Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"Leak" of unwatched subscribed promises across upgrades #10101

Open
mhofman opened this issue Sep 17, 2024 · 1 comment
Open

"Leak" of unwatched subscribed promises across upgrades #10101

mhofman opened this issue Sep 17, 2024 · 1 comment
Labels
contract-upgrade enhancement New feature or request liveslots requires vat-upgrade to deploy changes SwingSet package: SwingSet

Comments

@mhofman
Copy link
Member

mhofman commented Sep 17, 2024

What is the Problem Being Solved?

In incarnation 1, a vat may perform an eventual send or otherwise receive a promise to which liveslots will automatically subscribe to. The contract may not watch that promise (which is often, but not always a sign of a bug, see #9771). The subscription remains across vat upgrade, however the new incarnation would be unable to do anything with the resolution if/when it receives it if the promise wasn't watched. This results in a sort of leak of the clist of the vat until the promise gets resolved by the external decider, even though the vat has provably no interest in this resolution. This is somewhat a special case of the vat not being interested in a promise it receives because the user code drops the promise (#8469), but with actual knowledge that the user code is not interested because it doesn't even know about the promise anymore.

Description of the Design

Possibly a variation of #9771 where the kernel/the upgraded vat unsubscribes from non watched promises during upgrades.

Security Considerations

Only unwatched promises must be affected

Scaling Considerations

How to track these unwatched promises across upgrades

Test Plan

Reproduce case described in problem solved and verify promise is removed from clist after upgrade

Upgrade Considerations

Likely requires changes to liveslots, which means it might only affect promises created after liveslots is upgraded.

@mhofman mhofman added enhancement New feature or request SwingSet package: SwingSet contract-upgrade liveslots requires vat-upgrade to deploy changes labels Sep 17, 2024
@warner
Copy link
Member

warner commented Oct 9, 2024

We're making this low-priority, because the cost is low: some extra DB space for the c-list entries, and some wasted (but tiny) dispatch.notify if/when they resolve. To fix this we'll need the kernel to know whether a subscription is "durable" or not (durable promise watcher means durable subscription), so non-durable subscriptions can be unsubscribed by the kernel on behalf of the vat during upgade.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
contract-upgrade enhancement New feature or request liveslots requires vat-upgrade to deploy changes SwingSet package: SwingSet
Projects
None yet
Development

No branches or pull requests

2 participants