findings(E-5,E-8,E-9): module-identity ngspice events + runWaitCompletion admission gate

E-8 (re-implemented for JSPI — the codex gate is entangled with the dropped
execution owner; under JSPI a fresh non-suspending JS→wasm entry while
another activation is suspended is structurally safe on its own stack, so
the admission boundary for worker completions is liveness + trap state, not
execution ownership):
- jspi-scheduler.js grows `terminal` (trapped instance; distinct from `dead`),
  canTouchNative(), _terminalizeNativeTrap() (WebAssembly.RuntimeError +
  cross-realm string classification), and runWaitCompletion(site, token,
  prepare, inertResult): prepare runs immediately and owns ALL native work;
  stale tokens and dead/terminal instances drop loudly without resolving
  (resolving would resume the parked frame inside the damaged module); a
  trap latches terminal; a plain JS bug resolves inertResult so the wait
  fails instead of stranding. beginWait refuses (token 0) when dead/terminal.
- all four delayed completion sites route their native work through the
  gate: 'OCC export completion' (exporter_step_stub), 'OCC model completion'
  (oce_plugin_stub — the MEMFS cache write moves inside the gate too),
  'ngspice request completion' and 'ngspice vector completion'
  (sharedspice_client — every HEAP32/HEAPF64/malloc write inside prepare,
  inertResult 1 = transport error). Every wxWasmBeginWait caller in the
  stubs bails on token <= 0.
- deliberately NOT ported from codex: ownerModule, enqueueNativeCompletion,
  executionBarrier, the byte-credit native-entry FIFO — completions are
  one-shot per wait token and stream volume is bounded at the E-6 transport
  credit window. Cross-refs logged for group M (M-2/M-6/M-8).

E-5 (re-implemented; codex shape kept, owner APIs replaced with the E-8
gate): js_ngspice_install_events binds the handler to the EXACT installing
module (handler.__pcbjamNgspiceOwnerModule stamp; presence is not identity),
re-installation replaces a foreign module's handler, a superseded handler
disarms itself, native entry goes through installingModule._malloc/
._pcbjam_ngspice_event (never lexical Module), each dispatch checks
canTouchNative() (loud drop on a dead/terminal module), and a trap on the
per-line entry latches the terminal gate.

Tests: scheduler-shim.test.ts +7 (gate happy/stale/dead/terminal/cross-realm/
js-bug/beginWait-refusal). e2e specs updated from the codex line: occ-export
decode-fault recovery (real onmessageerror transition via failDecode, J-4),
ngspice-probe direct-service coverage, eeschema-sim rewritten onto the E-7
applied-generation receipt (codex's executionBarrier await replaced with a
pendingWaits('ngspice') drain poll — the JSPI-line equivalent).

Also bumps the kicad submodule to the E-7/E-9 commit (dd5751038f7).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Istvan Matejcsok 2026-08-19 16:03:16 +02:00
commit c14e76651c
9 changed files with 763 additions and 149 deletions

2
kicad

@ -1 +1 @@
Subproject commit 9ab93b838e86bedab0ca649a36a3104f30d01e34
Subproject commit 1c67b78fa43052e8ad730fc6c91a219ce1f3a2af

View file

@ -202,6 +202,13 @@
earlyWaitResolves: 0,
beginWait: function (kind) {
if (this.dead || this.terminal) {
// Refuse to mint a wait an unhealthy instance can never satisfy.
// Callers treat token 0 as "not started" (the C++ bridges bail);
// a stray waitPromise(0) settles immediately and warns.
this._note("beginWaitRefused", kind, 0);
return 0;
}
var token = ++this.waitSeq;
var entry = { kind: kind, resolved: false, resolve: null, promise: null };
entry.promise = new Promise(function (resolve) { entry.resolve = resolve; });
@ -274,6 +281,76 @@
},
dead: false,
// --- E-8: admission gate for delayed worker/MEMFS completions -----------
// `terminal` means the wasm instance TRAPPED (WebAssembly.RuntimeError or
// its cross-realm string equivalent): the heap may be mid-mutation, so no
// further native work (malloc / heap stores / FS writes) may run and no
// parked frame may be resumed into it. Distinct from `dead` (orderly
// shutdown). One-way.
terminal: false,
canTouchNative: function () { return !this.dead && !this.terminal; },
_terminalizeNativeTrap: function (site, e) {
var isTrap = (typeof WebAssembly !== "undefined"
&& WebAssembly.RuntimeError
&& e instanceof WebAssembly.RuntimeError)
|| /unreachable|memory access out of bounds|index out of bounds|null function or function signature mismatch|Aborted\(/i
.test(String((e && e.message) || e));
if (!isTrap) return false;
if (!this.terminal) {
this.terminal = true;
this._note("terminal", site, 0);
console.error("[wx-scheduler] native trap in " + site
+ " — instance is terminal; all further native completions are inert: "
+ e);
}
return true;
},
// The one admission boundary for delayed completions that both touch
// native state and wake a parked waiter (the four worker/MEMFS completion
// sites: OCC export, OCC model, ngspice request, ngspice vector).
// `prepare` runs IMMEDIATELY, never queued — it owns the parked waiter's
// output pointers, and queuing it behind anything can deadlock the very
// frame this completion wakes. Disposition (every drop is loud, never
// silent):
// stale/unknown token -> drop + warn (late frame from a retired
// worker generation)
// dead or terminal instance -> drop + warn, DO NOT resolve — resolving
// resumes the suspended frame INSIDE the
// damaged module
// prepare() traps -> latch terminal, DO NOT resolve
// prepare() throws plain JS -> resolve inertResult (fail the wait
// rather than strand its parked frame in
// a healthy instance)
runWaitCompletion: function (site, token, prepare, inertResult) {
var entry = this.waits.get(token);
if (!entry || entry.resolved) {
console.warn("[wx-scheduler] " + site + ": completion for stale wait "
+ token + " dropped");
this._note("staleCompletion", site, token);
return false;
}
if (!this.canTouchNative()) {
console.warn("[wx-scheduler] " + site + ": completion dropped ("
+ (this.terminal ? "terminal" : "dead") + " instance)");
this._note("inertCompletion", site, token);
return false;
}
var result;
try {
result = prepare();
} catch (e) {
if (this._terminalizeNativeTrap(site, e)) {
this._note("completionTrap", site, token);
return false;
}
console.error("[wx-scheduler] " + site + ": completion failed: " + e);
this._note("completionError", site, token);
this.resolveWait(token, inertResult == null ? 0 : inertResult | 0);
return false;
}
this.resolveWait(token, result | 0);
return true;
},
shutdown: function (why) {
this.dead = true;
// S6 teardown contract: queued-but-

