_module_via_ruby(
-                        unsafe { &*core_ptr },
-                        p,
-                        &spec,
-                        &ref_url,
-                        Some(here.unwrap_or(0)),
-                    )
-                    // Rendering the message reads the Ruby exception, so it too
-                    // stays inside with_gvl.
-                    .map_err(|e| e.to_string())
+                Some(p) => match with_gvl(core, RubyCall::Resolver(&spec), || {
+                    resolve_module_via_ruby(core, p, &spec, &ref_url, Some(here.unwrap_or(0)))
+                        // Rendering the message reads the Ruby exception, so it too
+                        // stays inside with_gvl.
+                        .map_err(|e| e.to_string())
                 }) {
                     Ok(id) => id,
                     // Unlike the static branch there is no Ruby frame waiting to
@@ -1087,7 +1234,8 @@ fn dynamic_import_cb<'s>(
         reject(scope, "dynamic import has no owner");
         return Some(promise);
     }
-    let resolver_proc = unsafe { &*core_ptr }
+    let core = unsafe { &*core_ptr };
+    let resolver_proc = core
         .dynamic_import_resolver
         .lock()
         .unwrap()
@@ -1096,8 +1244,8 @@ fn dynamic_import_cb<'s>(
     let id = match resolver_proc {
         // A raising resolver only fails the import() (it rejects generically);
         // it must NOT abort the surrounding eval, so swallow the Err here.
-        Some(p) => with_gvl(|| {
-            resolve_module_via_ruby(unsafe { &*core_ptr }, p, &spec, &referrer, Some(initiating))
+        Some(p) => with_gvl(core, RubyCall::Resolver(&spec), || {
+            resolve_module_via_ruby(core, p, &spec, &referrer, Some(initiating))
         })
         .unwrap_or(None),
         None => None,
@@ -2290,7 +2438,7 @@ impl Core {
                 &self.installed_stack_limit,
                 stack_top,
             );
-            if depth == 0 {
+            let reply = if depth == 0 {
                 let mut reply = std::panic::catch_unwind(AssertUnwindSafe(|| {
                     v8::scope!(let scope, unsafe { &mut *iso });
                     service_request(scope, request, true)
@@ -2359,15 +2507,38 @@ impl Core {
                     unsafe { (*iso).exit() };
                 }
                 reply
+            };
+            // Everything that has to happen whatever else does goes HERE, inside
+            // the closure, rather than after without_gvl returns:
+            // rb_thread_call_without_gvl checks the thread's pending interrupts as
+            // it re-acquires the GVL, and a Thread#raise, a Timeout, or a Ctrl-C
+            // that lands there longjmps straight past everything written after the
+            // call.
+            //
+            // Balancing the fetch_add is one: a missed decrement is permanent and
+            // silent — the isolate then looks like it has an op in flight for the
+            // rest of its life, so no later op is ever the outermost one
+            // (microtasks stop draining, terminate flags stop being cleared) and
+            // dispose refuses forever. The op is finished by this point: the scope
+            // is dropped and the isolate exited in both branches above.
+            //
+            // Poisoning a panicked isolate is the other: None means the op left V8
+            // possibly inconsistent, and an interrupt arriving on top of that must
+            // not be what decides whether later ops are allowed to touch it. The
+            // raise below still reports it — the lock is safe with the GVL
+            // released, since every other holder takes it briefly and none waits
+            // on an op.
+            if reply.is_none() {
+                self.shared.lock().unwrap().disposed = true;
             }
+            self.depth.fetch_sub(1, Ordering::SeqCst);
+            reply
         });
-        self.depth.fetch_sub(1, Ordering::SeqCst);
         match reply {
             Some(reply) => Ok(reply),
             None => {
-                // The op panicked: V8 may be left inconsistent, so POISON the
-                // isolate (every later op refuses) rather than risk using it.
-                self.shared.lock().unwrap().disposed = true;
+                // The op panicked; the isolate was poisoned inside the closure
+                // above (every later op refuses) rather than risk using it.
