feat(fetch): honor AbortSignal — cancel/timeout in-flight requests (#5690)

`fetch(url, { signal })` ignored the signal: `js_fetch_with_options` took only
url/method/body/headers and ran to completion, so neither `controller.abort()`
nor `AbortSignal.timeout(ms)` could cancel it. And `AbortSignal.timeout(ms)` was
a no-op stub returning a never-aborting signal. Together,
`fetch(url, { signal: AbortSignal.timeout(ms) })` on a slow/held response hung
forever instead of rejecting at the deadline.

This wires AbortSignal through the fetch path:

- `AbortSignal.timeout(ms)` (`url/abort.rs`) now schedules a real (unref'd)
  callback timer that aborts the signal with a `TimeoutError` and fires its
  `abort` listeners when the deadline elapses on the main thread.
- The signal reaches the stdlib fetch via a thread-local stash
  (`js_fetch_set_pending_signal`), keeping the 4-arg ABI unchanged. The runtime
  fetch thunk sets it for the dynamic/aliased path; codegen emits it before the
  call for the `fetch(url, { … })` fast path (a new `signal` field on the
  `FetchWithOptions` HIR node).
- `js_fetch_with_options` registers a per-request `tokio::sync::Notify` keyed to
  the signal and `select!`s the request against it; on abort it drops the
  request future (cancelling the in-flight reqwest request) and rejects with an
  `AbortError`. An already-aborted signal rejects up front. The abort reaches
  the request through the runtime: `fire_abort_listeners` calls
  `js_fetch_notify_signal_aborted` on every abort — so there is no per-fetch JS
  listener to accumulate on reused signals.

The pending signal is consumed before the promise is allocated (so a GC during
allocation can't move the TLS-stashed signal). No behavior change for
signal-less fetches; the WASM fetch backend keeps its existing behavior.

Co-authored-by: Ralph Küpper <ralph2@skelpo.com>

Author: proggeramlug

crates/perry-codegen-js/src/emit/exprs_more.rs

@@ -39,6 +39,7 @@ impl JsEmitter {
                 body,
                 headers,
                 headers_dynamic,
+                signal,
             } => {
                 self.output.push_str("fetch(");
                 self.emit_expr(url);
@@ -63,6 +64,10 @@ impl JsEmitter {
                     }
                     self.output.push('}');
                 }
+                if let Some(sig) = signal {
+                    self.output.push_str(", signal: ");
+                    self.emit_expr(sig);
+                }
                 self.output.push_str("})");
             }
             Expr::FetchGetWithAuth { url, auth_header } => {

crates/perry-codegen-wasm/src/emit/expr/net_fetch_crypto.rs

@@ -29,6 +29,9 @@ impl<'a> FuncEmitCtx<'a> {
                 body,
                 headers,
                 headers_dynamic,
+                // The WASM fetch backend has no AbortSignal cancellation (it is a
+                // separate target from the native binary), so the signal is unused.
+                signal: _,
             } => {
                 self.emit_expr(func, url);
                 self.emit_expr(func, method);

crates/perry-codegen-wasm/src/emit/js_fallback.rs

@@ -354,6 +354,7 @@ impl WasmModuleEmitter {
                 body,
                 headers,
                 headers_dynamic,
+                signal: _,
             } => {
                 let url_js = self.emit_js_expr(url, locals);
                 let method_js = self.emit_js_expr(method, locals);

crates/perry-codegen-wasm/src/emit/string_collection.rs

@@ -972,6 +972,7 @@ impl WasmModuleEmitter {
                 body,
                 headers,
                 headers_dynamic,
+                signal,
             } => {
                 self.collect_strings_in_expr(url);
                 self.collect_strings_in_expr(method);
@@ -983,6 +984,9 @@ impl WasmModuleEmitter {
                 if let Some(hd) = headers_dynamic {
                     self.collect_strings_in_expr(hd);
                 }
+                if let Some(s) = signal {
+                    self.collect_strings_in_expr(s);
+                }
             }
             Expr::FetchGetWithAuth { url, auth_header } => {
                 self.collect_strings_in_expr(url);

crates/perry-codegen/src/collectors/escape_check.rs

@@ -669,6 +669,7 @@ pub fn check_escapes_in_expr(
             body,
             headers,
             headers_dynamic,
+            signal,
         } => {
             check_escapes_in_expr(url, candidates, classes, escaped);
             check_escapes_in_expr(method, candidates, classes, escaped);
@@ -679,6 +680,9 @@ pub fn check_escapes_in_expr(
             if let Some(hd) = headers_dynamic {
                 check_escapes_in_expr(hd, candidates, classes, escaped);
             }
+            if let Some(s) = signal {
+                check_escapes_in_expr(s, candidates, classes, escaped);
+            }
         }
         Expr::SuperCall(args)
         | Expr::StaticMethodCall { args, .. }