View file

@ -36,8 +36,8 @@ async function loadRectifier(page: import('@playwright/test').Page): Promise<voi
for (const f of PROJECT_FILES)
await injectFileIntoMemfs(page, path.join(RECTIFIER_DIR, f), `${MEMFS_DIR}/${f}`);
await page.evaluate((sch: string) => {
(window as any).Module.kicadOpenFile(sch);
await page.evaluate(async (sch: string) => {
await (window as any).Module.kicadOpenFile(sch);
}, `${MEMFS_DIR}/rectifier.kicad_sch`);
await expect
@ -67,12 +67,9 @@ async function openSimulator(page: import('@playwright/test').Page): Promise<str
return simWin!;
}
// Run the loaded workbook's analysis and wait for the background run to
// finish (the bg 'finished' event lands after ngspice's thread joins).
async function runSimulation(page: import('@playwright/test').Page): Promise<void> {
const evtsBefore = await page.evaluate(
() => (window as any).__ngspiceEvents.length as number);
// Run the loaded workbook's analysis and await the exact native run generation
// only after its final plot, operating-point, and canvas refresh calls return.
async function runSimulation(page: import('@playwright/test').Page): Promise<number> {
// The simulator window div appears while the frame ctor is still
// suspended in the init RPC; the toolbar registers its tools only after
// init completes and the frame first paints. The Run tool's
@ -90,13 +87,53 @@ async function runSimulation(page: import('@playwright/test').Page): Promise<voi
}, { timeout: 60000 })
.toBe(true);
const generationCheckpoint = await page.evaluate(() => {
const hooks = (globalThis as any).__ngspiceServiceTestHooks;
if (!hooks || typeof hooks.appliedGenerationCheckpoint !== 'function'
|| typeof hooks.waitForAppliedGenerationAfter !== 'function') {
throw new Error('exact ngspice applied-generation hooks are missing');
}
return hooks.appliedGenerationCheckpoint() as number;
});
expect(await clickByTooltip(page, 'Run Simulation', { elementType: 'tool' }),
'Run tool').toBe(true);
await page.waitForFunction((n: number) => {
const evts = (window as any).__ngspiceEvents as Array<{ kind: string; finished?: boolean }>;
return evts.slice(n).some((e) => e.kind === 'bg' && e.finished === true);
}, evtsBefore, { timeout: 120000 });
const appliedReceipt = await page.evaluate(async (after: number) => {
const hooks = (globalThis as any).__ngspiceServiceTestHooks;
return await hooks.waitForAppliedGenerationAfter(after, 120000);
}, generationCheckpoint);
expect(appliedReceipt.generation, 'the clicked run published a newer applied generation')
.toBeGreaterThan(generationCheckpoint);
// The native receipt fires after the final refreshes. Additionally
// require the scheduler to hold no parked ngspice wait — a stale
// suspended frame here means the finish path leaked a wait. (The codex
// line awaited the execution owner's barrier; that machinery does not
// exist on the JSPI line, and wait drainage is its observable
// equivalent.)
await expect.poll(
() => page.evaluate(() => {
const scheduler = (globalThis as any).__wxScheduler;
return scheduler?.pendingWaits?.('ngspice') ?? -1;
}),
{ message: 'no ngspice wait may stay parked after the applied receipt', timeout: 30000 },
).toBe(0);
// Vector traffic is result validation only. It is deliberately not used as
// completion evidence because periodic OnSimRefresh(false) pulls can look
// identical to the final pull at the worker boundary.
const vectorReceipt = await page.evaluate(() =>
((window as any).__ngspiceLog as Array<{
sequence: number; kind: string; error?: string; length?: number;
}>).find((entry) => entry.kind === 'get_vec_info'
&& entry.error === undefined
&& (entry.length ?? -1) >= 101) ?? null,
);
expect(vectorReceipt, 'the applied run returned a non-trivial successful vector')
.not.toBeNull();
return appliedReceipt.generation;
}
function distinctColors(png: PNG): number {
@ -168,7 +205,9 @@ test.describe('eeschema simulator', () => {
const charText = evts.flatMap((e) => e.lines ?? []).join('\n');
expect(charText, 'no missing-model errors').not.toMatch(/unable to find definition/i);
// The plot pulled real vector data through get_vec_info.
// The exact final-refresh receipt and drained-waits check above prove
// this log entry belongs to a vector which reached the plot, not
// merely a worker response still waiting to copy into native memory.
const vecPulls = await page.evaluate(() =>
((window as any).__ngspiceLog as Array<{ kind: string; length?: number }>)
.filter((l) => l.kind === 'get_vec_info' && (l.length ?? 0) > 100).length);
@ -197,8 +236,10 @@ test.describe('eeschema simulator', () => {
await loadRectifier(page);
await openSimulator(page);
await runSimulation(page);
await runSimulation(page);
const firstGeneration = await runSimulation(page);
const secondGeneration = await runSimulation(page);
expect(secondGeneration, 'the second run has its own exact generation')
.toBeGreaterThan(firstGeneration);
const finishCount = await page.evaluate(() =>
((window as any).__ngspiceEvents as Array<{ kind: string; finished?: boolean }>)

