René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[High][reactive] Effect that writes a signal it reads recurses synchronously → stack overflow (no cycle guard)","articleBody":"## Severity: 🟠 High (robustness / self-DoS)\n\n## Location\n[`src/reactive/internals.ts:54-60`](../blob/main/src/reactive/internals.ts#L54-L60) (`scheduleObserver`), [`src/reactive/core.ts:48-56`](../blob/main/src/reactive/core.ts#L48-L56) (`Signal.set`), [`src/reactive/effect.ts:81-108`](../blob/main/src/reactive/effect.ts#L81-L108) (observer — no re-entrancy guard).\n\n## Description\nWhen `batchDepth === 0`, `scheduleObserver` invokes the observer **synchronously** inside `Signal.set`. The effect observer has no \"currently running\" guard, so an effect that writes to a signal it also reads (with a changing value) re-enters itself until the stack overflows:\n\n```ts\neffect(() =\u003e { count.value = count.value + 1; });\n// read subscribes observer → write calls set → Object.is false →\n// scheduleObserver runs observer synchronously → writes again → …\n// → RangeError: Maximum call stack size exceeded\n```\n\nWrapping in `batch()` does **not** help: during `flushObservers`, `batchDepth` is already 0, so the re-write recurses synchronously. Mutually-recursive effects/computeds hit the same path. Mainstream reactive libraries (Vue, Solid) detect this cycle and warn/bail rather than crashing the tab.\n\n## Impact\nA single natural authoring mistake crashes the whole runtime (uncatchable `RangeError` unwinds the render). No untrusted input required, but the failure mode is a hard denial of service of the page.\n\n## Suggested fix\nAdd a re-entrancy / max-depth guard: track a per-observer `isRunning` flag (or an `activeObservers` set) and, when an observer is scheduled while already executing, either defer to a microtask or bail with a \"cyclic dependency detected\" warning (Vue-style depth counter). A max-depth counter on synchronous cascades is the minimal safe fix.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:02:50.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/166/bQuery/issues/166"}