Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Concurrent Windows stops can escalate descendant cleanup before root shutdown completes

Aperta
  • Qualcosa non va?
#287 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go
Ambito
backend

Direzione di ricerca

Start with pkg/process/os_executor_windows.go and the shared tree-stop logic in pkg/process/os_executor.go, then read the existing Windows concurrent-stop test. Reproduce or extend coverage to distinguish native root exit from stdio-drain completion, including graceful and forced roots and descendant-held pipes. Done means the test establishes the intended descendant-escalation ordering while preserving stop ownership and bounded cancellation.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

Follow-up to PR #278, reviewed at c49750ffc674334831dd2b00ac807987fd2432d4. This is not a blocker for that PR; improving the sequencing is deferred because the practical impact is narrow and a safe change must preserve the separation between process exit and output draining.

Current behavior

In pkg/process/os_executor_windows.go:113–120, a caller that does not own stopping waits for descendants, but returns immediately for the root (optWaitForStdio is set):

if !shouldStopProcess && (opts&optIsResponsibleForStopping) == 0 {
	if (opts & optWaitForStdio) == 0 {
		// Another stop owns signaling, but descendants must still be confirmed exited.
		waitErr := waitForTrackedProcessExit(ctx, handle.Pid, ws, 0)
		return singleProcessStopResult{waitEndedCh: waitEndedCh}, waitErr
	}
	return singleProcessStopResult{waitEndedCh: waitEndedCh}, nil
}

The shared tree-stop implementation uses the returned result to decide whether to begin graceful descendant cleanup:

forceDescendants := rootResult.forceKillUsed || rootStopErr != nil || graceCtx.Err() != nil

if len(tree) > 0 && !forceDescendants {
	// Begin descendant cleanup under the graceful context.
}

See pkg/process/os_executor.go:715–738. Because the joining root call returns no error and no force-kill indication, it can begin descendant cleanup while the owning caller is still waiting for the root to shut down.

For descendants whose console-event receipt is unknown, Windows normally allows a six-second passive wait before force termination. An overlapping caller can therefore start that wait early and terminate descendants while the root is still within its own 15-second graceful window. Explicit stopping overlapping process-context cancellation is one possible entry point.

Impact and confidence

The practical concern is interrupted coordinated shutdown: the root may still be arranging child shutdown when the joining caller force-kills those children, potentially cutting off their cleanup or final output. The joining caller can also time out waiting for the root while the owning stop continues.

This is not immediate force termination, and it does not directly shorten the root owner's graceful wait. This particular ownership path requires overlapping stops on the same executor. Identity validation and final exit confirmation remain in place; no wrong-process termination, false successful cleanup, or process leak has been demonstrated from this behavior.

The sequencing was verified through code inspection, not a local Windows runtime reproduction. The Windows concurrent test deliberately starts descendant stopping before releasing its gated root, so the behavior is accommodated by existing coverage rather than being entirely untested.

Follow-up direction

Determine whether concurrent Windows stops should enforce the shared root-first contract, and implement any change without waiting for output draining before descendant cleanup. A simple copy of the Unix non-owner wait is insufficient as a complete proposal: cmd.Wait() can remain blocked after root exit because descendants retain stdout/stderr pipes. The historical tree-stop design intentionally defers that completion until after descendant cleanup.

Use existing identity-aware process-exit inspection where appropriate, preserve bounded cancellation and stop ownership, and propagate the owner's force-kill outcome if needed. Cover graceful and forced roots, overlapping explicit/cancellation cleanup, and descendant-held output pipes. The regression test should distinguish native root exit from stdio-drain completion and explicitly establish the intended descendant-escalation ordering.

Lingua principale
Go
Stelle
191
Fork
26
Merge medio
1g 21h
PR unite (30g)
23

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di microsoft/dcp

Tutte le issue di microsoft/dcp

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.