[Bug]: Exception raised by a signal handler kills the sync dispatcher fiber, every later sync call spins at 100% CPU

[tiptop32]

Version

1.63.0 (also 1.52.0)

Steps to reproduce

import signal

from playwright.sync_api import sync_playwright


class TestTimeout(Exception):
    pass


def on_alarm(signum, frame):
    raise TestTimeout()  # what pytest-timeout does with timeout_method=signal


with sync_playwright() as p:
    browser = p.chromium.launch()
    page = browser.new_page()

    signal.signal(signal.SIGALRM, on_alarm)
    signal.alarm(1)
    try:
        page.wait_for_timeout(5000)  # any call that is still pending when the signal arrives
    except TestTimeout:
        print("timeout delivered; dispatcher dead:", page._dispatcher_fiber.dead)

    print("calling Playwright again...")
    print(page.title())  # never returns: spins at 100% CPU
    print("unreachable")

The same thing with pytest-timeout, which is how we hit it:

import pytest
from playwright.sync_api import sync_playwright


@pytest.fixture(scope="session")
def browser():
    with sync_playwright() as p:
        browser = p.chromium.launch()
        yield browser
        browser.close()


@pytest.mark.timeout(1)
def test_slow(browser):
    page = browser.new_page()
    page.wait_for_timeout(5000)


def test_next(browser):
    page = browser.new_page()  # hangs forever, the session never finishes
    assert page.title() == ""

pytest test_repro.py -o timeout_method=signal

Expected behavior

The exception from the signal handler reaches the code that made the sync call (it does), and Playwright stays usable: page.title() returns, test_next passes.

Actual behavior

timeout delivered; dispatcher dead: True
calling Playwright again...

and then the process spins at 99% CPU forever. With pytest, test_slow fails with Failed: Timeout, then test_next (and the session fixture teardown) hang the same way.

A sync call blocks inside SyncBase._sync() in self._dispatcher_fiber.switch(), so the interpreter is running the dispatcher fiber (loop.run_until_complete(...) inside selector.select()) when the signal arrives. Python runs the handler in that frame, so the exception is raised inside the dispatcher fiber. It unwinds run_until_complete and greenlet_main, the fiber dies, and greenlet passes the exception to its parent, which is the greenlet waiting in _sync(). That part looks right. But from then on while not task.done(): self._dispatcher_fiber.switch() returns immediately on every iteration, because the switch goes to a dead greenlet.

Traceback of the timeout from our CI (1.52.0, Linux) shows where the signal lands:

  File ".../playwright/sync_api/_generated.py", line 16713, in count
    return mapping.from_maybe_impl(self._sync(self._impl_obj.count()))
  File ".../playwright/_impl/_sync_base.py", line 113, in _sync
    self._dispatcher_fiber.switch()
  File ".../playwright/sync_api/_context_manager.py", line 56, in greenlet_main
    self._loop.run_until_complete(self._connection.run_as_sync())
  File ".../asyncio/base_events.py", line 1898, in _run_once
    event_list = self._selector.select(timeout)
  File ".../selectors.py", line 468, in select
    fd_event_list = self._selector.poll(timeout, max_ev)
  File ".../pytest_timeout.py", line 317, in handler
    timeout_sigalrm(item, settings)
  File ".../pytest_timeout.py", line 502, in timeout_sigalrm
    pytest.fail(PYTEST_FAILURE_MESSAGE % settings.timeout)
  File ".../_pytest/outcomes.py", line 163, in __call__
    raise Failed(msg=reason, pytrace=pytrace)

In our CI the next call was the failure screenshot in a pytest_runtest_makereport hook. It spun until the job-level SIGINT, and the test ended up reported as passed in Allure, although its step had failed with the timeout.

Additional context

Related: #3187 adds a dispatcher_fiber.dead check to _sync(), so the next call raises TargetClosedError instead of spinning. That would turn the hang into an error, but the Playwright instance would still be unusable after a timeout, so every following test in the worker would fail. That PR covers a different trigger (the transport ends without Connection.cleanup()); a signal handler is a second way to reach the same loop.

What works for us as a workaround: a custom pytest_timeout_set_timer whose handler checks where it is running. When the current greenlet has a parent (that is, we are inside the dispatcher or an event listener fiber), it wakes the event loop and throws the exception into the root greenlet instead of raising it in place:

def handler(signum, frame):
    try:
        timeout_sigalrm(item, settings)  # pytest-timeout: raises Failed
    except pytest.fail.Exception as exc:
        current = greenlet.getcurrent()
        root = current
        while root.parent is not None:
            root = root.parent
        if root is current:
            raise
        # select() was entered with a timeout computed before the next call's task
        # existed, so without a wakeup the next call is never sent to the driver
        asyncio.get_running_loop().call_soon_threadsafe(lambda: None)
        root.throw(exc)

The dispatcher stays alive, the pending task is just orphaned, and later calls work: a screenshot of a frozen page fails with its own TimeoutError, page.close() and context.close() complete, and a new page opens in the same browser.

