bug#27587: 25.1; in the dynamic modules api, env->free_global_ref doesn't free anything

bug#27587: 25.1; in the dynamic modules api, env->free_global_ref doesn't free anything

[Valentin Gatien-Baron]

[-- Attachment #1: Type: text/plain, Size: 1080 bytes --]

The following dynamic module takes unbounded memory:

/* gcc -I . -g -ggdb -fPIC foo.c -shared -o foo.so && echo running && emacs
-Q -L . -batch -l foo */
#include <emacs-module.h>

int plugin_is_GPL_compatible;

int emacs_module_init(struct emacs_runtime *ert) {
  emacs_env *env = ert->get_environment(ert);
  while (1) {
    int i;
    for (i = 0; i < 10000; i++) {
      emacs_value v = env->make_string(env, "asdads", 3);
      env->free_global_ref(env, env->make_global_ref(env, v));
    }
    env->funcall(env, env->intern(env, "garbage-collect"), 0, NULL);
  }
}


This is because env->make_global_ref/env->free_global_ref leak memory.
env->free_global_ref fails to remove values from the hash table of
refcounts. The following patch makes the program above run in constant
space.


--- src/emacs-module.c 2017-06-30 16:00:36.776301646 -0400
+++ src/emacs-module.c 2017-06-30 16:05:01.660120043 -0400
@@ -308,7 +308,7 @@
           set_hash_value_slot (h, i, value);
         }
       else
- hash_remove_from_table (h, value);
+ hash_remove_from_table (h, obj);
     }
 }

[-- Attachment #2: Type: text/html, Size: 4437 bytes --]

bug#27587: 25.1; in the dynamic modules api, env->free_global_ref doesn't free anything

[Philipp Stephani]

[-- Attachment #1: Type: text/plain, Size: 1315 bytes --]

Valentin Gatien-Baron <vgatien-baron@janestreet.com> schrieb am Mi., 5.
Juli 2017 um 17:07 Uhr:

> The following dynamic module takes unbounded memory:
>
> /* gcc -I . -g -ggdb -fPIC foo.c -shared -o foo.so && echo running &&
> emacs -Q -L . -batch -l foo */
> #include <emacs-module.h>
>
> int plugin_is_GPL_compatible;
>
> int emacs_module_init(struct emacs_runtime *ert) {
>   emacs_env *env = ert->get_environment(ert);
>   while (1) {
>     int i;
>     for (i = 0; i < 10000; i++) {
>       emacs_value v = env->make_string(env, "asdads", 3);
>       env->free_global_ref(env, env->make_global_ref(env, v));
>     }
>     env->funcall(env, env->intern(env, "garbage-collect"), 0, NULL);
>   }
> }
>
>
> This is because env->make_global_ref/env->free_global_ref leak memory.
> env->free_global_ref fails to remove values from the hash table of
> refcounts. The following patch makes the program above run in constant
> space.
>
>
> --- src/emacs-module.c 2017-06-30 16:00:36.776301646 -0400
> +++ src/emacs-module.c 2017-06-30 16:05:01.660120043 -0400
> @@ -308,7 +308,7 @@
>            set_hash_value_slot (h, i, value);
>          }
>        else
> - hash_remove_from_table (h, value);
> + hash_remove_from_table (h, obj);
>      }
>  }
>
>
Good catch, installed as 22af69906cca871fdb893e06d6f10dbbab4518e6.

[-- Attachment #2: Type: text/html, Size: 4903 bytes --]

bug#27587: 25.1; in the dynamic modules api, env->free_global_ref doesn't free anything

[Valentin Gatien-Baron]

[-- Attachment #1: Type: text/plain, Size: 1697 bytes --]

​Thanks! By the way, the assert that refcount == 0 you added as a further
commit wouldn't have triggered, as the refcount in the hash table would
stay at 1 after the call to free_global_ref.


On Sun, Jul 9, 2017 at 6:17 PM, Philipp Stephani <p.stephani2@gmail.com>
wrote:

>
>
> Valentin Gatien-Baron <vgatien-baron@janestreet.com> schrieb am Mi., 5.
> Juli 2017 um 17:07 Uhr:
>
>> The following dynamic module takes unbounded memory:
>>
>> /* gcc -I . -g -ggdb -fPIC foo.c -shared -o foo.so && echo running &&
>> emacs -Q -L . -batch -l foo */
>> #include <emacs-module.h>
>>
>> int plugin_is_GPL_compatible;
>>
>> int emacs_module_init(struct emacs_runtime *ert) {
>>   emacs_env *env = ert->get_environment(ert);
>>   while (1) {
>>     int i;
>>     for (i = 0; i < 10000; i++) {
>>       emacs_value v = env->make_string(env, "asdads", 3);
>>       env->free_global_ref(env, env->make_global_ref(env, v));
>>     }
>>     env->funcall(env, env->intern(env, "garbage-collect"), 0, NULL);
>>   }
>> }
>>
>>
>> This is because env->make_global_ref/env->free_global_ref leak memory.
>> env->free_global_ref fails to remove values from the hash table of
>> refcounts. The following patch makes the program above run in constant
>> space.
>>
>>
>> --- src/emacs-module.c 2017-06-30 16:00:36.776301646 -0400
>> +++ src/emacs-module.c 2017-06-30 16:05:01.660120043 -0400
>> @@ -308,7 +308,7 @@
>>            set_hash_value_slot (h, i, value);
>>          }
>>        else
>> - hash_remove_from_table (h, value);
>> + hash_remove_from_table (h, obj);
>>      }
>>  }
>>
>>
> Good catch, installed as 22af69906cca871fdb893e06d6f10dbbab4518e6.
>

[-- Attachment #2: Type: text/html, Size: 5668 bytes --]