View file

@ -79,6 +79,122 @@ test.describe('ngspice_service probe', () => {
expect(last, 'v(out) end value').toBeLessThanOrEqual(1.0);
});
test('request receipts scan atomically and reject pre-checkpoint responses', async ({ page }) => {
await page.goto('/kicad/eeschema.html', { waitUntil: 'domcontentloaded' });
expect((await svcRequest(page, { kind: 'init' })).ret).toBe(0);
const evidence = await page.evaluate(async () => {
const runtime = globalThis as any;
const hooks = runtime.__ngspiceServiceTestHooks;
if (!hooks?.requestCheckpoint || !hooks?.waitForRequestAfter)
throw new Error('exact request receipt hooks are missing');
// Scan path: the response already exists before the waiter starts.
const scanCheckpoint = hooks.requestCheckpoint();
await runtime.ngspiceService.request({ kind: 'cur_plot' });
const scanned = await hooks.waitForRequestAfter(scanCheckpoint, {
kind: 'cur_plot',
});
// Subscribe path and issue-sequence rule: `old` owns a sequence
// before the checkpoint even though its response can arrive later.
// It must not satisfy the waiter; only the fresh request may do so.
const old = runtime.ngspiceService.request({ kind: 'running' });
const freshCheckpoint = hooks.requestCheckpoint();
let waiterSettled = false;
const waited = hooks.waitForRequestAfter(freshCheckpoint, {
kind: 'running',
}).then((entry: any) => {
waiterSettled = true;
return entry;
});
await old;
await Promise.resolve();
const ignoredOld = !waiterSettled;
const fresh = runtime.ngspiceService.request({ kind: 'running' });
const [subscribed] = await Promise.all([waited, fresh]);
return {
scanCheckpoint,
scanned,
freshCheckpoint,
subscribed,
ignoredOld,
state: hooks.snapshot(),
};
});
expect(evidence.scanned.sequence).toBeGreaterThan(evidence.scanCheckpoint);
expect(evidence.scanned.kind).toBe('cur_plot');
expect(evidence.ignoredOld,
'a late response issued before the checkpoint cannot satisfy the waiter').toBe(true);
expect(evidence.subscribed.sequence).toBeGreaterThan(evidence.freshCheckpoint);
expect(evidence.subscribed.kind).toBe('running');
expect(evidence.state.requestReceiptWaiters, 'all exact waiters settled').toBe(0);
});
test('boot and runtime worker decode faults settle exactly and recover', async ({ page }) => {
await page.goto('/kicad/eeschema.html', { waitUntil: 'domcontentloaded' });
await page.evaluate(() => {
(globalThis as any).__ngspiceServiceTestHooks.messageErrorDuringNextBoot();
});
const bootFailure = await svcRequest(page, { kind: 'init' });
expect(bootFailure.error, 'the first boot request must settle').toContain(
'message decode failed',
);
let state = await page.evaluate(
() => (globalThis as any).__ngspiceServiceTestHooks.snapshot(),
);
expect(state).toMatchObject({
activeGeneration: null,
pending: 0,
retiredGenerations: [1],
bootFaultArmed: false,
});
const recoveredBoot = await svcRequest(page, { kind: 'init' });
expect(recoveredBoot.error, 'generation 2 must boot normally').toBeUndefined();
expect(recoveredBoot.ret, 'generation 2 ngSpice_Init').toBe(0);
// Two calls share one live worker generation. Fault only after both
// real messages have been posted, proving the transport remains
// concurrent and fail-all settles every exact request.
const runtimeFailures = await page.evaluate(async () => {
const runtime = globalThis as any;
runtime.__ngspiceServiceTestHooks.messageErrorWhenPendingAtLeast(2);
return await Promise.all([
runtime.ngspiceService.request({ kind: 'running' }),
runtime.ngspiceService.request({ kind: 'cur_plot' }),
]);
});
expect(runtimeFailures).toHaveLength(2);
for (const result of runtimeFailures) {
expect(result.error, 'every generation-2 request must settle').toContain(
'message decode failed',
);
}
state = await page.evaluate(
() => (globalThis as any).__ngspiceServiceTestHooks.snapshot(),
);
expect(state.maxPending, 'requests are posted concurrently').toBeGreaterThanOrEqual(2);
expect(state).toMatchObject({
activeGeneration: null,
pending: 0,
retiredGenerations: [1, 2],
runtimeFaultArmed: false,
});
const recoveredRuntime = await svcRequest(page, { kind: 'init' });
expect(recoveredRuntime.error, 'generation 3 must recover').toBeUndefined();
expect(recoveredRuntime.ret, 'generation 3 ngSpice_Init').toBe(0);
state = await page.evaluate(
() => (globalThis as any).__ngspiceServiceTestHooks.snapshot(),
);
expect(state).toMatchObject({ activeGeneration: 3, pending: 0 });
});
test('XSPICE code model resolves through the static registry', async ({ page }) => {
await page.goto('/kicad/eeschema.html', { waitUntil: 'domcontentloaded' });

