GNU bug report logs - #27587
25.1; in the dynamic modules api, env->free_global_ref doesn't free anything

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 27587 in the body.
You can then email your comments to 27587 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Valentin Gatien-Baron <vgatien-baron <at> janestreet.com>
To: bug-gnu-emacs <at> gnu.org
Subject: 25.1; in the dynamic modules api, env->free_global_ref doesn't free
 anything
Date: Wed, 5 Jul 2017 08:43:26 -0400

[Message part 1 (text/plain, inline)]

The following dynamic module takes unbounded memory:

/* gcc -I . -g -ggdb -fPIC foo.c -shared -o foo.so && echo running && emacs
-Q -L . -batch -l foo */
#include <emacs-module.h>

int plugin_is_GPL_compatible;

int emacs_module_init(struct emacs_runtime *ert) {
  emacs_env *env = ert->get_environment(ert);
  while (1) {
    int i;
    for (i = 0; i < 10000; i++) {
      emacs_value v = env->make_string(env, "asdads", 3);
      env->free_global_ref(env, env->make_global_ref(env, v));
    }
    env->funcall(env, env->intern(env, "garbage-collect"), 0, NULL);
  }
}


This is because env->make_global_ref/env->free_global_ref leak memory.
env->free_global_ref fails to remove values from the hash table of
refcounts. The following patch makes the program above run in constant
space.


--- src/emacs-module.c 2017-06-30 16:00:36.776301646 -0400
+++ src/emacs-module.c 2017-06-30 16:05:01.660120043 -0400
@@ -308,7 +308,7 @@
           set_hash_value_slot (h, i, value);
         }
       else
- hash_remove_from_table (h, value);
+ hash_remove_from_table (h, obj);
     }
 }

[Message part 2 (text/html, inline)]

Message #10 received at 27587-done <at> debbugs.gnu.org (full text, mbox):

From: Philipp Stephani <p.stephani2 <at> gmail.com>
To: Valentin Gatien-Baron <vgatien-baron <at> janestreet.com>,
 27587-done <at> debbugs.gnu.org
Subject: Re: bug#27587: 25.1; in the dynamic modules api, env->free_global_ref
 doesn't free anything
Date: Sun, 09 Jul 2017 22:17:17 +0000

[Message part 1 (text/plain, inline)]

Valentin Gatien-Baron <vgatien-baron <at> janestreet.com> schrieb am Mi., 5.
Juli 2017 um 17:07 Uhr:

> The following dynamic module takes unbounded memory:
>
> /* gcc -I . -g -ggdb -fPIC foo.c -shared -o foo.so && echo running &&
> emacs -Q -L . -batch -l foo */
> #include <emacs-module.h>
>
> int plugin_is_GPL_compatible;
>
> int emacs_module_init(struct emacs_runtime *ert) {
>   emacs_env *env = ert->get_environment(ert);
>   while (1) {
>     int i;
>     for (i = 0; i < 10000; i++) {
>       emacs_value v = env->make_string(env, "asdads", 3);
>       env->free_global_ref(env, env->make_global_ref(env, v));
>     }
>     env->funcall(env, env->intern(env, "garbage-collect"), 0, NULL);
>   }
> }
>
>
> This is because env->make_global_ref/env->free_global_ref leak memory.
> env->free_global_ref fails to remove values from the hash table of
> refcounts. The following patch makes the program above run in constant
> space.
>
>
> --- src/emacs-module.c 2017-06-30 16:00:36.776301646 -0400
> +++ src/emacs-module.c 2017-06-30 16:05:01.660120043 -0400
> @@ -308,7 +308,7 @@
>            set_hash_value_slot (h, i, value);
>          }
>        else
> - hash_remove_from_table (h, value);
> + hash_remove_from_table (h, obj);
>      }
>  }
>
>
Good catch, installed as 22af69906cca871fdb893e06d6f10dbbab4518e6.

[Message part 2 (text/html, inline)]

Message #13 received at 27587-done <at> debbugs.gnu.org (full text, mbox):

From: Valentin Gatien-Baron <vgatien-baron <at> janestreet.com>
To: Philipp Stephani <p.stephani2 <at> gmail.com>
Cc: 27587-done <at> debbugs.gnu.org
Subject: Re: bug#27587: 25.1; in the dynamic modules api, env->free_global_ref
 doesn't free anything
Date: Mon, 10 Jul 2017 11:10:04 -0400

[Message part 1 (text/plain, inline)]

​Thanks! By the way, the assert that refcount == 0 you added as a further
commit wouldn't have triggered, as the refcount in the hash table would
stay at 1 after the call to free_global_ref.


On Sun, Jul 9, 2017 at 6:17 PM, Philipp Stephani <p.stephani2 <at> gmail.com>
wrote:

>
>
> Valentin Gatien-Baron <vgatien-baron <at> janestreet.com> schrieb am Mi., 5.
> Juli 2017 um 17:07 Uhr:
>
>> The following dynamic module takes unbounded memory:
>>
>> /* gcc -I . -g -ggdb -fPIC foo.c -shared -o foo.so && echo running &&
>> emacs -Q -L . -batch -l foo */
>> #include <emacs-module.h>
>>
>> int plugin_is_GPL_compatible;
>>
>> int emacs_module_init(struct emacs_runtime *ert) {
>>   emacs_env *env = ert->get_environment(ert);
>>   while (1) {
>>     int i;
>>     for (i = 0; i < 10000; i++) {
>>       emacs_value v = env->make_string(env, "asdads", 3);
>>       env->free_global_ref(env, env->make_global_ref(env, v));
>>     }
>>     env->funcall(env, env->intern(env, "garbage-collect"), 0, NULL);
>>   }
>> }
>>
>>
>> This is because env->make_global_ref/env->free_global_ref leak memory.
>> env->free_global_ref fails to remove values from the hash table of
>> refcounts. The following patch makes the program above run in constant
>> space.
>>
>>
>> --- src/emacs-module.c 2017-06-30 16:00:36.776301646 -0400
>> +++ src/emacs-module.c 2017-06-30 16:05:01.660120043 -0400
>> @@ -308,7 +308,7 @@
>>            set_hash_value_slot (h, i, value);
>>          }
>>        else
>> - hash_remove_from_table (h, value);
>> + hash_remove_from_table (h, obj);
>>      }
>>  }
>>
>>
> Good catch, installed as 22af69906cca871fdb893e06d6f10dbbab4518e6.
>

[Message part 2 (text/html, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.