bug#19235: make-fresh-user-module procedure leaks memory

[Chris Vine]

On Sun, 07 Dec 2014 03:07:43 -0500
Mark H Weaver <address@hidden> wrote:
> Chris Vine <address@hidden> writes:
> 
> > The make-fresh-user-module procedure leaks memory in guile-2.0.11 as
> > demonstrated by the attached test case.  [...]
> >
> > The question which might be asked is "Would any sane person ever
> > want to invoke the make-fresh-user-module procedure more than a few
> > times in a practical program?".  The answer to this question is
> > "Yes", if guile is being used as an extension framework for a C or
> > C++ program, and it executes guile extensions as individual tasks,
> > and it is necessary that top levels should not to be shared.  The
> > execution of tasks concurrently is one such case, but there can be
> > many cases where isolated top levels are desirable for tasks
> > executed serially also.
> 
> Unfortunately, Guile modules cannot be garbage collected.  The problem
> is that modules are usually referenced by name, not by direct
> pointers. Every module must have a name, due to the way our macro
> expander works. Modules created by 'make-module' or
> 'make-fresh-user-module' are named using gensyms.
> 
> We maintain a global map from module names to module objects, and we
> can never safely delete from this map, because we cannot prove that
> the module name won't be looked up in the future.
> 
> I agree that your use case is reasonable.  I'll think about how we
> might allow unnamed modules to be collected, but I'm afraid it might
> be quite difficult.
> 
> In the meantime, I wrote a procedure that uses undocumented interfaces
> to forcefully delete a module from the name->module map.  However, I
> must emphasize that this procedure is likely to break in a future
> version of Guile.  However, it should work in the 2.0.x series.

[snip]

> I should mention that creating new modules with
> 'make-fresh-user-module' is not thread safe, nor is the procedure
> above.  Both of them mutate the same name->module map.  For now, I
> recommend protecting calls to both of them with a mutex.

Thanks for that.  Having make-fresh-user-module (and possibly
set-current-module ??) not thread safe should be relatively easy to
deal with in my use case, subject to the next paragraph.  I would need
to call these procedures in C/C++ code before calling scm_eval_string()
to execute a scheme task, but presumably I can obtain a C variable
reference for make-fresh-user-module by calling scm_c_lookup() -
set-current-module already has a C interface provided by libguile.  I
would also need to use a POSIX mutex, but that is fine as guile uses
native threads.

However, that would not be completely effective if guile might also
call make-fresh-user-module internally, since that would be
unprotected.  Are there any circumstances in which guile might do this?

I know from what you said some time ago that guile module loading is not
thread safe.  Without asking you to exercise powers of clairvoyance,
can you think of any other thread safety problems I should be on the
look out for?  The documentation says that "multiple threads can call
scm_with_guile concurrently" and whereas that might literally be true
there seem a number of other things that one might reasonably expect to
do with scm_with_guile that are not.

On the memory leak, the usage case involves a library so I do not think
I can include code which might be liable to breakage at some
indeterminate time.  It would also be quite difficult to implement by
reference to the same mutex as used to protect make-fresh-user-module
because that would mean reimplementing your suggested code on the C/C++
side.  So I think it best just to document the leakage in the
documentation for the library (my one, not guile), and hope that at
some time it will be possible to deal with it in guile.

Chris