View file

@ -1,8 +1,10 @@
import type { Page } from '@playwright/test';
import * as fs from 'fs';
import * as path from 'path';
import { test, expect } from './fixtures';
import { clickMenuBarItem, clickMenuItem, waitForEditorReady, waitForRenderedByLabel, waitUntil, stableShot, settledShot } from '../e2e/utils/element-tracker';
import { injectFromSubmodule } from './utils/fs-inject';
import { waitForBoardLoaded } from './utils/board-ready';
import { openBoardProgrammatically } from './utils/board-ready';
/** Wait for a rendered popup menu to have its items (replaces a fixed post-menu-click sleep). */
async function waitForMenuItems(page: Page): Promise<void> {
@ -46,61 +48,65 @@ async function loadBoard(page: Page, testLogger: { consoleLogs: string[]; errors
await injectFromSubmodule(page, `kicad/demos/${DEMO.dir}/${proFilename}`,
`${PROJECT_DIR_MEMFS}/${proFilename}`);
expect(await clickMenuBarItem(page, 'File'), 'File menu should be findable').toBe(true);
await waitForMenuItems(page);
// Items register progressively while the popup paints — wait for the one
// we click (clickMenuItem is single-shot; the >3-items gate isn't enough).
await waitForRenderedByLabel(page, 'Open...', { elementType: 'menuitem' });
expect(await clickMenuItem(page, 'Open...'), 'Open… menu item should be findable').toBe(true);
await page.waitForFunction(() => {
const registry = window.wxElementRegistry;
return !!registry && registry.findAll({ visible: true })
.some((el) => el.typeName === 'wxFileDialog');
}, null, { timeout: 15000 });
// Wait for the filename text input to paint (the dialog object exists before its
// inner controls register; replaces a fixed 1000ms).
await waitUntil(page, () => {
const r = window.wxElementRegistry;
return !!r && r.findAll({ visible: true }).some((el) => el.typeName === 'wxTextCtrl' && el.name === 'text');
}, 'file dialog filename input');
const filenameInput = await page.evaluate(() => {
const registry = window.wxElementRegistry;
if (!registry) return null;
const text = registry.findAll({ visible: true })
.find((el) => el.typeName === 'wxTextCtrl' && el.name === 'text');
return text ? { x: text.centerX, y: text.centerY } : null;
});
expect(filenameInput, 'filename text input should be visible').not.toBeNull();
if (!filenameInput) throw new Error('filename text input not found');
await page.mouse.click(filenameInput.x, filenameInput.y);
// Documented interaction dwells: focus + typed-text registration have no observable signal.
await page.waitForTimeout(200); // eslint-disable-line -- documented interaction dwell
await page.keyboard.type(pcbFilename);
await page.waitForTimeout(300); // eslint-disable-line -- documented interaction dwell
await page.keyboard.press('Enter');
const result = await waitForBoardLoaded(page, testLogger, 60000);
const result = await openBoardProgrammatically(
page,
`${PROJECT_DIR_MEMFS}/${pcbFilename}`,
DEMO.stem,
testLogger,
60000,
);
console.log(`[TEST] ${DEMO.name} board-ready result: ${result}`);
}
/** Click a visible wx button by label; returns whether it was found. */
async function clickWxButton(page: Page, label: string): Promise<boolean> {
const pos = await page.evaluate((wanted: string) => {
type WxButtonTarget = { x: number; y: number; domId: number | null };
/** Resolve one visible wx button to its stable DOM identity and fallback point. */
async function findWxButton(page: Page, label: string): Promise<WxButtonTarget | null> {
return page.evaluate((wanted: string) => {
const registry = window.wxElementRegistry;
if (!registry) return null;
const el = registry.findAll({ visible: true })
.find((e) => (e.label === wanted || e.label === `&${wanted}`)
&& (e.typeName ?? '').includes('Button'));
return el ? { x: el.centerX, y: el.centerY } : null;
return el
? { x: el.centerX, y: el.centerY, domId: el.domId && el.domId > 0 ? el.domId : null }
: null;
}, label);
if (!pos) return false;
await page.mouse.click(pos.x, pos.y);
}
async function clickWxButtonTarget(page: Page, target: WxButtonTarget): Promise<void> {
if (target.domId) {
await page.locator(`[data-wx-dom-id="${target.domId}"]`).click();
return;
}
await page.mouse.click(target.x, target.y);
}
/** Click a visible wx button by label; returns whether it was found. */
async function clickWxButton(page: Page, label: string): Promise<boolean> {
const target = await findWxButton(page, label);
if (!target) return false;
await clickWxButtonTarget(page, target);
return true;
}
async function openStepExportDialog(page: Page): Promise<void> {
expect(await clickMenuBarItem(page, 'File'), 'File menu').toBe(true);
await waitForMenuItems(page);
await waitForRenderedByLabel(page, 'Export', { elementType: 'menuitem' });
expect(await clickMenuItem(page, 'Export'), 'Export submenu').toBe(true);
await waitForRenderedByLabel(page, 'STEP/GLB/BREP/XAO/PLY/STL...', { elementType: 'menuitem' });
expect(await clickMenuItem(page, 'STEP/GLB/BREP/XAO/PLY/STL...'),
'STEP export menu item').toBe(true);
await page.waitForFunction(() => {
const registry = window.wxElementRegistry;
return !!registry && registry.findAll({ visible: true })
.some((el) => (el.label === 'Export' || el.label === '&Export')
&& (el.typeName ?? '').includes('Button'));
}, null, { timeout: 20000 });
}
test.describe('OCC export via occ_service worker', () => {
test.describe.configure({ mode: 'serial' });
test.setTimeout(240000);
@ -126,24 +132,8 @@ test.describe('OCC export via occ_service worker', () => {
expect(occFetches, 'occ_service must NOT be fetched before the export').toHaveLength(0);
// File → Export → STEP/GLB/…
expect(await clickMenuBarItem(page, 'File'), 'File menu').toBe(true);
await waitForMenuItems(page);
await waitForRenderedByLabel(page, 'Export', { elementType: 'menuitem' });
expect(await clickMenuItem(page, 'Export'), 'Export submenu').toBe(true);
// Wait for the SUBMENU's item — waitForMenuItems(>3) is satisfied by
// the still-rendered File menu items before the submenu paints.
await waitForRenderedByLabel(page, 'STEP/GLB/BREP/XAO/PLY/STL...', { elementType: 'menuitem' });
expect(await clickMenuItem(page, 'STEP/GLB/BREP/XAO/PLY/STL...'),
'STEP export menu item').toBe(true);
// The (unchanged) DIALOG_EXPORT_STEP: wait for its Export button.
await page.waitForFunction(() => {
const registry = window.wxElementRegistry;
return !!registry && registry.findAll({ visible: true })
.some((el) => (el.label === 'Export' || el.label === '&Export')
&& (el.typeName ?? '').includes('Button'));
}, null, { timeout: 20000 });
// File → Export → STEP/GLB/… and the unchanged export dialog.
await openStepExportDialog(page);
await stableShot(page, 'occ-export-dialog.png');
expect(await clickWxButton(page, 'Export'), 'Export button click').toBe(true);
@ -175,4 +165,165 @@ test.describe('OCC export via occ_service worker', () => {
await stableShot(page, 'occ-export-done.png');
});
test('worker decode fault settles concurrent native wait and the next export recovers', async ({ page, testLogger }) => {
await page.goto('/kicad/pcbnew.html');
await waitForEditorReady(page);
