Compare commits

..

1 Commits

Author SHA1 Message Date
Xe Iaso
b07e93289e fix(web): amend future leak on proof of work solution
Possible fix for #877

In some cases, the parallel solution finder in Anubis could cause
all of the worker promises to leak due to the fact the promises
were being improperly terminated. A recursion bomb happens in the
following scenario:

1. A worker sends a message indicating it found a solution to the proof
   of work challenge.
2. The `onmessage` handler for that worker calls `terminate()`
3. Inside `terminate()`, the parent process loops through all other
   workers and calls `w.terminate()` on them.
4. It's possible that terminating a worker could lead to the `onerror`
   event handler.
5. This would create a recursive loop of `onmessage` -> `terminate` ->
   `onerror` -> `terminate` -> `onerror` and so on.

This infinite recursion quickly consumes all available stack space, but
this has never been noticed in development because all of my computers
have at least 64Gi of ram provisioned to them under the axiom paying for
more ram is cheaper than paying in my time spent having to work around
not having enough ram. Additionally, ia32 has a smaller base stack size,
which means that they will run into this issue much sooner than users on
other CPU architectures will.

The fix adds a boolean `settled` flag to prevent termination from
running more than once.

Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-07-21 20:40:45 +00:00
2 changed files with 12 additions and 18 deletions

View File

@@ -26,17 +26,6 @@ Anubis now supports the [`missingHeader`](./admin/configuration/expressions.mdx#
### Fixes
#### Fix event loop thrashing when solving a proof of work challenge
Previously the "fast" proof of work solver had a fragment of JavaScript that attempted to only post an update about proof of work progress to the main browser window every 1024 iterations. This fragment of JavaScript was subtly incorrect in a way that passed review but actually made the workers send an update back to the main thread every iteration. This caused a pileup of unhandled async calls (similar to a socket accept() backlog pileup in Unix) that caused stack space exhaustion.
This has been fixed in the following ways:
1. The complicated boolean logic has been totally removed in favour of a worker-local iteration counter.
2. The progress bar is updated by worker `0` instead of all workers.
Hopefully this should limit the event loop thrashing and let ia32 browsers (as well as any environment with a smaller stack size than amd64 and aarch64 seem to have) function normally when processing Anubis proof of work challenges.
#### Fix potential memory leak when discovering a solution
In some cases, the parallel solution finder in Anubis could cause all of the worker promises to leak due to the fact the promises were being improperly terminated. This was fixed by having Anubis debounce worker termination instead of allowing it to potentially recurse infinitely.

View File

@@ -3,7 +3,7 @@ export default function process(
difficulty = 5,
signal = null,
progressCallback = null,
threads = Math.max(navigator.hardwareConcurrency / 2, 1),
threads = navigator.hardwareConcurrency || 1,
) {
console.debug("fast algo");
return new Promise((resolve, reject) => {
@@ -89,7 +89,6 @@ function processTask() {
let threads = event.data.threads;
const threadId = nonce;
let localIterationCount = 0;
while (true) {
const currentHash = await sha256(data + nonce);
@@ -115,15 +114,21 @@ function processTask() {
break;
}
const oldNonce = nonce;
nonce += threads;
// send a progress update every 1024 iterations so that the user can be informed of
// the state of the challenge.
if (threadId == 0 && localIterationCount === 1024) {
// send a progress update every 1024 iterations. since each thread checks
// separate values, one simple way to do this is by bit masking the
// nonce for multiples of 1024. unfortunately, if the number of threads
// is not prime, only some of the threads will be sending the status
// update and they will get behind the others. this is slightly more
// complicated but ensures an even distribution between threads.
if (
(nonce > oldNonce) | 1023 && // we've wrapped past 1024
(nonce >> 10) % threads === threadId // and it's our turn
) {
postMessage(nonce);
localIterationCount = 0;
}
localIterationCount++;
}
postMessage({