macltok

public

Star0

Fork 0

Watch0

21 commits 3 branches 0 tags 0 releases3.0 MiB

Commit `7b376d620a3d`

tarball

atagen <boss@atagen.co>2026-09-27 01:42 UTC

6 files changed+46-6

engine: let the host hear a wasm panic

On wasm32 a panic traps the task mid poll and nothing unwinds, so the engine's catch_unwind never fires and the rest of it keeps running in an undefined state without ever sending Failed or Stopped. on_panic hands the host the message from inside the panic hook, chained after any hook already installed, so it can tear the worker down. It's a free function because a panic hook belongs to the whole instance, not to one engine.

Modified file: README.md+5 additions−2 deletions@@ -112,8 +112,11 @@ rustflags = ["--cfg", "getrandom_backend=\"wasm_js\""]
 
 what's different in a browser
 
-- a panic aborts the whole instance. natively a panicking command costs its
-  caller an `Interrupted`, here it takes the engine and everything else with it
+- a panic doesn't abort anything. it traps the task mid poll and the rest of
+  the engine carries on in an undefined state and goes quiet, no `Failed` and no
+  `Stopped`. register `macltok::on_panic` and have it tear the worker down and
+  start another. natively a panicking command just costs its caller an
+  `Interrupted`
 - `MediaUploadProgress` only ever reports completion, the sdk's wasm http path
   has no upload progress
 - the sdk doesn't retry requests or time them out individually. sync still

Modified file: docs/design-decisions.md+5 additions−2 deletions@@ -30,8 +30,11 @@ doing the work died before it could answer. `challenge` turns up with
 the run loop routes and does nothing slow. every task it spawns is registered
 with a context. a command task that panics costs its caller an `Interrupted`
 and gets logged. a watcher or a room actor that panics takes the engine down,
-emitting `Failed` then `Stopped`. natively, anyway. wasm aborts the whole
-instance on any panic and nothing is left to log it
+emitting `Failed` then `Stopped`. natively, anyway. on wasm a panic traps the
+task mid poll and nothing is caught. the rest keeps running in an undefined
+state and goes silent, no `Failed` and no `Stopped`, so the host hears of it
+through `on_panic`, a free function since a panic hook belongs to the whole
+instance rather than to one engine
 
 sync restarts itself with backoff after an error or an unexpected stop, and
 `ConnectionChanged` shows `Offline` meanwhile. a run that drops again inside

Modified file: src/engine/executor.rs+1−1

@@ -14,7 +14,7 @@ pub(super) fn is_panic(error: &JoinError) -> bool {

1414 error.is_panic()

1515 }

1616

17-/// the sdk's wasm join error has no payload, though a panic there aborts the instance anyway

17+/// the sdk's wasm join error has no payload, and a real panic traps before it gets here

1818 #[cfg(target_family = "wasm")]

1919 pub(super) fn is_panic(error: &JoinError) -> bool {

2020 !error.is_cancelled()

Modified file: src/engine/mod.rs+2 additions−1 deletions@@ -145,7 +145,8 @@ impl TaskContext {
     }
 }
 
-/// tasks catch their own panics, since the sdk's wasm join error drops the payload
+/// tasks catch their own panics so each comes back with its context, since joining
+/// through the sdk's executor gives no task id to look one up by. wasm has nothing to catch
 fn panic_message(payload: Box<dyn std::any::Any + Send>) -> String {
     payload
         .downcast_ref::<&str>()

Modified file: src/lib.rs+4 additions@@ -10,6 +10,8 @@ mod normalise;
 mod transport;
 mod uiaa;
 mod upload;
+#[cfg(target_family = "wasm")]
+mod wasm;
 
 #[cfg(all(feature = "sqlite", target_family = "wasm"))]
 compile_error!("sqlite has no filesystem to live on in wasm, use indexeddb");
@@ -58,3 +60,5 @@ pub use uiaa::{
     InteractiveAuth, InteractiveAuthChallenge, InteractiveAuthFailure, InteractiveAuthFlow,
     InteractiveAuthOutcome,
 };
+#[cfg(target_family = "wasm")]
+pub use wasm::on_panic;

Added file: src/wasm.rs+29 additions@@ -0,0 +1,29 @@
+use std::cell::RefCell;
+
+type Handler = Box<dyn Fn(&str)>;
+
+thread_local! {
+    static HANDLER: RefCell<Option<Handler>> = const { RefCell::new(None) };
+}
+
+/// a panic on wasm32 traps the task that raised it and nothing unwinds, so the engine
+/// catches nothing. the rest of it keeps running in an undefined state and goes silent,
+/// no `Failed` and no `Stopped`. `handler` runs from the panic hook with the message,
+/// after whatever hook was there before, and is the host's one chance to react, say by
+/// terminating the worker and starting a fresh one. a second call replaces the handler
+pub fn on_panic(handler: impl Fn(&str) + 'static) {
+    let installed = HANDLER.with(|slot| slot.replace(Some(Box::new(handler))).is_some());
+    if installed {
+        return;
+    }
+    let previous = std::panic::take_hook();
+    std::panic::set_hook(Box::new(move |info| {
+        previous(info);
+        let message = info.to_string();
+        HANDLER.with(|slot| {
+            if let Some(handler) = &*slot.borrow() {
+                handler(&message);
+            }
+        });
+    }));
+}

macltok

Commit 7b376d620a3d

Commit `7b376d620a3d`