await loadBoard(page, testLogger);
// The exact open Promise and title/paint helper have completed. Keep a
// byte-stable baseline before opening a nested submenu.
await settledShot(page.locator('#canvas'), expect);
await openStepExportDialog(page);
const probeBoard = fs.readFileSync(
path.resolve(__dirname, '..', 'fixtures', 'demo', 'demo.kicad_pcb'),
'utf8',
);
// Start one direct service request before the dialog's native request.
// Both wait on the same lazy worker boot, then both post without a host
// mutex. The harness injects a messageerror only when both are in the
// generation's pending map, and the real worker is then terminated.
await page.evaluate((boardText: string) => {
const runtime = globalThis as any;
runtime.__occServiceTestHooks.messageErrorWhenPendingAtLeast(2);
runtime.__occParallelResult = null;
void runtime.occService.request({
kind: 'export',
board: new TextEncoder().encode(boardText),
jobJson: JSON.stringify({ format: 'step', export_components: false }),
fileName: 'parallel-probe.step',
}).then((res: unknown) => { runtime.__occParallelResult = res; });
}, probeBoard);
expect(await clickWxButton(page, 'Export'), 'first native Export button click').toBe(true);
await page.waitForFunction(
() => (globalThis as any).__occParallelResult !== null,
null,
{ timeout: 30000 },
);
const parallelResult = await page.evaluate(
() => (globalThis as any).__occParallelResult as { ok: boolean; report?: string },
);
expect(parallelResult.ok, 'the parallel request must settle on generation failure').toBe(false);
expect(parallelResult.report, 'the exact messageerror reason reaches the caller')
.toContain('message decode failed');
// The C++ Export() request was the second request in the same failed
// generation. Its exact wx wait must close and show the native failure
// dialog instead of leaving the export handler parked.
await page.waitForFunction(() => {
const registry = window.wxElementRegistry;
if (!registry) return false;
const dialogs = registry.findAll({ visible: true })
.filter((el) => /Dialog/.test(el.typeName ?? ''));
return dialogs.length >= 2;
}, null, { timeout: 30000 });
await expect.poll(
() => page.evaluate(() => {
const scheduler = (globalThis as any).__wxScheduler;
return scheduler?.pendingWaits?.('occ') ?? -1;
}),
{ message: 'the native OCC wait must be completed by fail-all', timeout: 10000 },
).toBe(0);
const failed = await page.evaluate(() => {
const runtime = globalThis as any;
const rendered = runtime.wxElementRegistry?.findAllRendered?.({}) ?? [];
return {
labels: rendered.map((el: any) => el.label ?? el.text ?? '').filter(Boolean),
service: runtime.__occServiceTestHooks.snapshot(),
};
});
expect(failed.service.maxPending,
'two requests must coexist in one generation; worker requests are not serialized')
.toBeGreaterThanOrEqual(2);
expect(failed.service.requestsStarted,
'the direct probe and one native export must be the only provider entries').toBe(2);
expect(failed.service.requestsPosted,
'both failed-generation requests must reach the real worker transport').toBe(2);
expect(failed.service.workerGenerationsStarted,
'the two parallel requests must share one worker generation').toEqual([1]);
expect(failed.service.pending, 'fail-all must drain the failed generation').toBe(0);
expect(failed.service.retiredGenerations, 'generation 1 must be retired').toEqual([1]);
expect(failed.service.activeGeneration, 'the failed slot must be cleared').toBeNull();
expect(failed.service.armed, 'the one-shot fault must be consumed').toBe(false);
console.log(`[TEST-OCC] native fault dialog labels: ${JSON.stringify(failed.labels)}`);
// Resolve the parent action before dismissing the child, then reuse its
// exact DOM identity. This prevents a label/geometry re-query from
// turning the handback race into a click on some replacement control.
const retryExport = await findWxButton(page, 'Export');
expect(retryExport, 'the original parent Export button must remain registered').not.toBeNull();
expect(retryExport?.domId,
'the retry must target a stable DOM-backed wx button').toBeGreaterThan(0);
expect(await clickWxButton(page, 'OK'), 'dismiss native export failure').toBe(true);
// page.mouse.click() completes when the browser has delivered the OK
// input, not when the nested native modal has unwound. The parent
// export dialog is intentionally non-interactive until that exact
// child lease closes. Wait for the scheduler's observable modal
// count to return from {export + failure} to {export} before clicking
// through to the parent.
await expect.poll(
() => page.evaluate(() => {
const scheduler = (globalThis as any).__wxScheduler;
return scheduler?.pendingWaits?.('modal') ?? -1;
}),
{ message: 'the failure child must retire before retrying its parent', timeout: 10000 },
).toBe(1);
// The export dialog remains open. Its next request must create a fresh
// generation and complete through the actual OCC module.
if (!retryExport) throw new Error('parent Export button disappeared before retry');
await clickWxButtonTarget(page, retryExport);
await expect.poll(
() => page.evaluate(() => (globalThis as any)
.__occServiceTestHooks.snapshot().requestsStarted),
{
message: 'the exact parent retry must enter the OCC provider once',
timeout: 10000,
},
).toBe(failed.service.requestsStarted + 1);
await expect.poll(
() => page.evaluate(() => (globalThis as any)
.__occServiceTestHooks.snapshot().activeGeneration),
{ message: 'the retry must boot a replacement worker generation', timeout: 30000 },
).toBe(2);
await page.waitForFunction(
() => ((window as any).__occExports?.length ?? 0) === 1,
null,
{ timeout: 180000 },
);
const recovered = await page.evaluate(() => {
const runtime = globalThis as any;
return {
exports: runtime.__occExports,
service: runtime.__occServiceTestHooks.snapshot(),
schedulerDead: runtime.__wxScheduler?.dead === true,
occWaits: runtime.__wxScheduler?.pendingWaits?.('occ') ?? -1,
};
});
expect(recovered.exports).toHaveLength(1);
expect(recovered.exports[0].magic.startsWith('ISO-10303-21'), 'retry returns real STEP bytes')
.toBe(true);
expect(recovered.exports[0].size, 'retry returns a non-trivial STEP file')
.toBeGreaterThan(10_000);
expect(recovered.service.activeGeneration, 'retry must own a replacement generation').toBe(2);
expect(recovered.service.requestsStarted,
'the parent retry must add exactly one provider entry').toBe(3);
expect(recovered.service.requestsPosted,
'the parent retry must post exactly once to the replacement worker').toBe(3);
expect(recovered.service.workerGenerationsStarted,
'the retry must create exactly one replacement generation').toEqual([1, 2]);
expect(recovered.service.pending, 'replacement generation must quiesce').toBe(0);
expect(recovered.schedulerDead, 'the worker failure must not terminalize the editor').toBe(false);
expect(recovered.occWaits, 'the replacement native OCC wait must quiesce').toBe(0);
await page.waitForTimeout(1000); // eslint-disable-line -- documented interaction dwell
await clickWxButton(page, 'OK');
});
});

