isImplementedInClass leaks the losing sample instance on re-entrant or racing cache population
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 38/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- cpp, objective-c
- 领域
- mobile-dev
调研方向
从 NativeScript/runtime/Metadata.mm 中的 MethodMeta::isImplementedInClass 以及指向此 issue 的注释开始;跟踪 sampleInstances 的填充、mutex 的使用和 alloc 的可重入行为。完成标准是在可重入或存在竞争的填充过程中消除被遗弃的 sample instances,同时不发生死锁、不安全释放或有意的永久保留。
由索引模型根据 Issue 内容生成。
描述
Problem
MethodMeta::isImplementedInClass (NativeScript/runtime/Metadata.mm) keeps a process-wide cache of [klass alloc]-created sample instances used to answer respondsToSelector: for classes whose alloc returns a different class or which forward messages. The cache is populated like this:
[klass alloc]runs outside the mutex — deliberately, becausealloccan trigger+initialize, which may run arbitrary code that re-enters this method (holding the lock would deadlock).- The lock is then taken and
sampleInstances.emplace(klass, instance)inserts.
When the emplace loses — the re-entrant call already populated the entry for the same class, or another thread raced — the freshly allocated instance is abandoned: one leaked object per lost race (Instruments shows these as e.g. a leaked UIAlertView / NSURLSessionConfiguration attributed to isImplementedInClass). The count varies run to run since it is timing-dependent.
Why the obvious fixes don't work
- Releasing the loser is unsafe: the instance is
alloc'd but neverinit'd, so-releaseruns-deallocagainst zero-filled ivars of an arbitrary framework class, on whatever thread the probe ran on (it demonstrably runs on worker threads). Benign for most classes, but a-deallocthat doesCFRelease/dispatch_releaseon a zero ivar traps, and UIKit teardown off the main thread is asserting territory. - Holding the lock across
allocdeadlocks via the+initializere-entry described above. - Parking losers in a static container merely converts the unreachable leak into intentional perpetual retention — it silences Instruments without reclaiming anything (tried and reverted in #458).
Potential solutions
- A re-entrancy-aware locking scheme (recursive mutex, or a reader/writer arrangement) so the populate path can be made atomic with respect to re-entrant probes without deadlocking through
+initialize. - Reuse already-
alloc-ed objects: when a sample for that Class is requested (or something else calls[thatClass alloc]through the runtime), hand out / consume the cached instance instead of allocating another, so a losing instance gets used rather than abandoned.
The leak site carries a comment pointing at this issue.
- 主要语言
- JavaScript
- 星标
- 150
- 派生
- 43
- 平均合并
- 3 天 10 小时
- 30 天内合并 PR
- 22
贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
NativeScript/ios 的其他 Issue
-
难度 5/5 一周以上 新手友好度 25/100
NativeScript/ios#445 ·
-
难度 3/5 3-5 天 新手友好度 66/100
NativeScript/ios#414 ·
-
question
难度 4/5 3-5 天 新手友好度 34/100
NativeScript/ios#364 · 2 条评论 ·
-
难度 4/5 3-5 天 新手友好度 35/100
NativeScript/ios#355 ·
-
难度 4/5 3-5 天 新手友好度 25/100
NativeScript/ios#292 · 9 条评论 ·
相似的 Issue
-
bug
难度 2/5 1-3 小时 新手友好度 76/100
avniproject/avni-client#2135 ·
-
enhancement
难度 2/5 1-3 小时 新手友好度 70/100
babalae/bettergi-scripts-list#3674 ·
-
A-Release-Notes C-Editing D-Modest S-Ready-For-Implementation
难度 2/5 1-3 小时 新手友好度 72/100
bevyengine/bevy-website#2595 ·
-
ecosystem wording
难度 1/5 1 小时以内 新手友好度 90/100
matrix-org/matrix.org#3649 ·
-
难度 2/5 1-3 小时 新手友好度 88/100
vadimdemedes/ink#1029 ·