bug#27587: 25.1; in the dynamic modules api, env->free_global_ref doesn't free anything

[Valentin Gatien-Baron <vgatien-baron@janestreet.com>]

[-- Attachment #1: Type: text/plain, Size: 1697 bytes --]

​Thanks! By the way, the assert that refcount == 0 you added as a further
commit wouldn't have triggered, as the refcount in the hash table would
stay at 1 after the call to free_global_ref.


On Sun, Jul 9, 2017 at 6:17 PM, Philipp Stephani <p.stephani2@gmail.com>
wrote:

>
>
> Valentin Gatien-Baron <vgatien-baron@janestreet.com> schrieb am Mi., 5.
> Juli 2017 um 17:07 Uhr:
>
>> The following dynamic module takes unbounded memory:
>>
>> /* gcc -I . -g -ggdb -fPIC foo.c -shared -o foo.so && echo running &&
>> emacs -Q -L . -batch -l foo */
>> #include <emacs-module.h>
>>
>> int plugin_is_GPL_compatible;
>>
>> int emacs_module_init(struct emacs_runtime *ert) {
>>   emacs_env *env = ert->get_environment(ert);
>>   while (1) {
>>     int i;
>>     for (i = 0; i < 10000; i++) {
>>       emacs_value v = env->make_string(env, "asdads", 3);
>>       env->free_global_ref(env, env->make_global_ref(env, v));
>>     }
>>     env->funcall(env, env->intern(env, "garbage-collect"), 0, NULL);
>>   }
>> }
>>
>>
>> This is because env->make_global_ref/env->free_global_ref leak memory.
>> env->free_global_ref fails to remove values from the hash table of
>> refcounts. The following patch makes the program above run in constant
>> space.
>>
>>
>> --- src/emacs-module.c 2017-06-30 16:00:36.776301646 -0400
>> +++ src/emacs-module.c 2017-06-30 16:05:01.660120043 -0400
>> @@ -308,7 +308,7 @@
>>            set_hash_value_slot (h, i, value);
>>          }
>>        else
>> - hash_remove_from_table (h, value);
>> + hash_remove_from_table (h, obj);
>>      }
>>  }
>>
>>
> Good catch, installed as 22af69906cca871fdb893e06d6f10dbbab4518e6.
>

[-- Attachment #2: Type: text/html, Size: 5668 bytes --]