emqx / esockd / 578

67%

master: 67%

Pull #225

github

fix: verify countdown timer liveness and re-arm it if dead

The countdown timer was trusted through the `timer` state field alone:
branches that found the field set did nothing, so nothing distinguished
"a timer is armed" from "the state says a timer is armed". If the timer
ever died (cancelled externally, or its reference replaced while a tick
was still in flight) while the field kept pointing at it, the countdown
froze silently - the same permanent-stall failure mode as the schedule
bug fixed previously.

Make the invariant structural instead of assumed:

- arm_countdown_timer/2: the single arming point, clamping the timeout
  to at least 1ms (start_timer crashes on a negative timeout and arms
  a never-firing timer on zero) and arming only while buckets exist, so
  an idle limiter no longer ticks once per second forever
- ensure_countdown_timer/1: verifies the reference against
  erlang:read_timer/1 - the actual liveness, not the field - and re-arms
  a dead timer; every callback touching the countdown map now ends here
  (create, update, delete, and every countdown tick)
- a stale countdown tick (reference no longer matching the state)
  re-establishes the invariant instead of falling into the unexpected
  message log

Tests: externally cancel the timer and verify a config touch re-arms it
and buckets keep refilling; inject stale ticks against both a live and
a dead timer; verify no timer exists without buckets and that the last
pending tick winds down after the final delete.

11 of 11 new or added lines in 1 file covered. (100.0%)

714 of 1057 relevant lines covered (67.55%)

206.48 hits per line