|
| 1 | +/// Copyright 2026 North Pole Security, Inc. |
| 2 | +/// |
| 3 | +/// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +/// you may not use this file except in compliance with the License. |
| 5 | +/// You may obtain a copy of the License at |
| 6 | +/// |
| 7 | +/// https://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +/// |
| 9 | +/// Unless required by applicable law or agreed to in writing, software |
| 10 | +/// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +/// See the License for the specific language governing permissions and |
| 13 | +/// limitations under the License. |
| 14 | + |
| 15 | +#include "Source/common/cel/Activation.h" |
| 16 | +#include "Source/common/cel/CELProtoTraits.h" |
| 17 | +#include "Source/common/cel/Evaluator.h" |
| 18 | + |
| 19 | +#import <Foundation/Foundation.h> |
| 20 | +#import <XCTest/XCTest.h> |
| 21 | + |
| 22 | +#include <mach/mach.h> |
| 23 | +#include <cstddef> |
| 24 | +#include <string> |
| 25 | +#include <vector> |
| 26 | + |
| 27 | +#include "absl/status/statusor.h" |
| 28 | + |
| 29 | +static size_t GetResidentMemoryBytes() { |
| 30 | + mach_task_basic_info_data_t info; |
| 31 | + mach_msg_type_number_t count = MACH_TASK_BASIC_INFO_COUNT; |
| 32 | + if (task_info(mach_task_self(), MACH_TASK_BASIC_INFO, (task_info_t)&info, &count) != |
| 33 | + KERN_SUCCESS) { |
| 34 | + return 0; |
| 35 | + } |
| 36 | + return info.resident_size; |
| 37 | +} |
| 38 | + |
| 39 | +@interface ArenaGrowthTest : XCTestCase |
| 40 | +@end |
| 41 | + |
| 42 | +@implementation ArenaGrowthTest |
| 43 | + |
| 44 | +/// Regression test for unbounded arena growth in CompileAndEvaluate. |
| 45 | +/// |
| 46 | +/// Previously, the Evaluator used a single protobuf Arena for every |
| 47 | +/// compile+evaluate cycle. Since Arena is a monotonic bump allocator that never |
| 48 | +/// frees individual allocations, every evaluation leaked materialized variable |
| 49 | +/// values (args strings, env maps, etc.) and compilation temporaries. |
| 50 | +/// |
| 51 | +/// The fix uses a stack-local Arena in CompileAndEvaluate so temporaries are |
| 52 | +/// freed at end of scope. This test verifies memory stays bounded. |
| 53 | +- (void)testCompileAndEvaluateArenaGrowth { |
| 54 | + using ExecutableFileT = santa::cel::CELProtoTraits<true>::ExecutableFileT; |
| 55 | + using AncestorT = santa::cel::CELProtoTraits<true>::AncestorT; |
| 56 | + |
| 57 | + auto sut = santa::cel::Evaluator<true>::Create(); |
| 58 | + if (!sut.ok()) { |
| 59 | + XCTFail(@"Failed to create evaluator: %.*s", (int)sut.status().message().size(), |
| 60 | + sut.status().message().data()); |
| 61 | + return; |
| 62 | + } |
| 63 | + |
| 64 | + // Build a large args list to amplify per-evaluation arena allocation. |
| 65 | + // This simulates a process like `node` or `yarn` with many arguments. |
| 66 | + std::vector<std::string> largeArgs; |
| 67 | + largeArgs.reserve(200); |
| 68 | + for (int i = 0; i < 200; i++) { |
| 69 | + largeArgs.push_back(std::string(256, 'a' + (i % 26))); |
| 70 | + } |
| 71 | + const auto *argsPtr = &largeArgs; |
| 72 | + |
| 73 | + // Expression that forces materialization of the full args list onto the arena. |
| 74 | + absl::string_view expr = "args.exists(x, x == 'nonexistent_value')"; |
| 75 | + |
| 76 | + // Warm up: run a few iterations to stabilize RSS and JIT/lazy allocations. |
| 77 | + for (int i = 0; i < 10; i++) { |
