Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Exceptions from fetch handlers should wait for output gate. #585

Merged
merged 1 commit into from
May 2, 2023

Conversation

kentonv
Copy link
Member

@kentonv kentonv commented Apr 28, 2023

Prior to this, if an application queued a storage write, then threw an exception, and the storage write failed later on, the exception might nevertheless be received by the caller. If, for some reason, an application were confirming writes by throwing exceptions, this could result in confirming a write that didn't actually make it to disk.

Of course, surely no app does that. The bigger problem is that this could screw with the durableObjectReset flag on exceptions thrown after storage breakages. Say a storage write fails, and we respond by simultaneously throwing an exception from the storage API to the application, as well as breaking the output gate with the same exception. The version of the exception thrown at the application could propagate out of the fetch handler before the output gate had a chance to propagate its version. However, the version that throws through the application would lose the broken. annotation, as this by design does not transit through application code. The version of the exception that broke the output gate keeps this annotation, so is a better one to throw to the client. By properly waiting for the output gate here, we can make sure the preferred exception is propagated.

@kentonv kentonv requested review from bcaimano and a-robinson April 28, 2023 21:53
@kentonv kentonv force-pushed the kenton/error-output-gate branch from 53e6ba5 to 8b89221 Compare April 28, 2023 21:54
Prior to this, if an application queued a storage write, then threw an exception, and the storage write failed later on, the exception might nevertheless be received by the caller. If, for some reason, an application were confirming writes by throwing exceptions, this could result in confirming a write that didn't actually make it to disk.

Of course, surely no app does that. The bigger problem is that this could screw with the `durableObjectReset` flag on exceptions thrown after storage breakages. Say a storage write fails, and we respond by simultaneously throwing an exception from the storage API to the application, as well as breaking the output gate with the same exception. The version of the exception thrown at the application could propagate out of the fetch handler before the output gate had a chance to propagate its version. However, the version that throws *through* the application would lose the `broken.` annotation, as this by design does not transit through application code. The version of the exception that broke the output gate keeps this annotation, so is a better one to throw to the client. By properly waiting for the output gate here, we can make sure the preferred exception is propagated.
@kentonv kentonv force-pushed the kenton/error-output-gate branch from 8b89221 to e4b849a Compare May 2, 2023 15:18
@kentonv kentonv merged commit 117aa32 into main May 2, 2023
@kentonv kentonv deleted the kenton/error-output-gate branch May 2, 2023 17:11
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants