node {16,17,18} doesn't respect spawn timeout and hangs

[aviadhahami]

Version

16.*

Platform

linux
Linux f092196b2008 5.10.104-linuxkit #1 SMP Thu Mar 17 17:08:06 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

What steps will reproduce the bug?

I've created a demo using docker so you can easily swap node versions and see the bug.
That being said, I'm sharing the tarball as bas64 because I wasn't sure if you'd like to download tarballs...that being said you may also not want to decode b64 🤷‍♂️

download here if you'd like: poc

or run the following:

base64 -d <<< H4sIACurxWIAA+1YbWvbMBDOZ/+KqzfqZCSyZcsxBLoLjpJp+fRKchuVA7HcQLfB912y9ZxSdkuAJi4Xey5PvE9cDAmJGiAX/3UGo2ZKMJcTiW8YGH8gJ90G40e6F+sY9W+ECB7OGNJ3Ek7+SxFYlJFjHX5x06wyr/nuzL/BHvdBjhVTOY+Xnn+32zZQ5baw1BMjCIc75gpjynudiZhOqa5acQ8Oqc56EMCnQLeSidAS7M8M9piPPcyavwlkP1Bp3LEElpVDMmHLiEP8B/7S/4T38eS/x7xSM3/TeDToP8NFOd7kvQiYVPD+N4ffP2wNwCbZ4Vh7PYPjgFJyhsf948Gxwf9vf0jOAGtE2YbTJbG9Bf6IUw4rVXg5QHZKpFnUx7PEiqqKQYfUf8RQhx9/+O6/tsIkL0kcHUx1um/G9zKv9dV+o+xV+v/JhDxVBRwLbLwMj28SqM57EBOf85YTptWNJFV31mW84gKYbUMQ3nzhKKEj5vWofoNS8cIIdm3GqFppdnUap9YTI4cJonVtpCdnY9l2+lc0HzIBbVO2zJmETPek24TmrPCakPBppTPih6WG/jOm7fuhtMBVCl6RWW45963/wU6NRX/B/AY/cdBIPnvup5b6/8mUOY/C6PzcEzlLcDTp4+xTv89n9zov0PU/e/X+r8ZXBsga/lwSs0emPIomG1lkDItGE+VDSMHOaU1piLKWVYsekrjNGT62+odoK2lo5AdKoA0ZDld3AfKmUYTDtYXmiQcRjmfgkgozaS437htWbC9rV8mgGzdrQaXg811gHN6dcnzWEU4OdWWcFZMeH4zsYRFNBV6XXuHu6Yxr++MP6Dk/3J/q4mx9v3vBff03wscXPN/E7hbYqljICs6SbtLVdLR4qgsyZrN1s77O66fOY9hynNVAFqtti7ZuurTAtuGEBJeyLqwpty/jnvvfykGTx/j8e9/3/fk/e8iVM2EbuOV879GjRqvF78BY21wXQAgAAA= > out.tar.gz

then tar -zxf out.tar.gz and you'll see the following files:

Dockerfile  build-n-run.sh  index.js  node_modules  pkg

you can run the build-n-run.sh that I've created (which is a silly 2liner), or build and run it yourself

Steps to Reproduce

1. Run something like:

const {spawnSync} = require('child_process')

console.log('Spawning...')
spawnSync('npm',['install','./pkg','--verbose'], {stdio:'inherit', timeout:1000*3})
console.log('spawner bye')

and make the package preinstall script for pkg to hang (via long setTimeout that will make it busy)
3. Expect ETIMEOUT, but get nothing

[mscdex]

Using 'sleep 10' as the command works for me.

Are you expecting a thrown exception? You need to be checking the return value of spawnSync() (specifically .error), as that is where you'll find the ETIMEDOUT error.

[aviadhahami]

I'd expect it to terminate at first, then check the status code;

wdym by sleep 10? did u try my poc?

[mscdex]

I'd expect it to terminate at first, then check the status code

When I tested, spawnSync() returned after 3 seconds (due to ETIMEDOUT). From there, you just check the various properties from the returned object.

wdym by sleep 10?

spawnSync('sleep',['10'], {stdio:'inherit', timeout:1000*3})

did u try my poc?

No, 'sleep 10' should be equivalent.

[aviadhahami]

interesting; I'm checking this in the above env

[aviadhahami]

you are not wrong - I can reproduce it as well;
That being said - my POC still works. I'll try to reduce it to the bare minimum, I have a feeling it has to do with multiple children or so.

This is ps aux from the hanging container (with poc):

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.1  0.7 319640 31760 ?        Ssl  20:26   0:00 node index.js
root        13  1.1  1.4 907304 59800 ?        Sl   20:26   0:00 npm install ./pkg
root        24  0.0  0.0   2388   744 ?        S    20:26   0:00 sh -c echo 'Hello from sleeper preinstall!' && node ./sleep.
root        25  0.0  0.7 319640 31076 ?        Sl   20:26   0:00 node ./sleep.js
root        32  0.0  0.0   3868  3184 pts/0    Ss   20:26   0:00 /bin/bash
root      1209  0.0  0.0   7640  2760 pts/0    R+   20:27   0:00 ps aux

Minus the last 2 procs - the rest are the hanged

====

Update:
I'm unable to repro this using simple spawns, but yes every time using the npm install :\

[wa-Nadoo]

Please try to add killSignal: 'SIGKILL' option to spawn. By default spawn sends SIGTERM signal to child process that not enough for some programs.

[aviadhahami]

@wa-Nadoo this doesn't work either;
tho regardless of the signal itself -- I would expect it to terminate;
This works on node 14, but doesn't on 16;

[aviadhahami]

Checked, it reproduces on these node versions: 16,17,18

[lirantal]

@aviadhahami can you check if you're also using different npm versions along with those 16,17,18 runtime versions? I suspect that it's the npm executable specifically that is indeed not respecting/forwarding signals correctly to child processes that it spawns.

[aviadhahami]

For the supplied PoC, these are the versions:
node:16-slim - npm@8.11.0
node:17-slim - npm@8.11.0
node:18-slim - npm@8.12.1

[lirantal]

Ok, so pretty close version ranges so I assume no big changes there, although worth looking into the changelog and see if anything obvious comes up in the diff.

[benjamingr]

Does the issue reproduce when you manually when you spawn npm in these versions in a terminal and kill it from another terminal? (find it with ps and send it the same signal).

If it does this can/should be an NPM issue, I am also not able to reproduce this with a simple program and agree with Liran that it's probably a function of NPM versions