You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by "HarshMehta112 (via GitHub)" <gi...@apache.org> on 2026/06/29 05:03:30 UTC
[PR] fix(#3453): resolve concurrency, leak, and panic issues from code audit [dubbo-go]
HarshMehta112 opened a new pull request, #3461:
URL: https://github.com/apache/dubbo-go/pull/3461
Fixes #3453
Addresses six source-grounded findings around concurrency correctness, memory/goroutine
leaks, and panic-based failure handling. Each fix is narrowly scoped with focused tests.
#### 1. RoundRobin selection now atomic under concurrency
`cluster/loadbalance/roundrobin/loadbalance.go`
The weighted-round-robin select+update sequence was only per-field atomic, so concurrent
callers could observe each other's intermediate `currentWeight` and skew distribution.
Added a per-key `sync.Mutex` on `cachedInvokers` so the full select+update transaction is
serialized per service+method (contention bounded to the same key).
#### 2. Getty server no longer panics on config errors
`remoting/getty/getty_server.go`
Replaced `panic(err)` in config marshal/unmarshal, `CheckValidity()`, and `newSession()`
with structured error logging / error returns. Added `safeYAMLMarshal` to recover the
panic `yaml.v3` raises on unmarshalable types (channels, funcs) and surface it as an error.
Malformed protocol config no longer escalates to process-level failure.
#### 3. Graceful shutdown result publication hardened
`graceful_shutdown/shutdown.go`
Added `shutdownResultMu` guarding all reads/writes of the package-level `shutdownResult`,
removing reliance on subtle ordering assumptions between the background shutdown goroutine
and concurrent `Shutdown()` readers.
#### 4. TPS limiter cache is now bounded
`filter/tps/limiter/method_service.go`
The limiter map grew for process lifetime as distinct service+method combos accumulated.
Wrapped each strategy in a `tpsLimitEntry` tracking last-access time, switched to `sync.Map`,
and added a singleton background `runCleanup` goroutine that evicts entries idle past a TTL.
#### 5. Script-router JS runtime no longer leaks cross-request state
`cluster/router/script/instance/js_instance.go`
Pooled `goja.Runtime` instances were never returned to the pool, and request/script globals
survived reuse. Added `defer reset()+Put()` in `Run()`. `reset()` snapshots the built-in
global keys at construction and deletes every global outside that set — clearing both request
bindings and user-script-defined globals while preserving built-ins.
#### 6. Forking cluster cancels losing parallel branches
`cluster/cluster/forking/cluster_invoker.go`
Losing parallel invocations ran to completion after the winner returned, wasting downstream
work. Derived a cancelable `forkCtx`; `defer cancel()` stops sibling requests as soon as the
first accepted result wins.
### Tests
- `TestRoundRobinByWeightConcurrent` — 50 goroutines × 30 selections, race-clean
- `TestInitServerDoesNotPanicOnUnmarshalableParams` — channel in Params no longer panics
- `TestShutdownResultConsistentUnderConcurrentReaders`, `TestShutdownPanicSetsResultError`
- `TestTpsLimitEntryUpdatesLastAccess`, `TestTpsLimiterStaleEntryEviction`
- `TestJsInstanceResetClearsBindings` (incl. user-defined global), `TestJsInstanceRunReturnsRuntimeToPool`
- `TestForkingInvokeCancelsLosingBranches` — loser branch ctx canceled after winner succeeds
All 74 tests across the 6 packages pass; `go vet` and `gofmt` clean.
### Scope
Covers audit items 1–6 only. Item 7 (broader panic/fatal policy audit) is left for follow-up
PRs per the issue's suggested slicing. Items A/B/C are already fixed upstream.
### Checklist
- [x] I confirm the target branch is `develop`
- [x] Code has passed local testing
- [x] I have added tests that prove my fix is effective or that my feature works
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] fix(#3453): resolve concurrency, leak, and panic issues from code audit [dubbo-go]
Posted by "HarshMehta112 (via GitHub)" <gi...@apache.org>.