View file

@ -66,12 +66,18 @@ EM_JS( void, js_occExportStart,
const jobJson = UTF8ToString( aJobJson );
const fileName = UTF8ToString( aFileName );
// E-8: all native work (malloc + heap writes) runs inside the scheduler's
// completion gate — a dead or trapped instance drops the completion
// loudly instead of re-entering wasm, and a trap inside the prepare
// latches the instance terminal without resolving the wait.
const finish = ( res ) => {
const s = JSON.stringify( res || { ok: false, report: 'occ_service: no response' } );
const n = lengthBytesUTF8( s ) + 1;
const p = _malloc( n );
stringToUTF8( s, p, n );
globalThis.__wxScheduler.resolveWait( aToken, p );
globalThis.__wxScheduler.runWaitCompletion( 'OCC export completion', aToken, () => {
const s = JSON.stringify( res || { ok: false, report: 'occ_service: no response' } );
const n = lengthBytesUTF8( s ) + 1;
const p = _malloc( n );
stringToUTF8( s, p, n );
return p;
} );
};
let req;
@ -168,6 +174,18 @@ bool EXPORTER_STEP::Export()
const wxString downloadName = wxFileName( m_outputFile ).GetFullName();
const int token = wxWasmBeginWait( "occ" );
// Token 0 = the scheduler refused the wait (dead or terminal instance):
// never start an RPC whose completion could not be admitted.
if( token <= 0 )
{
if( m_reporter )
m_reporter->Report( wxT( "occ_service: scheduler unavailable" ), RPT_SEVERITY_ERROR );
wxRemoveFile( wxString::FromUTF8( TMP_BOARD ) );
return false;
}
js_occExportStart( token, TMP_BOARD, jobJson.c_str(), downloadName.utf8_string().c_str() );
// The malloc'd JSON pointer rides the wait as an int32.

View file

@ -67,11 +67,18 @@ EM_JS( void, js_occLoadModelStart, ( int aToken, const char* aModelPath ),
{
const modelPath = UTF8ToString( aModelPath );
const finish = ( cachePath ) => {
const n = lengthBytesUTF8( cachePath ) + 1;
const p = _malloc( n );
stringToUTF8( cachePath, p, n );
globalThis.__wxScheduler.resolveWait( aToken, p );
// E-8: all native work (the MEMFS cache write + the malloc'd path) runs
// inside the scheduler's completion gate — a dead or trapped instance
// drops the completion loudly instead of re-entering wasm, and a trap
// inside the prepare latches the instance terminal without resolving.
const finish = ( writeCache ) => {
globalThis.__wxScheduler.runWaitCompletion( 'OCC model completion', aToken, () => {
const cachePath = writeCache();
const n = lengthBytesUTF8( cachePath ) + 1;
const p = _malloc( n );
stringToUTF8( cachePath, p, n );
return p;
} );
};
let req;
@ -100,22 +107,26 @@ EM_JS( void, js_occLoadModelStart, ( int aToken, const char* aModelPath ),
}
req.then( ( res ) => {
let cachePath = '';
finish( () => {
let cachePath = '';
if( res && res.ok && res.bytes && res.bytes.length )
{
cachePath = '/tmp/pcbjam_occ_model_cache.3dc';
FS.writeFile( cachePath, res.bytes );
}
else if( res && res.report )
{
console.error( '[pcbjam-occ] loadModel failed:', res.report );
}
if( res && res.ok && res.bytes && res.bytes.length )
{
cachePath = '/tmp/pcbjam_occ_model_cache.3dc';
FS.writeFile( cachePath, res.bytes );
}
else if( res && res.report )
{
console.error( '[pcbjam-occ] loadModel failed:', res.report );
}
finish( cachePath );
return cachePath;
} );
} ).catch( ( e ) => {
// The gate makes this fallback inert after a trap or shutdown — it
// cannot repeat native work in a damaged instance.
console.error( '[pcbjam-occ] loadModel request failed:', e );
finish( '' );
finish( () => '' );
} );
} )
@ -225,6 +236,11 @@ SCENEGRAPH* oce3d_Load( char const* aFileName )
return nullptr;
const int token = wxWasmBeginWait( "occ" );
// Token 0 = the scheduler refused the wait (dead or terminal instance).
if( token <= 0 )
return nullptr;
js_occLoadModelStart( token, aFileName );
// The malloc'd path pointer rides the wait as an int32.

