[tannevaled]

socket: Thread#kill can interrupt a blocked accept — the unblock function

threadRelease runs its fn to completion, so a Thread#kill arriving while a
thread is parked in accept(2) is only noticed after fn returns — which,
for an accept nobody will connect to, is never.

	MRI 4.0.6	rbgo before	rbgo after
alive? after t.kill	false at 0.1 s	still true at 3.0 s	false at 0.1 s

Same program both sides, the one in #933.

The mechanism

MRI's answer is the unblock function of rb_thread_call_without_gvl, whose
job is to make the call return. rbgo already had the other half:
interruptibleWait selects on the thread's interrupt channel for every wait
rbgo owns — join, Queue#pop, Mutex#lock. A wait the kernel owns cannot
go into a select, so ioBlockCancel puts a watcher on that same channel and
calls a cancel function instead: SetDeadline(now), which makes the call return
without closing anything.

Two details the design had to get right, both written down before any code:

• net.Listener does not declare SetDeadline — the interface is
  Accept/Close/Addr. The capability is asked for (socketDeadliner)
  rather than assumed, and the deadline is cleared afterwards so a listener that
  outlives the interrupted thread still accepts.
• ⛔ An interrupted wait is not a failed one. The error after cancelling is
  the deadline we set ourselves; raising it would hand a killed thread an
  IOError MRI never raises. accept returns instead, and the thread unwinds at
  its next safepoint — which is what safepoints are for.

The answer travels on a channel, not a shared bool: a flag written by the
watcher and read by the caller is a data race, and -race would say so.

⛔ My own GVL gate refused this first

ioBlockCancel is a new releaser, so the Accept inside it read as unwrapped
until the wrapper was named in the one map where that exemption lives.
Inferring it would have defeated the point of the map. That is the gate from
#924 catching the author of the gate, one day later.

Measured, and one number deliberately not quoted

library/socket/tcpserver/accept_spec.rb — the exact file whose site this
changes — is gone from the kill list: nine files killed by the clock across
library/socket + library/timeout before, eight after.

⛔ The passing-example delta from that sweep is not quoted, because the
control is broken there: MRI scores 7 on those 190 files. The cause is now
known — library/socket/spec_helper.rb calls MSpec.enable_feature, and the
conformance shim defines no MSpec, so the reference stops at load. A control
that scores 7 measures nothing, and +217 against it would mean nothing.

Why one site and not twelve

Twelve ioBlock sites remain (socket.go ×6, socket_raw.go ×6). Each needs
its own canceller — listener, conn, packet conn — and its own decision about the
error it returns. Converting them all in one change, each with its own
concurrency semantics, is how a race gets shipped; this lands the primitive with
one site proven end to end against the reference, which is the same ratchet
argument this repository already uses for the GVL gate itself.

The remaining sites are listed in #933 as the follow-up, and the seven
library/socket files still killed name them precisely: recv, send,
recvfrom, connect_nonblock, tcp_server_loop, udp_server_loop,
unixserver/accept.

112 tests pass under -race, no data race, gate green at 33 calls.

Refs #933, #916, #924

(#933 stays open: one site of thirteen is converted. #916 stays open: eight
files still hang. #924 is the merged pull request whose gate refused this one
until the new wrapper was named.)

🤖 Generated with Claude Code