crates/perry-codegen/src/collectors/escape_news.rs

@@ -754,6 +754,7 @@ fn collect_used_new_fields_in_expr(
             body,
             headers,
             headers_dynamic,
+            signal,
         } => {
             collect_used_new_fields_in_expr(url, non_escaping_news, used);
             collect_used_new_fields_in_expr(method, non_escaping_news, used);
@@ -764,6 +765,9 @@ fn collect_used_new_fields_in_expr(
             if let Some(hd) = headers_dynamic {
                 collect_used_new_fields_in_expr(hd, non_escaping_news, used);
             }
+            if let Some(s) = signal {
+                collect_used_new_fields_in_expr(s, non_escaping_news, used);
+            }
         }
         Expr::FetchGetWithAuth { url, auth_header } => {
             collect_used_new_fields_in_expr(url, non_escaping_news, used);

crates/perry-codegen/src/expr/logical_collections.rs

@@ -80,10 +80,17 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
             body,
             headers,
             headers_dynamic,
+            signal,
         } => {
             let url_box = lower_expr(ctx, url)?;
             let method_box = lower_expr(ctx, method)?;
             let body_box = lower_expr(ctx, body)?;
+            // Lower `init.signal` (if any) up front so it can be stashed for
+            // `js_fetch_with_options` right before the call below.
+            let signal_box = match signal {
+                Some(s) => Some(lower_expr(ctx, s)?),
+                None => None,
+            };
 
             // Obtain the headers as a NaN-boxed object value, then JSON-stringify
             // it below. Two cases:
@@ -141,6 +148,11 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
             let url_handle = unbox_to_i64(blk, &url_box);
             let method_handle = unbox_to_i64(blk, &method_box);
             let body_handle = unbox_to_i64(blk, &body_box);
+            // Stash the AbortSignal so `js_fetch_with_options` can cancel the
+            // request when it aborts (`controller.abort()` / `AbortSignal.timeout`).
+            if let Some(sig) = &signal_box {
+                blk.call_void("js_fetch_set_pending_signal", &[(DOUBLE, sig)]);
+            }
             let promise = blk.call(
                 I64,
                 "js_fetch_with_options",

crates/perry-codegen/src/runtime_decls/stdlib_ffi/language_core.rs

@@ -147,6 +147,9 @@ pub(crate) fn declare_core(module: &mut LlModule) {
     module.declare_function("js_fetch_stream_status", DOUBLE, &[DOUBLE]);
     module.declare_function("js_fetch_text", I64, &[I64]);
     module.declare_function("js_fetch_with_options", I64, &[I64, I64, I64, I64]);
+    // Stashes the `fetch(url, { signal })` AbortSignal for the next
+    // `js_fetch_with_options` so the request can be aborted.
+    module.declare_function("js_fetch_set_pending_signal", VOID, &[DOUBLE]);
     // Headers-aware JSON stringify for the `fetch(url, { headers })` request
     // path: takes the headers value (f64) and returns a `*const StringHeader`
     // (i64) holding `{name:value}` JSON, treating a `Headers` handle safely.

crates/perry-hir/src/capability.rs

@@ -515,6 +515,7 @@ mod tests {
             body: Box::new(Expr::Undefined),
             headers: vec![],
             headers_dynamic: None,
+            signal: None,
         }));
         let v = audit_module_capabilities(
             &m,

crates/perry-hir/src/egress.rs

@@ -489,6 +489,7 @@ mod tests {
             body: Box::new(Expr::Undefined),
             headers: vec![],
             headers_dynamic: None,
+            signal: None,
         }));
         let v = audit_module_egress(&m, "/repo/main.ts", &pats(&["api.example.com"]), false);
         assert_eq!(v.len(), 1);
@@ -506,6 +507,7 @@ mod tests {
             body: Box::new(Expr::Undefined),
             headers: vec![],
             headers_dynamic: None,
+            signal: None,
         }));
         let v = audit_module_egress(&m, "/repo/main.ts", &pats(&["api.example.com"]), false);
         assert!(v.is_empty());
@@ -520,6 +522,7 @@ mod tests {
             body: Box::new(Expr::Undefined),
             headers: vec![],
             headers_dynamic: None,
+            signal: None,
         }));
         let v = audit_module_egress(&m, "/repo/main.ts", &pats(&["api.example.com"]), false);
         assert_eq!(v.len(), 1);
@@ -539,6 +542,7 @@ mod tests {
             body: Box::new(Expr::Undefined),
             headers: vec![],
             headers_dynamic: None,
+            signal: None,
         }));
         let v = audit_module_egress(
             &m,