[Bro] Returning local variables and garbage collection

[Lorenzo Cavallaro]

Hi,

   I'm debugging a custom policy script that was causing Bro to use too
   much memory. The script has been stripped down just to do some
   logging and nothing more, but the memory usage is still pretty "high"
   i.e., WAY higher then with compared to having conn.bro loaded, for
   instance.

   The only particular thing the script is currently doing is just to
   return local variables. Basically, I'm considering them similar to
   ptr in C (but I might have misunderstood their semantic, tho). For
   instance, I've something like the following:

      type custom_conn_t: record {
         id: conn_id;
         # custom type involved here!
         ...
      };

      function conn_init(c: connection)
      {
         local __c: custom_conn_t;

         __c$id = c$id;
         # assign other __c's fields from c

         return __c;
      }

      function foobar(c: connection)
      {

         local __c: custom_conn_t;

         __c = conn_init(c);

         do_log(__c);
      }

      event X(c: connection)
      {
         foobar(c);
      }

   I'm monitoring live-traffic so it's pretty hard to provide a
   representative trace. However, conn.bro produces a low memory
   footprint (~50MB over 3/4 hrs) and it gets stable pretty soon. The
   aforementioned script reached 200MB in less time and it keeps
   growing.

   I'm just wondering what it happens when I return __c in conn_init().
   I'm expecting a new object to be created and the local one declared
   in conn_init to be destroyed. Then, eventually, whenever the newly
   created __c is not needed anymore (say, after do_log, or, however,
   after event X returns), I'd expect it to be free'd by the garbage
   collector. 
   
   Or, is the object the same and just internal refcnt are increased or
   decreased? If so, it shouldn't really make any difference as refcnt
   should be going to 0 after X finishes.

   However, I'm experiencing and (almost linear) increasing memory
   consumption, and that's weird (bug?). Any idea?

TIA, bye
Lorenzo

-- 
Lorenzo `Gigi Sullivan' Cavallaro <sullivan at cs.ucsb.edu>
GPG key at http://www.cs.ucsb.edu/~sullivan/sullivan.asc

Until I loved, life had no beauty;
I did not know I lived until I had loved. (Theodor Korner)

See the reality in your eyes, when the hate makes you blind. (A.H.X)