View file

@ -60,12 +60,17 @@ using nlohmann::json;
// microtask (the early-resolve contract, doc 22 §10 Phase E retry entry).
// clang-format off
EM_JS( void, js_ngspice_request_start, ( int aToken, const char* aReqJson ), {
// E-8: the malloc + heap writes run inside the scheduler's completion
// gate — a dead or trapped instance drops the completion loudly instead
// of re-entering wasm.
const finish = ( res ) => {
const s = JSON.stringify( res ?? {} );
const n = lengthBytesUTF8( s ) + 1;
const p = _malloc( n );
stringToUTF8( s, p, n );
globalThis.__wxScheduler.resolveWait( aToken, p );
globalThis.__wxScheduler.runWaitCompletion( 'ngspice request completion', aToken, () => {
const s = JSON.stringify( res ?? {} );
const n = lengthBytesUTF8( s ) + 1;
const p = _malloc( n );
stringToUTF8( s, p, n );
return p;
} );
};
let req;
try {
@ -90,7 +95,6 @@ EM_JS( void, js_ngspice_request_start, ( int aToken, const char* aReqJson ), {
EM_JS( void, js_ngspice_get_vec_start,
( int aToken, const char* aName, int* aMeta, double** aReal, double** aComp,
char** aVName ), {
const finish = ( status ) => globalThis.__wxScheduler.resolveWait( aToken, status );
let req;
try {
const svc = globalThis.ngspiceService;
@ -100,35 +104,41 @@ EM_JS( void, js_ngspice_get_vec_start,
} catch( e ) {
req = Promise.resolve( { error: String( e ) } );
}
// E-8: every output-pointer write happens inside the scheduler's
// completion gate, so a dead or trapped instance is never written to.
// A plain JS failure inside the prepare resolves the inertResult (1 =
// transport error) so the parked caller fails instead of stranding.
req.catch( ( e ) => ( { error: String( e ) } ) ).then( ( res ) => {
HEAP32[aMeta >> 2] = 0;
HEAPU32[aReal >> 2] = 0;
HEAPU32[aComp >> 2] = 0;
HEAPU32[aVName >> 2] = 0;
if( !res || res.error )
return finish( 1 );
if( !res.found )
return finish( 0 );
HEAP32[( aMeta >> 2 ) + 1] = res.vtype | 0;
HEAP32[( aMeta >> 2 ) + 2] = res.flags | 0;
HEAP32[( aMeta >> 2 ) + 3] = res.length | 0;
if( res.real && res.real.length ) {
const p = _malloc( res.real.length * 8 );
HEAPF64.set( res.real, p >> 3 );
HEAPU32[aReal >> 2] = p;
}
if( res.comp && res.comp.length ) {
const p = _malloc( res.comp.length * 8 );
HEAPF64.set( res.comp, p >> 3 );
HEAPU32[aComp >> 2] = p;
}
const s = res.vname || '';
const n = lengthBytesUTF8( s ) + 1;
const vp = _malloc( n );
stringToUTF8( s, vp, n );
HEAPU32[aVName >> 2] = vp;
HEAP32[aMeta >> 2] = 1;
finish( 0 );
globalThis.__wxScheduler.runWaitCompletion( 'ngspice vector completion', aToken, () => {
HEAP32[aMeta >> 2] = 0;
HEAPU32[aReal >> 2] = 0;
HEAPU32[aComp >> 2] = 0;
HEAPU32[aVName >> 2] = 0;
if( !res || res.error )
return 1;
if( !res.found )
return 0;
HEAP32[( aMeta >> 2 ) + 1] = res.vtype | 0;
HEAP32[( aMeta >> 2 ) + 2] = res.flags | 0;
HEAP32[( aMeta >> 2 ) + 3] = res.length | 0;
if( res.real && res.real.length ) {
const p = _malloc( res.real.length * 8 );
HEAPF64.set( res.real, p >> 3 );
HEAPU32[aReal >> 2] = p;
}
if( res.comp && res.comp.length ) {
const p = _malloc( res.comp.length * 8 );
HEAPF64.set( res.comp, p >> 3 );
HEAPU32[aComp >> 2] = p;
}
const s = res.vname || '';
const n = lengthBytesUTF8( s ) + 1;
const vp = _malloc( n );
stringToUTF8( s, vp, n );
HEAPU32[aVName >> 2] = vp;
HEAP32[aMeta >> 2] = 1;
return 0;
}, /* inertResult = */ 1 );
} );
} );
@ -138,30 +148,60 @@ extern "C" int wxWasmYieldUntil( int aToken );
// Event dispatcher: provider `{ evt }` frames -> KiCad's registered callbacks
// via the exported pcbjam_ngspice_event (fresh wasm entries; see header
// comment). Installed once, at first pcbjam_ngSpice_Init.
// comment).
//
// E-5: the handler is bound to the EXACT installing module, not to whatever
// `Module` lexically means when an event later arrives. Presence is not
// identity: the old install-once guard let a replacement module (trap
// recovery is module replacement — cross-ref G-8) keep the retired module's
// handler, whose closure drove the dead instance's heap. Re-installation is
// idempotent only for the same module; a different module replaces the
// handler, and a superseded handler disarms itself.
EM_JS( void, js_ngspice_install_events, (), {
if( globalThis.__ngspiceOnEvent )
const installingModule = Module;
const installed = globalThis.__ngspiceOnEvent;
if( installed && installed.__pcbjamNgspiceOwnerModule === installingModule )
return;
globalThis.__ngspiceOnEvent = ( evt ) => {
const handler = ( evt ) => {
if( globalThis.__ngspiceOnEvent !== handler )
return; // superseded install — never drive a retired module
const sched = globalThis.__wxScheduler;
if( !sched || !sched.canTouchNative || !sched.canTouchNative() ) {
// E-8/M-2: a dead or terminal instance takes no native entry; the
// drop is loud, never silent.
console.warn( '[sharedspice_client] dropping ngspice event for a '
+ 'dead/terminal module' );
return;
}
const call = ( kind, text, a, b ) => {
let p = 0;
if( text != null ) {
const n = lengthBytesUTF8( text ) + 1;
p = _malloc( n );
p = installingModule._malloc( n );
stringToUTF8( text, p, n );
}
Module._pcbjam_ngspice_event( kind, p, a | 0, b | 0 );
installingModule._pcbjam_ngspice_event( kind, p, a | 0, b | 0 );
};
if( evt.kind === 'char' || evt.kind === 'stat' ) {
for( const line of evt.lines || [] )
call( evt.kind === 'char' ? 0 : 1, line, 0, 0 );
} else if( evt.kind === 'bg' ) {
call( 2, null, evt.finished ? 1 : 0, 0 );
} else if( evt.kind === 'exit' ) {
call( 3, null, evt.status | 0,
( evt.immediate ? 1 : 0 ) | ( evt.quit ? 2 : 0 ) );
try {
if( evt.kind === 'char' || evt.kind === 'stat' ) {
for( const line of evt.lines || [] )
call( evt.kind === 'char' ? 0 : 1, line, 0, 0 );
} else if( evt.kind === 'bg' ) {
call( 2, null, evt.finished ? 1 : 0, 0 );
} else if( evt.kind === 'exit' ) {
call( 3, null, evt.status | 0,
( evt.immediate ? 1 : 0 ) | ( evt.quit ? 2 : 0 ) );
}
} catch( e ) {
// A trap on this fresh entry poisons the instance: latch the
// terminal gate so no later completion re-enters it.
if( !sched._terminalizeNativeTrap
|| !sched._terminalizeNativeTrap( 'ngspice event entry', e ) )
throw e;
}
};
handler.__pcbjamNgspiceOwnerModule = installingModule;
globalThis.__ngspiceOnEvent = handler;
} );
// clang-format on
@ -184,6 +224,12 @@ std::atomic<bool> s_bgRunning{ false };
json rpc( const json& aReq )
{
const int token = wxWasmBeginWait( "ngspice" );
// Token 0 = the scheduler refused the wait (dead or terminal instance):
// never start an RPC whose completion could not be admitted.
if( token <= 0 )
return json{ { "error", "wx scheduler unavailable" } };
js_ngspice_request_start( token, aReq.dump().c_str() );
// The malloc'd JSON pointer rides the wait as an int32.
@ -359,6 +405,24 @@ extern "C" EMSCRIPTEN_KEEPALIVE void pcbjam_ngspice_event( int aKind, char* aTex
std::free( aText );
}
// E-9: a destroyed NGSPICE must unregister its callbacks — a late worker
// event otherwise reaches s_sendChar( text, 0, s_user ) with s_user pointing
// at the destroyed object (use-after-free after simulator close; the E-7
// run-generation gate sits downstream in the wx event queue and cannot cover
// this entry). Identity-checked so a stale destructor never clears a
// successor instance's registration.
extern "C" EMSCRIPTEN_KEEPALIVE void pcbjam_ngspice_reset_callbacks( void* aUser )
{
if( s_user != aUser )
return;
s_sendChar = nullptr;
s_sendStat = nullptr;
s_controlledExit = nullptr;
s_bgThreadRunning = nullptr;
s_user = nullptr;
}
// -------------------------------------------------------------------------
// The sharedspice API surface NGSPICE::init_dll binds to
// -------------------------------------------------------------------------
@ -430,6 +494,11 @@ pvector_info pcbjam_ngGet_Vec_Info( char* aVecName )
char* vname = nullptr;
const int token = wxWasmBeginWait( "ngspice" );
// Token 0 = the scheduler refused the wait (dead or terminal instance).
if( token <= 0 )
return nullptr;
js_ngspice_get_vec_start( token, aVecName ? aVecName : "", meta, &real, &comp, &vname );
if( wxWasmYieldUntil( token ) != 0 )