HarshMehta112 closed pull request #3461: fix(#3453): resolve concurrency, leak, and panic issues from code audit
URL: https://github.com/apache/dubbo-go/pull/3461
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] fix(#3453): resolve concurrency, leak, and panic issues from code audit [dubbo-go]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #3461:
URL: https://github.com/apache/dubbo-go/pull/3461#issuecomment-4829268661
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go&pullRequest=3461) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=3461&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=3461&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go&pullRequest=3461&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go&pullRequest=3461&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go&pullRequest=3461&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go&pullRequest=3461)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] fix(#3453): resolve concurrency, leak, and panic issues from code audit [dubbo-go]
Posted by "HarshMehta112 (via GitHub)" <gi...@apache.org>.
HarshMehta112 commented on PR #3461:
URL: https://github.com/apache/dubbo-go/pull/3461#issuecomment-4900431852
Closing this PR as suggested above. I'll split it into six smaller PRs for easier review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] fix(#3453): resolve concurrency, leak, and panic issues from code audit [dubbo-go]
Posted by "Alanxtl (via GitHub)" <gi...@apache.org>.
Alanxtl commented on PR #3461:
URL: https://github.com/apache/dubbo-go/pull/3461#issuecomment-4832098464
1. comment in the issue before summitting pr
2. split this pr into 6 small prs, this one is too large to review
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] fix(#3453): resolve concurrency, leak, and panic issues from code audit [dubbo-go]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #3461:
URL: https://github.com/apache/dubbo-go/pull/3461#issuecomment-4829151323
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go&pullRequest=3461) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=3461&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=3461&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go&pullRequest=3461&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go&pullRequest=3461&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go&pullRequest=3461&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go&pullRequest=3461)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] fix(#3453): resolve concurrency, leak, and panic issues from code audit [dubbo-go]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #3461:
URL: https://github.com/apache/dubbo-go/pull/3461#issuecomment-4829284515
## [Codecov](https://app.codecov.io/gh/apache/dubbo-go/pull/3461?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `75.75758%` with `16 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 54.09%. Comparing base ([`8b5bbcf`](https://app.codecov.io/gh/apache/dubbo-go/commit/8b5bbcf192aaac782e2fcf1ea2a6c7c90d9e3e1c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`5cfc4a8`](https://app.codecov.io/gh/apache/dubbo-go/commit/5cfc4a80829c100c1a17b42028cd4cf3ce1dfb3e?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 3 commits behind head on develop.
| [Files with missing lines](https://app.codecov.io/gh/apache/dubbo-go/pull/3461?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [filter/tps/limiter/method\_service.go](https://app.codecov.io/gh/apache/dubbo-go/pull/3461?src=pr&el=tree&filepath=filter%2Ftps%2Flimiter%2Fmethod_service.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-ZmlsdGVyL3Rwcy9saW1pdGVyL21ldGhvZF9zZXJ2aWNlLmdv) | 70.83% | [6 Missing and 1 partial :warning: ](https://app.codecov.io/gh/apache/dubbo-go/pull/3461?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [remoting/getty/getty\_server.go](https://app.codecov.io/gh/apache/dubbo-go/pull/3461?src=pr&el=tree&filepath=remoting%2Fgetty%2Fgetty_server.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-cmVtb3RpbmcvZ2V0dHkvZ2V0dHlfc2VydmVyLmdv) | 61.53% | [5 Missing :warning: ](https://app.codecov.io/gh/apache/dubbo-go/pull/3461?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [cluster/router/script/instance/js\_instance.go](https://app.codecov.io/gh/apache/dubbo-go/pull/3461?src=pr&el=tree&filepath=cluster%2Frouter%2Fscript%2Finstance%2Fjs_instance.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y2x1c3Rlci9yb3V0ZXIvc2NyaXB0L2luc3RhbmNlL2pzX2luc3RhbmNlLmdv) | 75.00% | [2 Missing and 2 partials :warning: ](https://app.codecov.io/gh/apache/dubbo-go/pull/3461?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## develop #3461 +/- ##
===========================================
+ Coverage 53.57% 54.09% +0.52%
===========================================
Files 460 461 +1
Lines 35182 35530 +348
===========================================
+ Hits 18847 19220 +373
+ Misses 14857 14791 -66
- Partials 1478 1519 +41
```
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/dubbo-go/pull/3461?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org