node_08 - The Event Loop¶

const fs = require('fs')

// Demonstrate phase execution order
fs.readFile(__filename , () => {
  console.log('1 - I/O callback (poll phase)')

  setTimeout(() => console.log('2 - timer callback'))
  setImmediate(() => console.log('3 - check phase immediate'))
  process.nextTick(() => console.log('4 - nextTick (microtask)'))
})

// Typical output when I/O just completed:
// 1 - I/O callback (poll phase)
// 4 - nextTick (microtask)     <- runs between every phase
// 3 - check phase immediate     <- check phase runs first
// 2 - timer callback            <- next timer phase

// Notice process.nextTick ran BEFORE setImmediate
// Microtasks always drain between phases

console.log('0 - synchronous start')

setTimeout(() => console.log('1 - setTimeout (macrotask)'), 0)
setImmediate(() => console.log('2 - setImmediate (macrotask)'))

Promise.resolve().then(() => console.log('3 - Promise.then (microtask)'))

process.nextTick(() => console.log('4 - process.nextTick (microtask)'))

queueMicrotask(() => console.log('5 - queueMicrotask (microtask)'))

console.log('6 - synchronous end')

// Output (deterministic):
// 0 - synchronous start
// 6 - synchronous end
// 4 - process.nextTick          <- microtask, highest priority
// 3 - Promise.then              <- microtask, second priority
// 5 - queueMicrotask            <- microtask, same as Promise
// 1 - setTimeout                <- timer phase macrotask
// 2 - setImmediate              <- check phase macrotask

// The microtask queue drains COMPLETELY before the first
// macrotask fires. All three microtasks execute before
// any timer callback or setImmediate

// process.nextTick runs before the next phase
// setImmediate runs in the check phase (after poll)
// Despite the name, setImmediate is NOT immediate

function deferWork() {
  // BAD: process.nextTick for I/O deferral
  // This delays I/O processing across ALL phases
  process.nextTick(() => {
    console.log('nextTick - runs before next phase')
  })

  // GOOD: setImmediate for deferring work
  // This only waits until the check phase
  setImmediate(() => {
    console.log('setImmediate - runs in check phase')
  })

  // The Node.js docs say: use setImmediate
  // unless you NEED to fire before the next phase
  // 99% of the time you want setImmediate
}

// The iconic pattern - why setImmediate wins inside I/O
const fs = require('fs')
fs.readFile(__filename , () => {
  setTimeout(() => console.log('timeout'))
  setImmediate(() => console.log('immediate'))
})
// Output:
// immediate   <- check phase runs right after poll
// timeout     <- timer phase runs on next iteration

// NextTick recursion - the infinite loop footgun
function badIdea() {
  process.nextTick(badIdea)
  // This never gives the event loop a chance to process I/O
  // setTimeout callbacks never fire
  // New HTTP connections never get accepted
  // You've DOS'd your own process
}

const express = require('express')
const crypto = require('crypto')
const app = express()

// DANGER: this blocks the entire process
app.post('/hash' , (req , res) => {
  // Synchronous crypto - blocks the event loop
  const hash = crypto.createHash('sha256')
    .update(req.body.password)
    .digest('hex')

  // While this runs: ZERO other requests get processed
  // Every client gets timeout errors
  // Your monitoring alerts start screaming
  res.json({ hash })
})

// SAFE: offload to async version (uses libuv thread pool)
app.post('/hash-safe' , (req , res) => {
  crypto.pbkdf2(req.body.password , 'salt' , 100000 , 64 , 'sha512' , (err , key) => {
    if (err) return res.status(500).json({ error: 'hashing failed' })
    res.json({ hash: key.toString('hex') })
  })
  // Thread pool handles the CPU work
  // Event loop keeps processing other requests
})

// DANGER: arbitrary JSON parsing from client
app.post('/parse' , (req , res) => {
  const data = JSON.parse(req.body)
  // What if req.body is 500MB of nested objects?
  // JSON.parse is synchronous - blocks until done
  // OOM crash or event loop starvation
  res.json(data)
})

// REDOS example - catastrophic backtracking
const evilRegex = /^(a+)+b$/
const attack = 'a'.repeat(30)        // harmless
const weaponized = 'a'.repeat(100) + 'x'  // CPU pinned for seconds

// JSON bomb - deeply nested empty arrays
const jsonBomb = '['.repeat(100000) + ']'.repeat(100000)
// JSON.parse(this) = OOM crash or event loop frozen for minutes

// Protection: limit input sizes and validate schemas
function safeParse(body , maxDepth = 20) {
  let depth = 0
  return JSON.parse(body , (key , value) => {
    if (typeof value === 'object' && value !== null) {
      depth++
      if (depth > maxDepth) {
        throw new Error('JSON too deep - aborting')
      }
    }
    return value
  })
}

const { Worker } = require('worker_threads')

function runInWorker(workerData) {
  return new Promise((resolve , reject) => {
    const worker = new Worker('./heavy-worker.js' , { workerData })

    worker.on('message' , resolve)
    worker.on('error' , reject)
    worker.on('exit' , (code) => {
      if (code !== 0) reject(new Error(`Worker exited with code ${code}`))
    })
  })
}

// Express endpoint that doesn't freeze the server
app.post('/crack' , async (req , res) => {
  try {
    const result = await runInWorker({ hash: req.body.hash })
    res.json(result)
  } catch (err) {
    res.status(500).json({ error: 'worker failed' })
  }
  // Event loop remains responsive throughout
})

let lastCheck = process.hrtime.bigint()

setInterval(() => {
  const now = process.hrtime.bigint()
  const lag = Number(now - lastCheck) / 1e6 // ms
  lastCheck = now

  if (lag > 100) {
    console.error(`Event loop lag: ${lag.toFixed(2)}ms - investigate immediately`)
    // Alert PagerDuty, increment a Prometheus counter
  }
}, 1000)