View file

@ -24,6 +24,14 @@ type SchedulerShape = {
mutatorQueue: unknown[];
mutatorsDelivered: number;
dead: boolean;
terminal: boolean;
canTouchNative(): boolean;
runWaitCompletion(
site: string,
token: number,
prepare: () => number,
inertResult?: number,
): boolean;
shutdown(reason: string): void;
enqueueAfter(fn: number, arg: number, ms: number): void;
_openBusy(): boolean;
@ -229,3 +237,121 @@ describe("N5: scheduler shim under flood", () => {
await expect(S.waitPromise(99999), "unknown token resolves 0").resolves.toBe(0);
});
});
describe("E-8: runWaitCompletion admission gate for worker completions", () => {
it("runs prepare immediately and resolves the wait with its result", async () => {
const S = loadShim({ busy: () => false });
const token = S.beginWait("occ");
let ran = false;
expect(
S.runWaitCompletion("test completion", token, () => {
ran = true;
return 42;
}),
).toBe(true);
expect(ran, "prepare runs immediately, never queued").toBe(true);
await expect(S.waitPromise(token)).resolves.toBe(42);
});
it("drops a completion for a stale or already-resolved token, loudly", () => {
const S = loadShim({ busy: () => false });
const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
try {
const prepare = vi.fn(() => 1);
expect(S.runWaitCompletion("late frame", 99999, prepare)).toBe(false);
const token = S.beginWait("occ");
S.resolveWait(token, 7);
expect(S.runWaitCompletion("late frame", token, prepare)).toBe(false);
expect(prepare, "stale completions never touch native").not.toHaveBeenCalled();
expect(warn).toHaveBeenCalledTimes(2);
} finally {
warn.mockRestore();
}
});
it("a dead instance admits no native work and does not resolve the wait", () => {
const S = loadShim({ busy: () => false });
const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
try {
const token = S.beginWait("ngspice");
S.shutdown("test");
expect(S.canTouchNative()).toBe(false);
const prepare = vi.fn(() => 1);
expect(S.runWaitCompletion("post-shutdown", token, prepare)).toBe(false);
expect(prepare).not.toHaveBeenCalled();
expect(S.waitEarlyResolved(token), "wait deliberately not resolved").toBe(0);
} finally {
warn.mockRestore();
}
});
it("a trap in prepare latches terminal and never resolves the wait", () => {
const S = loadShim({ busy: () => false });
const err = vi.spyOn(console, "error").mockImplementation(() => {});
const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
try {
const token = S.beginWait("occ");
expect(
S.runWaitCompletion("trapping completion", token, () => {
throw new WebAssembly.RuntimeError("memory access out of bounds");
}),
).toBe(false);
expect(S.terminal).toBe(true);
expect(S.canTouchNative()).toBe(false);
// Resolving would resume the parked frame INSIDE the trapped module.
expect(S.waitEarlyResolved(token)).toBe(0);
// Every later completion is inert…
const prepare = vi.fn(() => 1);
const token2Before = S.beginWait("occ");
expect(token2Before, "beginWait refuses on a terminal instance").toBe(0);
expect(S.runWaitCompletion("after trap", token, prepare)).toBe(false);
expect(prepare).not.toHaveBeenCalled();
} finally {
err.mockRestore();
warn.mockRestore();
}
});
it("classifies cross-realm trap strings as terminal too", () => {
const S = loadShim({ busy: () => false });
const err = vi.spyOn(console, "error").mockImplementation(() => {});
try {
const token = S.beginWait("occ");
S.runWaitCompletion("cross-realm trap", token, () => {
throw new Error("RuntimeError: unreachable");
});
expect(S.terminal).toBe(true);
expect(S.waitEarlyResolved(token)).toBe(0);
} finally {
err.mockRestore();
}
});
it("a plain JS bug fails the wait with inertResult instead of stranding it", async () => {
const S = loadShim({ busy: () => false });
const err = vi.spyOn(console, "error").mockImplementation(() => {});
try {
const token = S.beginWait("ngspice");
expect(
S.runWaitCompletion(
"buggy completion",
token,
() => {
throw new TypeError("res.lines is not iterable");
},
1,
),
).toBe(false);
expect(S.terminal, "a JS bug is not a trap").toBe(false);
await expect(S.waitPromise(token), "wait fails instead of stranding").resolves.toBe(1);
} finally {
err.mockRestore();
}
});
it("beginWait refuses (token 0) on a dead instance", () => {
const S = loadShim({ busy: () => false });
S.shutdown("test");
expect(S.beginWait("occ")).toBe(0);
});
});