relay: hop cross-exec handle teardown to the owning exec#449
Merged
Conversation
The reciprocal peer SubscribeNamespaceHandle was acquired via a direct session->subscribeNamespace() and stored raw, so peerSubNsHandles_.erase() destroyed it on relayExec_ — running its teardown (isClosed() read + control RST) on the wrong thread while the peer session closed on its own io exec (TSAN-confirmed data race on MoQSession). Acquire it through maybeWrapPublisher so the handle is a CrossExecSubscribeNamespaceHandle bound to the session's exec, and give every cross-exec wrapper in PublisherCrossExecFilter a destructor that hops the inner handle's destruction to that exec — so destructor-driven teardown is exec-correct, not just the explicit unsubscribe/cancel calls. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
afrind
force-pushed
the
fix/tsan-lf-publish-done
branch
from
261964b to
19998ed
Compare
gmarzot
approved these changes
Jun 26, 2026
gmarzot
left a comment
gmarzot
left a comment
Contributor
There was a problem hiding this comment.
@gmarzot reviewed 3 files and all commit messages.
Reviewable status:complete! all files reviewed, all discussions resolved (waiting on afrind).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The reciprocal peer SubscribeNamespaceHandle was acquired via a direct session->subscribeNamespace() and stored raw, so peerSubNsHandles_.erase() destroyed it on relayExec_ — running its teardown (isClosed() read + control RST) on the wrong thread while the peer session closed on its own io exec (TSAN-confirmed data race on MoQSession).
Acquire it through maybeWrapPublisher so the handle is a CrossExecSubscribeNamespaceHandle bound to the session's exec, and give every cross-exec wrapper in PublisherCrossExecFilter a destructor that hops the inner handle's destruction to that exec — so destructor-driven teardown is exec-correct, not just the explicit unsubscribe/cancel calls.
This change is