                 Err(Error::new(
                     err_class(ruby, "InternalError"),
                     "internal error: operation panicked; the isolate has been disposed",
@@ -2555,6 +2726,7 @@ impl Core {
         let host_fn_id = self.procs.lock().unwrap().alloc(ProcSlot {
             context_id,
             proc: Some(RootedProc(BoxValue::new(proc))),
+            name: name.clone(),
         });
         let reply = self.run(
             ruby,
@@ -2592,6 +2764,7 @@ impl Core {
                     let id = procs.alloc(ProcSlot {
                         context_id,
                         proc: Some(RootedProc(BoxValue::new(proc))),
+                        name: name.clone(),
                     });
                     (name, id)
                 })
@@ -2892,7 +3065,10 @@ impl Core {
             if self.depth.load(Ordering::SeqCst) != 0 {
                 return Err(Error::new(
                     err_class(ruby, "Error"),
-                    "RustyRacer: cannot dispose an isolate from within a running op or host callback",
+                    "RustyRacer: cannot dispose an isolate with an operation still in \
+                     flight — from inside a host callback, or from anywhere at all if a \
+                     host callback yielded out of a Fiber that has not been resumed \
+                     (see https://github.com/ursm/rusty_racer#fibers)",
                 ));
             }
             shared.disposed = true;
@@ -2908,13 +3084,7 @@ impl Drop for Core {
         if self.shared.lock().unwrap().disposed {
             return;
         }
-        if current_ruby_thread() == self.owner {
-            // Last wrapper dropped on the owner thread: full teardown. depth is 0
-            // (a running op holds a wrapper alive, so the last drop can't race
-            // one), and Drop can't raise — so just tear down.
-            self.shared.lock().unwrap().disposed = true;
-            self.teardown();
-        } else {
+        if current_ruby_thread() != self.owner {
             // Foreign-thread GC drop: a thread-bound isolate CANNOT be disposed
             // off its owner thread (that would SEGV) and Drop CANNOT raise — so
             // LEAK the OwnedIsolate (it stays in the owner thread's ISOLATES until
@@ -2923,15 +3093,45 @@ impl Drop for Core {
             // this leak; the counter makes it observable (RustyRacer.leaked_isolate_count).
             LEAKED_ISOLATES.fetch_add(1, Ordering::Relaxed);
             self.watchdog.request_shutdown();
+            return;
         }
+        // An op still in flight means a host callback yielded out of a Fiber that
+        // was then never resumed — Ruby frees an unresumed Fiber's stack without
+        // unwinding it, so the op's frames simply vanish and its wrapper with
+        // them. The isolate is still ENTERED by those frames, and disposing an
+        // entered isolate is a V8 fatal ("Disposing the isolate that is entered by
+        // a thread"), which is the unexplained abort this binding exists to avoid.
+        // Leak it instead: the process is on its way out anyway, and a leak that
+        // says why beats a fatal that doesn't. This is the quiet twin of
+        // fatal_nesting_broken — same cause, but nothing ever came back to detect
+        // it, so it surfaces here at teardown.
+        if self.depth.load(Ordering::SeqCst) != 0 {
+            eprintln!(
+                "\n[rusty_racer] warning: an isolate is being discarded with an \
+                 operation still in flight,\n\
+                 so it cannot be disposed and is leaked.\n\
+                 The usual cause is a host function that yielded out of a Fiber \
+                 which was never resumed;\n\
+                 `Fiber#kill` recovers one if you still hold it. See\n\
+                 https://github.com/ursm/rusty_racer#fibers\n"
+            );
+            LEAKED_ISOLATES.fetch_add(1, Ordering::Relaxed);
+            self.watchdog.request_shutdown();
+            return;
+        }
+        // Last wrapper dropped on the owner thread with nothing in flight: full
+        // teardown. Drop can't raise, so just tear down.
+        self.shared.lock().unwrap().disposed = true;
+        self.teardown();
     }
 }
 
 // RustyRacer.live_isolate_count -> Integer: isolates currently in the registry
 // (created, not yet disposed). RustyRacer.leaked_isolate_count -> Integer:
-// isolates that could not be disposed because their last wrapper was dropped off
-// the owner thread (see Drop) — a workload that churns owner threads should keep
-// this at 0 by disposing on the owner thread.
+// isolates that could not be disposed — because their last wrapper was dropped
+// off the owner thread, or because an operation was still in flight (see Drop
+// for both) — a workload that churns owner threads should keep this at 0 by
+// disposing on the owner thread.
 fn live_isolate_count() -> usize {
     isolates().lock().unwrap().len()
 }

data/lib/rusty_racer/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RustyRacer
-  VERSION = "0.2.1"
+  VERSION = "0.2.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rusty_racer
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.3
 platform: ruby
 authors:
 - Keita Urashima
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-14 00:00:00.000000000 Z
+date: 2026-08-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rb_sys