Skip to content

WIP: perf: copy-on-write for sentry_value_t clone #1794

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jpnurmi wants to merge 6 commits into
base: master
Choose a base branch
from
Open

WIP: perf: copy-on-write for sentry_value_t clone #1794

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
fa0e5b3
benchmark: scope & value
jpnurmi Jun 4, 2026
e7a2524
fix: clone user and fingerprint in scope_apply_to_event
jpnurmi Jun 4, 2026
6f7d4b8
ref: copy-on-write for sentry_value_t clone
jpnurmi Mar 4, 2026
201b00d
fix(value): Fix nested clone failure in thing_clone_children
jpnurmi Jun 4, 2026
409939c
fix: Handle object detach key clone failures
jpnurmi Jul 6, 2026
3e7dd7b
Update CHANGELOG.md
jpnurmi Jul 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@

- Native/Windows: ensure valid event IDs for fast-fail crash envelopes to fix launching of the external crash reporter for fast-fail crashes. ([#1832](https://github.com/getsentry/sentry-native/pull/1832))
- Native/Linux: resolve symbols from split-debug files on Linux. ([#1836](https://github.com/getsentry/sentry-native/pull/1836))
- Fix scope data loss from shared `sentry_value_t` containers while significantly improving scope merge performance with copy-on-write cloning. ([#1794](https://github.com/getsentry/sentry-native/pull/1794))

## 0.15.2

Expand Down
4 changes: 2 additions & 2 deletions src/sentry_scope.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -414,10 +414,10 @@ sentry__scope_apply_to_event(const sentry_scope_t *scope,
sentry_value_new_string(options->run->installation_id));
}
} else if (sentry_value_get_length(scope->user) > 0) {
PLACE_VALUE("user", scope->user);
PLACE_CLONED_VALUE("user", scope->user);
}
}
PLACE_VALUE("fingerprint", scope->fingerprint);
PLACE_CLONED_VALUE("fingerprint", scope->fingerprint);
PLACE_STRING("transaction", scope->transaction);
PLACE_VALUE("sdk", scope->client_sdk);

Expand Down
236 changes: 206 additions & 30 deletions src/sentry_value.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,7 @@ typedef struct {
sentry_value_t *items;
size_t len;
size_t allocated;
long refcount;
} list_t;

typedef struct {
Expand All @@ -104,6 +105,7 @@ typedef struct {
obj_pair_t *pairs;
size_t len;
size_t allocated;
long refcount;
} obj_t;

static const char *
Expand Down Expand Up @@ -161,33 +163,148 @@ thing_get_type(const thing_t *thing)
}

static void
thing_free(thing_t *thing)
list_free(list_t *list)
{
if (sentry__atomic_fetch_and_add(&list->refcount, -1) != 1) {
return;
}
for (size_t i = 0; i < list->len; i++) {
sentry_value_decref(list->items[i]);
}
sentry_free(list->items);
sentry_free(list);
}

static void
obj_free(obj_t *obj)
{
if (sentry__atomic_fetch_and_add(&obj->refcount, -1) != 1) {
return;
}
for (size_t i = 0; i < obj->len; i++) {
sentry_free(obj->pairs[i].k);
sentry_value_decref(obj->pairs[i].v);
}
sentry_free(obj->pairs);
sentry_free(obj);
}

static bool
thing_detach(thing_t *thing)
{
switch (thing_get_type(thing)) {
case THING_TYPE_LIST: {
list_t *list = thing->payload._ptr;
for (size_t i = 0; i < list->len; i++) {
sentry_value_decref(list->items[i]);
list_t *old = thing->payload._ptr;
if (sentry__atomic_fetch(&old->refcount) <= 1) {
return true;
}
sentry_free(list->items);
sentry_free(list);
break;
list_t *new_list = SENTRY_MAKE(list_t);
if (!new_list) {
return false;
}
new_list->len = old->len;
new_list->allocated = old->len;
new_list->refcount = 1;
if (old->len) {
new_list->items = sentry_malloc(sizeof(sentry_value_t) * old->len);
if (!new_list->items) {
sentry_free(new_list);
return false;
}
memcpy(
new_list->items, old->items, sizeof(sentry_value_t) * old->len);
for (size_t i = 0; i < old->len; i++) {
sentry_value_incref(new_list->items[i]);
}
} else {
new_list->items = NULL;
}
list_free(old);
thing->payload._ptr = new_list;
return true;
}
case THING_TYPE_OBJECT: {
obj_t *obj = thing->payload._ptr;
for (size_t i = 0; i < obj->len; i++) {
sentry_free(obj->pairs[i].k);
sentry_value_decref(obj->pairs[i].v);
obj_t *old = thing->payload._ptr;
if (sentry__atomic_fetch(&old->refcount) <= 1) {
return true;
}
obj_t *new_obj = SENTRY_MAKE(obj_t);
if (!new_obj) {
return false;
}
new_obj->len = 0;
new_obj->allocated = old->len;
new_obj->refcount = 1;
if (old->len) {
new_obj->pairs = sentry_malloc(sizeof(obj_pair_t) * old->len);
if (!new_obj->pairs) {
sentry_free(new_obj);
return false;
}
for (size_t i = 0; i < old->len; i++) {
new_obj->pairs[i].k = sentry__string_clone(old->pairs[i].k);
if (!new_obj->pairs[i].k) {
obj_free(new_obj);
return false;
}
new_obj->pairs[i].v = old->pairs[i].v;
sentry_value_incref(new_obj->pairs[i].v);
new_obj->len++;
}
} else {
new_obj->pairs = NULL;
}
sentry_free(obj->pairs);
sentry_free(obj);
obj_free(old);
thing->payload._ptr = new_obj;
Comment thread
cursor[bot] marked this conversation as resolved.
return true;
}
default:
return true;
}
}

