Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

No process-level heap cap: OOM aborts (rc 134); sandbox max_bytes misses general growth

未关闭
  • 哪里不对？
#1,319 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
c
领域
compilers, documentation

调研方向

Start by reading docs/PRINCIPLES.md and the existing sandbox_run max_bytes behavior, then trace the eigs_alloc chokepoint and run the supplied OOM reproduction. Compare the proposed cap, error, charging, and trace behavior with the sandbox requirements. Done includes a catchable named error, non-134 exit, stopped sandbox growth, a clean handles_full.eigs run, overhead measurements, and synchronized updates to docs/SPEC.md, docs/BUILTINS.md, docs/EMBEDDING.md, and docs/llms.txt.

由索引模型根据 Issue 内容生成。

描述

area:embed area:memory kind:decision

Gap

There is no process-level heap cap. An embedder, a CI harness or an agent running generated .eigs cannot bound a whole run's memory. The only tools are OS limits, and both are poor fits:

  • ulimit -v (RLIMIT_AS) counts reserved address space, not use. Each thread reserves an 8 MiB stack and a 64 MiB malloc arena up front. Measured in #1318: tests/handles_full.eigs peaks at 21 MB RSS, yet it was killed under a 1.5 GB -v cap. That produced false one-sided rows in a differential harness.
  • cgroups (systemd-run -p MemoryMax=, container limits) work, but they end in a SIGKILL from outside. The program never sees an error, and the harness cannot tell an OOM from a crash without extra machinery.

When memory does run out, the runtime aborts. Repro on main 94c4c5b:

xs is []
s is "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
i is 0
loop while i < 100000000:
    xs is append of [xs, s + (str of i)]
    i is i + 1
print of "done"

$ ( ulimit -v 300000; src/eigenscript oom.eigs; echo rc=$? )
eigenscript: out of memory (requested 64 bytes)
Aborted (core dumped)
rc=134

sandbox_run's max_bytes is the one budget that exists (#739), and it has two limits:

  1. It is reachable only from inside a program, around an assembled chunk. It cannot cover a whole run.
  2. It charges only the size-controlled allocators (zeros/fill/buffer/range/concat) and the zlib codecs. General growth like the append loop above is not charged, so even a sandboxed run can exhaust the host.

Prior art (for the decision)

  • Runtime-level heap caps that raise a named error: JVM -Xmx (OutOfMemoryError), V8 --max-old-space-size, the allocator limit in Lua's lua_newstate, wasm max memory pages.
  • Harness-level RSS monitors: libFuzzer -rss_limit_mb reports OOM as its own outcome.
  • AFL documents that its RLIMIT_AS limit (-m) must be none under ASan, which is the same failure as above.

Decision needed

  • The knob: an env flag (EIGS_MAX_HEAP=<bytes>, parsed like the other eigs_env_flag knobs), a CLI flag, an embed API field, or all three.
  • What gets charged: every eigs_alloc (a chokepoint charge, which catches the append loop), or live bytes net of frees (which needs the counter decremented on free).
  • What happens at the cap: an rt_error of a new kind (catchable by try, a clean exit code distinct from 134), and what the trace tape records.
  • Whether sandbox_run's max_bytes becomes the same mechanism scoped to the run, which would close its second limitation above.

Done when

  • The decision above is recorded in this issue, citing a principle from docs/PRINCIPLES.md.
  • Running the repro above with the cap set to 64 MiB ends in a named, documented error with a non-134 exit code, and the program can catch it with try.
  • The same program under sandbox_run with max_bytes set is stopped by the budget. It returns {ok: 0}, and the host does not abort.
  • tests/handles_full.eigs runs clean under a cap well above its measured peak (for example 64 MiB), proving thread reservations are not charged.
  • Measured overhead with the cap unset is recorded, taken from the perf-attribution paired samples or the CodSpeed instruction count on the DMG target.
  • docs/SPEC.md, docs/BUILTINS.md (sandbox_run), docs/EMBEDDING.md and docs/llms.txt describe the knob, all in the same PR.
主要语言
C
星标
3
派生
7
平均合并
4 小时 7 分钟
30 天内合并 PR
112

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

InauguralSystems/EigenScript 的其他 Issue

查看 InauguralSystems/EigenScript 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。