Limiting memory usage of script

[Tim Trefren]

Hello,

I'm working on an application that executes scripts from untrusted users. These scripts are expected to define a certain function that we will pull out and run many times.

I have implemented a watchdog thread that ensures that no single function call takes too long (if it does, I assume there is an infinite loop in the function).

Now I am trying to limit memory usage. I investigated various approaches with setrlimit and ResourceConstraints::ConfigureDefaults but those both leave the program in a bad state when it runs out of memory. Instead, I would like to occasionally use `GetHeapStatistics` to inspect the heap and error out if it has grown too large. 

My question is this: is it required to acquire a v8:Locker lock before using GetHeapStatistics? I am passing a pointer to my isolate to the watchdog script so that it can call v8:TerminateExecution if necessary, which is explicitly allowed in the documentation. The documentation for Locker says that a lock must be acquired to access handles or object pointers, but it's not clear if it is required for GetHeapStatistics.

Thanks,

Tim

[Ben Noordhuis]

Yes, you need to acquire the isolate before calling
v8::Isolate::GetHeapStatistics(), it iterates over mutable data.

As a rule of thumb, if the documentation doesn't explicitly mention
that a function is thread-safe, it's not.

[Tim Trefren]

Thanks Ben.

[Jane Chen]

I have something similar in my app and I'd like my background thread to check the heap statistics to detect that the script is about to run out of memory, so that I can terminate it before it actually does. 

My problem is that I don't know the criteria to detect that.  I got from the HeapStatistics: total heap size, total heap size executable, total physical size, used heap size and heap size limit.  I can see that my total heap size and used heap size both grow with used heap size lagging slightly, heap size limit stays constant.  But way before total heap size reaches heap size limit, I already get out of memory exception:

......
2015-09-21 18:21:49.290 Info: total heap size: 600510208
2015-09-21 18:21:49.290 Info: total heap size executable: 4194304
2015-09-21 18:21:49.290 Info: total physical size: 3928224
2015-09-21 18:21:49.290 Info: used heap size: 596191056
2015-09-21 18:21:49.290 Info: heap size limit: 1535115264
......
2015-09-21 18:21:56.294 Info: total heap size: 1023430400
2015-09-21 18:21:56.294 Info: total heap size executable: 4194304
2015-09-21 18:21:56.294 Info: total physical size: 3944864
2015-09-21 18:21:56.294 Info: used heap size: 1019090648
2015-09-21 18:21:56.294 Info: heap size limit: 1535115264

Any idea on how the out of memory condition can be detected based on the above?

[Ben Noordhuis]

On Tue, Sep 22, 2015 at 3:56 AM, Jane Chen <jxch...@gmail.com> wrote:
> I have something similar in my app and I'd like my background thread to
> check the heap statistics to detect that the script is about to run out of
> memory, so that I can terminate it before it actually does.
>
> My problem is that I don't know the criteria to detect that. I got from the
> HeapStatistics: total heap size, total heap size executable, total physical
> size, used heap size and heap size limit. I can see that my total heap size
> and used heap size both grow with used heap size lagging slightly, heap size
> limit stays constant. But way before total heap size reaches heap size
> limit, I already get out of memory exception:
>
> ......
> 2015-09-21 18:21:49.290 Info: total heap size: 600510208
> 2015-09-21 18:21:49.290 Info: total heap size executable: 4194304
> 2015-09-21 18:21:49.290 Info: total physical size: 3928224
> 2015-09-21 18:21:49.290 Info: used heap size: 596191056
> 2015-09-21 18:21:49.290 Info: heap size limit: 1535115264
> ......
> 2015-09-21 18:21:56.294 Info: total heap size: 1023430400
> 2015-09-21 18:21:56.294 Info: total heap size executable: 4194304
> 2015-09-21 18:21:56.294 Info: total physical size: 3944864
> 2015-09-21 18:21:56.294 Info: used heap size: 1019090648
> 2015-09-21 18:21:56.294 Info: heap size limit: 1535115264
>
> Any idea on how the out of memory condition can be detected based on the
> above?

I don't think there is a bulletproof way to do that. There are two
OOM scenarios:

1. The garbage collector can't reclaim enough heap space to allocate a
new object.

2. V8 can't mmap the memory it needs to grow the heap.

You can try to apply some best effort heuristics to the first scenario
but the second one is essentially unpredictable.