Uh oh!
There was an error while loading. Please reload this page.
Never block the event loop acquiring a connection permit - #2226
Merged
hyperxpro merged 4 commits intoJul 18, 2026
Merged
Conversation
On a redirect / 401 / 407 / retry replay, sendNextRequest re-enters NettyRequestSender.sendRequestWithNewChannel from AsyncHttpClientHandler.channelRead — on the Netty event loop. acquirePartitionLockLazily then called the connection semaphore's blocking acquireChannelLock (Semaphore.tryAcquire(acquireFreeChannelTimeout)), parking the event-loop thread for up to the configured timeout when a finite maxConnections / maxConnectionsPerHost limit is saturated. Blocking the loop stalls every other connection it serves, and the permit may only be released by a task queued on that same loop. The sibling waitForHttp2Connection already guards this with isOnEventLoop(); this path did not. Acquire the permit non-blocking when on the event loop: fail fast (the request still gets its single non-blocking HTTP/2-reuse poll before aborting) instead of parking the loop. Off the loop — the initial execute() on the caller thread — the configured blocking wait is unchanged. - ConnectionSemaphore: add a default acquireChannelLock(key, nonBlocking) overload (default delegates to the blocking form, so custom implementations are unaffected). - Max/PerHost/Combined limiters override it with a non-blocking tryAcquire(). - NettyResponseFuture.acquirePartitionLockLazily(boolean) threads the flag through; the call site passes isOnEventLoop(). Gated behind non-default config (a positive cap AND a positive acquireFreeChannelTimeout); inert under defaults. Adds SemaphoreTest coverage that the non-blocking acquire fails fast instead of waiting and that the default overload delegates.
hyperxpro
approved these changes
Jul 18, 2026
Uh oh!
There was an error while loading. Please reload this page.
hyperxpro added a commit
that referenced
this pull request
Jul 18, 2026
Motivation: #2226 made the connection-permit acquire non-blocking on the event loop. CombinedConnectionSemaphore's non-blocking path takes the global permit first and then the per-host permit, releasing the global one if the per-host permit is unavailable. That releaseGlobal branch is the single place the non-blocking path can leak the global permit, yet it had no coverage: the existing combinedNonBlockingFailsFastWhenExhausted uses equal global and per-host limits (1, 1), so the acquire is rejected at the global gate and never reaches the per-host rejection where releaseGlobal runs. Modification: Add combinedNonBlockingReleasesGlobalPermitWhenPerHostExhausted using a wider global limit (2) than per-host (1). The non-blocking acquire passes the global gate, is rejected by the per-host limit (asserted as TooManyConnectionsPerHostException), and a follow-up non-blocking acquire for a different host must succeed — proving the global permit taken during the failed attempt was released rather than leaked. Result: The global-permit release path of the non-blocking combined acquire is now covered; a regression that leaked the global permit on per-host rejection would starve other hosts of the global permit and fail this test.
hyperxpro added a commit
that referenced
this pull request
Jul 18, 2026
Motivation: #2226 made the connection-permit acquire non-blocking on the event loop. CombinedConnectionSemaphore's non-blocking path takes the global permit first and then the per-host permit, releasing the global one if the per-host permit is unavailable. That releaseGlobal branch is the single place the non-blocking path can leak the global permit, yet it had no coverage: the existing combinedNonBlockingFailsFastWhenExhausted uses equal global and per-host limits (1, 1), so the acquire is rejected at the global gate and never reaches the per-host rejection where releaseGlobal runs. Modification: Add combinedNonBlockingReleasesGlobalPermitWhenPerHostExhausted using a wider global limit (2) than per-host (1). The non-blocking acquire passes the global gate, is rejected by the per-host limit (asserted as TooManyConnectionsPerHostException), and a follow-up non-blocking acquire for a different host must succeed; proving the global permit taken during the failed attempt was released rather than leaked. Result: The global-permit release path of the non-blocking combined acquire is now covered; a regression that leaked the global permit on per-host rejection would starve other hosts of the global permit and fail this test.
hyperxpro added a commit
that referenced
this pull request
Jul 18, 2026
Motivation: #2226 made the connection-permit acquire non-blocking on the event loop. CombinedConnectionSemaphore's non-blocking path takes the global permit first and then the per-host permit, releasing the global one if the per-host permit is unavailable. That releaseGlobal branch is the single place the non-blocking path can leak the global permit, yet it had no coverage: the existing combinedNonBlockingFailsFastWhenExhausted uses equal global and per-host limits (1, 1), so the acquire is rejected at the global gate and never reaches the per-host rejection where releaseGlobal runs. Modification: Add combinedNonBlockingReleasesGlobalPermitWhenPerHostExhausted using a wider global limit (2) than per-host (1). The non-blocking acquire passes the global gate, is rejected by the per-host limit (asserted as TooManyConnectionsPerHostException), and a follow-up non-blocking acquire for a different host must succeed; proving the global permit taken during the failed attempt was released rather than leaked. Result: The global-permit release path of the non-blocking combined acquire is now covered; a regression that leaked the global permit on per-host rejection would starve other hosts of the global permit and fail this test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On a redirect / 401 / 407 / retry replay, sendNextRequest re-enters NettyRequestSender.sendRequestWithNewChannel from AsyncHttpClientHandler.channelRead — on the Netty event loop. acquirePartitionLockLazily then called the connection semaphore's blocking acquireChannelLock (Semaphore.tryAcquire(acquireFreeChannelTimeout)), parking the event-loop thread for up to the configured timeout when a finite maxConnections / maxConnectionsPerHost limit is saturated. Blocking the loop stalls every other connection it serves, and the permit may only be released by a task queued on that same loop. The sibling waitForHttp2Connection already guards this with isOnEventLoop(); this path did not.
Acquire the permit non-blocking when on the event loop: fail fast (the request still gets its single non-blocking HTTP/2-reuse poll before aborting) instead of parking the loop. Off the loop — the initial execute() on the caller thread — the configured blocking wait is unchanged.
Gated behind non-default config (a positive cap AND a positive acquireFreeChannelTimeout); inert under defaults. Adds SemaphoreTest coverage that the non-blocking acquire fails fast instead of waiting and that the default overload delegates.