| 78 | + @autoreleasepool { |
| 79 | + auto f = std::make_unique<ExecutableFileT>(); |
| 80 | + f->mutable_signing_time()->set_seconds(1748436989); |
| 81 | + santa::cel::Activation<true> activation( |
| 82 | + std::move(f), |
| 83 | + ^std::vector<std::string>() { |
| 84 | + return *argsPtr; |
| 85 | + }, |
| 86 | + ^std::map<std::string, std::string>() { |
| 87 | + return {}; |
| 88 | + }, |
| 89 | + ^uid_t() { |
| 90 | + return 501; |
| 91 | + }, |
| 92 | + ^std::string() { |
| 93 | + return "/usr/local/bin"; |
| 94 | + }, |
| 95 | + ^std::vector<AncestorT>() { |
| 96 | + return {}; |
| 97 | + }); |
| 98 | + auto result = sut.value()->CompileAndEvaluate(expr, activation); |
| 99 | + if (!result.ok()) { |
| 100 | + XCTFail(@"Warmup failed: %.*s", (int)result.status().message().size(), |
| 101 | + result.status().message().data()); |
| 102 | + return; |
| 103 | + } |
| 104 | + } |
| 105 | + } |
| 106 | + |
| 107 | + size_t rssBaseline = GetResidentMemoryBytes(); |
| 108 | + XCTAssertGreaterThan(rssBaseline, (size_t)0, @"Failed to read RSS"); |
| 109 | + |
| 110 | + // Run many iterations of CompileAndEvaluate. Each iteration materializes |
| 111 | + // ~200 * 256 = ~50KB of arg strings onto the arena, plus compilation |
| 112 | + // temporaries. Before the fix this grew by ~600MB+ over 5000 iterations. |
| 113 | + const int iterations = 5000; |
| 114 | + for (int i = 0; i < iterations; i++) { |
| 115 | + @autoreleasepool { |
| 116 | + auto f = std::make_unique<ExecutableFileT>(); |
| 117 | + f->mutable_signing_time()->set_seconds(1748436989); |
| 118 | + santa::cel::Activation<true> activation( |
| 119 | + std::move(f), |
| 120 | + ^std::vector<std::string>() { |
| 121 | + return *argsPtr; |
| 122 | + }, |
| 123 | + ^std::map<std::string, std::string>() { |
| 124 | + return {{"PATH", "/usr/bin"}, {"HOME", "/Users/test"}}; |
| 125 | + }, |
| 126 | + ^uid_t() { |
| 127 | + return 501; |
| 128 | + }, |
| 129 | + ^std::string() { |
| 130 | + return "/usr/local/bin"; |
| 131 | + }, |
| 132 | + ^std::vector<AncestorT>() { |
| 133 | + return {}; |
| 134 | + }); |
| 135 | + auto result = sut.value()->CompileAndEvaluate(expr, activation); |
| 136 | + if (!result.ok()) { |
| 137 | + XCTFail(@"Iteration %d failed: %.*s", i, (int)result.status().message().size(), |
| 138 | + result.status().message().data()); |
| 139 | + return; |
| 140 | + } |
| 141 | + } |
| 142 | + } |
| 143 | + |
| 144 | + size_t rssAfter = GetResidentMemoryBytes(); |
| 145 | + size_t growth = rssAfter > rssBaseline ? rssAfter - rssBaseline : 0; |
| 146 | + |
| 147 | + double growthMB = (double)growth / (1024.0 * 1024.0); |
| 148 | + NSLog(@"Arena growth test: baseline=%.1fMB, after=%.1fMB, growth=%.1fMB over %d iterations", |
| 149 | + (double)rssBaseline / (1024.0 * 1024.0), (double)rssAfter / (1024.0 * 1024.0), growthMB, |
| 150 | + iterations); |
| 151 | + |
| 152 | + // Threshold: 50MB is generous enough to avoid flakiness from normal heap |
| 153 | + // activity, but will clearly catch unbounded arena growth (~600MB before fix). |
| 154 | + double thresholdMB = 50.0; |
| 155 | + XCTAssertLessThan(growthMB, thresholdMB, |
| 156 | + @"CompileAndEvaluate leaked %.1fMB over %d iterations " |
| 157 | + @"(threshold: %.0fMB). This indicates unbounded arena growth.", |
| 158 | + growthMB, iterations, thresholdMB); |
| 159 | +} |
| 160 | + |
| 161 | +@end |
0 commit comments