fix(signal): honor SA_SIGINFO, SA_RESETHAND, and implement per-thread signal masks

[Arshia001]

Three POSIX conformance bugs in WASIX signal handling. Each was hidden behind the one before it, so they are best reviewed in order.

1. SA_SIGINFO was ignored

__wasm_signal always invoked the registered handler as void(int) — the sa_handler form:

if (ksa.handler != 0) {
	ksa.handler(sig);
}

A handler installed through sa_sigaction takes (int, siginfo_t *, void *). On native ABIs calling it through the one-argument signature is harmless — the surplus register arguments are ignored. On wasm the argument count is part of the function type, so the call_indirect traps:

RuntimeError: indirect call type mismatch
    at __wasm_signal (edge[328]:0x41d80)

The runtime maps that to WasiError::Exit(Errno::Intr) — exit code 27 — killing the instance.

Any Node-derived guest hits this, because Node's RegisterSignalHandler installs SIGINT/SIGTERM handlers this way. On Wasmer Edge a graceful instance stop (SIGTERM via InstanceHandle::stop_graceful) therefore killed the instance instead of running its shutdown path, surfacing as a 5xx whenever it raced an in-flight request. Reproduced against the published wasmer/edgejs-quickjs:

$ RUST_LOG=warn wasmer run wasmer/edgejs-quickjs \
    -- -e 'process.kill(process.pid, "SIGINT"); setTimeout(()=>console.log("alive"),500);'
WARN wasmer_wasix::state::env: signal handler runtime error pid=1
     runtime_err=RuntimeError: indirect call type mismatch
    at __wasm_signal (edge[328]:0x41d80)
exit=27

Fixed by branching on SA_SIGINFO — already recorded in __eintr_handler_callbacks by __libc_sigaction — and dispatching through a matching signature. There is no machine context to hand over, since the host delivers the signal rather than it arising from a faulting instruction: ucontext is null and the siginfo_t carries only si_signo and si_code = SI_USER, which is what Node-style handlers use.

The dispatch goes through a union rather than a function-pointer cast: a direct cast is rejected by the build's -Werror,-Wcast-function-type-mismatch, which is the very arity mismatch this patch is about.

2. SA_RESETHAND was never implemented

With handlers finally reaching their bodies, the next defect surfaced immediately. SA_RESETHAND appeared nowhere in the signal path, so a handler installed with it stayed installed while running. POSIX resets the disposition to SIG_DFL on entry, which is what a handler that re-raises its own signal to reach the default action depends on — again the SignalExit pattern. Without it the re-raise re-enters the handler:

handler sig=2
handler sig=2
handler sig=2 ...

Every delivery crosses a host/guest boundary, so the recursion exhausts the host stack and segfaults the runtime process (exit 139, core dumped) rather than trapping in the guest.

Fixed by clearing the table entry before dispatch when SA_RESETHAND is set.

3. There was no signal mask at all

sa_mask was stored and never applied, and SA_NODEFER was never consulted, so every handler effectively ran as SA_NODEFER and any non-reentrant handler could be re-entered mid-execution. This is also why bug 2 could recurse: edgejs's RegisterSignalHandler calls sigfillset(&sa.sa_mask), and honoring that alone would have prevented it.

Nothing could be blocked either — pthread_sigmask was return 0, sigpending was return EINVAL, and block.c "blocked" by re-registering the callback as __wasm_signal_blocked, a name nothing defines. That only appeared to work because callback_signal stores None for a missing export and process_signals then skips pop_signals(), leaving deliveries queued host-side.

Each thread now owns a real mask and pending set in struct pthread:

• __wasm_signal records a blocked signal as pending instead of dispatching it.
• A handler runs with sa_mask installed, plus its own signal unless SA_NODEFER.
• Deferred deliveries are drained iteratively once the mask is restored, so a handler that re-raises its own signal runs again sequentially rather than nesting.
• pthread_sigmask and sigpending are real; block.c is plain mask arithmetic.

Because signals are only ever delivered at syscall boundaries, unblocking flushes pending deliveries itself — no interrupt will come along to do it. Applications still cannot block SIGTIMER/SIGCANCEL/SIGSYNCCALL, or pthread_cancel and timers would break.

Two adjacent bugs had to be fixed to make this work, both worth a look on their own:

• struct pthread was never zeroed. __wasi_init_tp() allocates it with aligned_alloc(), so the new mask started as heap garbage and made arbitrary signals appear blocked. __init_tp() now clears it explicitly. Anyone adding a field to that struct should know this.
• A forked child had no signal callback. The host tracks registration per instance, but the guest-side "already registered" flag is ordinary memory that survives fork(), so the child looked registered while the host had no callback and silently discarded its signals. This was previously masked by accident: the old __restore_sigs() re-registered on every call and _Fork() calls it. With that side effect gone the child registers explicitly. It cost me a hang in the pre-existing libc/signal fixture to find.

Not addressed

sigsuspend and sigtimedwait remain EINVAL stubs, so sa_mask is not yet honored there.

Testing

Regression tests in wasmerio/wasmer#6838 — seven fixtures, each written red against a sysroot without the corresponding fix and green after. The mask pair is the interesting one: the same program with and without SA_NODEFER, asserting the handler runs 5 times at nesting depth 1 versus depth 5.

Full wasm_tests suite against sysroots built from this branch with build-all.sh: 1100 passed, 0 failed, 71 ignored.

End-to-end, edgejs rebuilt against the patched sysroot (with its own SA_SIGINFO fix, since it set sa_sigaction without the flag):

Case	Before	After
SIGINT, no JS listener	trap, exit 27	exit 127, termination signal: Interrupt
SIGTERM, no JS listener	trap, exit 27	exit 127, termination signal: Terminated
SIGINT + JS listener	ok	ok

Terminating on an unhandled SIGINT/SIGTERM is the point: SignalExit now runs its stdio-reset path and lets the default action terminate, instead of dying on a type trap.

Review note

Commit 3 changes behavior for programs that work today — signals are now deferred while a handler runs, and sigprocmask stops being a no-op. Commits 1 and 2 only allow previously-trapping code to run. Worth weighing separately.

🤖 Generated with Claude Code