Fault injection and chaos tests for the pool - #929
Open
benoitc wants to merge 4 commits into
Open
Conversation
Convert a connection call timeout into a checkout error. The pool must not terminate just because a DNS/TCP/TLS attempt outlives its timeout. Fixes: #927
Only exit:{timeout, _} was caught, so a transport raising or the conn
being killed while dialing still took the pool down. Catch any exit from
the connect call and return it as a checkout error. The caller already
stops the conn on every error return.
Integration tests only exercise servers that answer, so nothing covered a connection that stalls, crashes, or dies mid-checkout, which is how #927 reached a release. Adds a transport that can be told to misbehave, a crash sentinel that makes a dead pool visible under error_logger:tty(false), a fault matrix over the checkout entry points, a randomized chaos run, and a structural test that fails on any unguarded call from the pool into a connection process. The structural test found three unguarded set_owner calls and the prewarm dial; they now go through guarded helpers. Stopping a connection from inside the pool is bounded too: a conn wedged in a transport call used to hold the pool for as long as the transport took to return.
Extends the fault harness to the multiplexed checkout paths, where a bad connection is worse than on the HTTP/1 path: HTTP/2 and HTTP/3 connections are shared, so every caller for that host goes through the same probe. h2_conn_usable claimed a short timeout but called get_state/1, which waits the default 5s, so one wedged connection stalled the pool for 5s per checkout. The is_ready, checkin_info and set_owner probes had the same 5s exposure. All four now take an explicit timeout and the pool passes 250ms: a connection that cannot answer a question about its own state at once is unusable to the pool, and waiting on it blocks every caller behind it. The new suite wedges a registered connection with sys:suspend/1 and fails if the pool waits on it. Before the change that scenario hit the eunit timeout; it now answers none in 252ms.
Owner
Author
|
Extended to the multiplexed checkout paths in 721cf78.
|
benoitc
marked this pull request as ready for review
August 11, 2026 18:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Based on #928, so it contains its two commits. Merge #928 first, a rebase then removes them.
Our tests only use servers which answer. Nothing covered a connection which stalls, crashes, or dies during a checkout, the case of #927.
New modules:
hackney_fault_transport, a transport identical tohackney_tcpuntil a fault is armed on one callback;hackney_crash_sentinel, which makes a dead pool visible undererror_logger:tty(false); fault tests for the checkout entry points and for the shared HTTP/2 and HTTP/3 connections; a chaos run, longer withHACKNEY_CHAOS_WORKERSandHACKNEY_CHAOS_ROUNDS; andhackney_pool_safety_tests, which reads the compiled code and fails if the pool calls a connection process outside atry.Three problems found, corrected here:
hackney_conn:set_owner/2and the prewarm dial.stop_connusedgen_statem:stop/1, which waits without limit, so after a dial timeout the pool stayed blocked for the whole duration of the transport call. It is now bounded to 100ms, then kills the connection.h2_conn_usable/1usedget_state/1, which waits 5s, so one blocked HTTP/2 connection blocked the pool 5s per checkout on that host.is_ready,checkin_infoandset_ownerhad the same problem. The four functions now take a timeout and the pool passes 250ms.eunit is green (1096 tests), xref and dialyzer are clean.
DEVELOPMENT.mdexplains how to arm a fault and how to run a longer chaos test.