Doing this inside Playwright (for example, when a BaseException escapes run_until_complete in greenlet_main while a call is pending, throw it into the waiting greenlet and keep the loop running) would make sync Playwright safe under pytest-timeout's default signal method. If that is out of scope, a note in the docs that signal-based timeouts break the sync API would help too.

Environment

- Operating System: macOS 15.7.9 (repro above); Linux in Docker (CI, 1.52.0)
- CPU: arm64 (repro above)
- Browser: Chromium
- Python Version: 3.11.14
- Other info: greenlet 3.5.6, pytest 9.1.1, pytest-timeout 2.4.0

[gchai]

Confirming this on Playwright 1.63.0 (Python 3.14.6 on macOS arm64; pytest 9.1.1, pytest-timeout 2.4.0, greenlet 3.5.1). We hit it in a Linux CI suite: one pytest worker made no progress for about an hour and then had to be SIGKILLed, and the JUnit report it had written held zero testcases. We have no stack from CI itself, only from local reproductions of the same shape. Some details that may help whoever picks this up:

1. One SIGINT does not end the process. With the pytest repro from the description, the first SIGINT only breaks the first spin (in test_next). pytest then runs session teardown, where the browser fixture's browser.close() hits the dead dispatcher and spins again; a second SIGINT ends it. A runner that sends one SIGINT and waits a grace period before SIGKILL therefore ends up SIGKILLing. The main-thread stack about 8 seconds after the first SIGINT:

File ".../playwright/_impl/_sync_base.py", line 113, in _sync
File ".../playwright/sync_api/_generated.py", line 16537, in close
File "test_repro.py", line 10, in browser        # browser.close() in the session fixture
File ".../_pytest/fixtures.py", line 1014, in _teardown_yield_fixture
File ".../_pytest/runner.py", line 112, in pytest_sessionfinish

2. The alarm does not have to land in a test body. With pytest-timeout's default timeout_func_only = false, the per-test timeout also covers fixture setup. A slow session-scoped fixture that drives its own browser is enough: the first test's timeout fires inside the fixture, and the spin is in the Browser.close() of its finally. A sync call blocked inside an event handler (page.on("console", ...) with a handler that calls page.wait_for_timeout(...)) wedges the same way.

3. The workaround in the description works. Its snippet shows only the handler, so here is a complete conftest.py that installs it. It replaces pytest-timeout's signal timer; other methods, and non-main threads, fall through to pytest-timeout's own.

import asyncio
import contextlib
import signal
import threading

import greenlet
import pytest
from pytest_timeout import timeout_sigalrm


def _root(g):
    while g.parent is not None:
        g = g.parent
    return g


def pytest_timeout_set_timer(item, settings):
    if (
        settings.method != "signal"
        or threading.current_thread() is not threading.main_thread()
    ):
        return None  # leave every other case to pytest-timeout

    def handler(signum, frame):
        __tracebackhide__ = True
        try:
            timeout_sigalrm(item, settings)  # raises pytest.fail.Exception
        except pytest.fail.Exception as exc:
            current = greenlet.getcurrent()
            root = _root(current)
            if current is root:
                raise
            # The signal interrupted select() inside the dispatcher fiber; wake the loop,
            # or it resumes waiting with the timeout it was entered with.
            with contextlib.suppress(RuntimeError):
                asyncio.get_running_loop().call_soon_threadsafe(lambda: None)
            root.throw(exc)

    def cancel():
        signal.setitimer(signal.ITIMER_REAL, 0)
        signal.signal(signal.SIGALRM, signal.SIG_DFL)

    item.cancel_timeout = cancel
    signal.signal(signal.SIGALRM, handler)
    signal.setitimer(signal.ITIMER_REAL, settings.timeout)
    return True

On 1.63.0 it turns the repro from the description into 1 failed, 1 passed in 1.2s (test_slow fails with Timeout (>1.0s), test_next passes, teardown completes), and the two variants in (2) behave the same way.

The call_soon_threadsafe wake matters more than it looks. The interrupted select() resumes with the timeout it was entered with, so without the wake the next call is not sent until the abandoned call finishes. In the repro above that is only the remaining ~4 seconds of wait_for_timeout(5000) (6.9 s total instead of 2.5 s). With wait_for_timeout(60_000) it is a 0%-CPU stall (still running after 25 s) instead of a 100%-CPU spin.

The abandoned call's task is left pending, so Task exception was never retrieved (a TargetClosedError) may be logged when its page closes in teardown. That was the only side effect we saw.