static sentry_value_t
thing_get_child(const thing_t *thing, size_t i)
{
switch (thing_get_type(thing)) {
case THING_TYPE_LIST:
return ((const list_t *)thing->payload._ptr)->items[i];
case THING_TYPE_OBJECT:
return ((const obj_t *)thing->payload._ptr)->pairs[i].v;
default:
return sentry_value_new_null();
}
}

static void
thing_set_child(thing_t *thing, size_t i, sentry_value_t value)
{
switch (thing_get_type(thing)) {
case THING_TYPE_LIST:
((list_t *)thing->payload._ptr)->items[i] = value;
break;
case THING_TYPE_OBJECT:
((obj_t *)thing->payload._ptr)->pairs[i].v = value;
break;
default:
break;
}
case THING_TYPE_STRING: {
}

static void
thing_free(thing_t *thing)
{
switch (thing_get_type(thing)) {
case THING_TYPE_LIST:
list_free(thing->payload._ptr);
break;
case THING_TYPE_OBJECT:
obj_free(thing->payload._ptr);
break;
case THING_TYPE_STRING:
sentry_free(thing->payload._ptr);
break;
}
}
sentry_free(thing);
}

Expand Down Expand Up @@ -395,6 +512,8 @@ sentry_value_new_list(void)
{
list_t *l = SENTRY_MAKE(list_t);
if (l) {
memset(l, 0, sizeof(list_t));
l->refcount = 1;
sentry_value_t rv = new_thing_value(l, THING_TYPE_LIST);
if (sentry_value_is_null(rv)) {
sentry_free(l);
Expand All @@ -410,6 +529,8 @@ sentry__value_new_list_with_size(size_t size)
{
list_t *l = SENTRY_MAKE(list_t);
if (l) {
memset(l, 0, sizeof(list_t));
l->refcount = 1;
l->allocated = size;
if (size) {
l->items = sentry_malloc(sizeof(sentry_value_t) * size);
Expand All @@ -434,6 +555,8 @@ sentry_value_new_object(void)
{
obj_t *o = SENTRY_MAKE(obj_t);
if (o) {
memset(o, 0, sizeof(obj_t));
o->refcount = 1;
sentry_value_t rv = new_thing_value(o, THING_TYPE_OBJECT);
if (sentry_value_is_null(rv)) {
sentry_free(o);
Expand All @@ -449,6 +572,8 @@ sentry__value_new_object_with_size(size_t size)
{
obj_t *o = SENTRY_MAKE(obj_t);
if (o) {
memset(o, 0, sizeof(obj_t));
o->refcount = 1;
o->allocated = size;
if (size) {
o->pairs = sentry_malloc(sizeof(obj_pair_t) * size);
Expand Down Expand Up @@ -639,7 +764,8 @@ sentry_value_set_by_key_n(
}
sentry_slice_t k_slice = { k, k_len };
thing_t *thing = value_as_unfrozen_thing(value);
if (!thing || thing_get_type(thing) != THING_TYPE_OBJECT) {
if (!thing || thing_get_type(thing) != THING_TYPE_OBJECT
|| !thing_detach(thing)) {
goto fail;
}
obj_t *o = thing->payload._ptr;
Expand Down Expand Up @@ -690,7 +816,8 @@ sentry_value_remove_by_key_n(sentry_value_t value, const char *k, size_t k_len)
}
sentry_slice_t k_slice = { k, k_len };
thing_t *thing = value_as_unfrozen_thing(value);
if (!thing || thing_get_type(thing) != THING_TYPE_OBJECT) {
if (!thing || thing_get_type(thing) != THING_TYPE_OBJECT
|| !thing_detach(thing)) {
return 1;
}
obj_t *o = thing->payload._ptr;
Expand Down Expand Up @@ -722,7 +849,8 @@ int
sentry_value_append(sentry_value_t value, sentry_value_t v)
{
thing_t *thing = value_as_unfrozen_thing(value);
if (!thing || thing_get_type(thing) != THING_TYPE_LIST) {
if (!thing || thing_get_type(thing) != THING_TYPE_LIST
|| !thing_detach(thing)) {
goto fail;
}

Expand Down Expand Up @@ -791,6 +919,42 @@ sentry__value_stringify(sentry_value_t value)
#undef STRINGIFY_NUMERIC
}

static bool
value_is_container(sentry_value_t value)
{
const thing_t *thing = value_as_thing(value);
if (!thing) {
return false;
}
int type = thing_get_type(thing);
return type == THING_TYPE_LIST || type == THING_TYPE_OBJECT;
}

static bool
thing_clone_children(thing_t *thing, size_t len)
{
bool detached = false;
for (size_t i = 0; i < len; i++) {
sentry_value_t child = thing_get_child(thing, i);
if (!value_is_container(child)) {
continue;
}
if (!detached) {
if (!thing_detach(thing)) {
return false;
}
detached = true;
}
sentry_value_t cloned = sentry__value_clone(child);
if (sentry_value_is_null(cloned)) {
return false;
}
sentry_value_decref(child);
thing_set_child(thing, i, cloned);

@sentry sentry Bot Jul 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The thing_clone_children function leaks memory. It calls thing_detach, which increments child refcounts, but then thing_set_child overwrites the child without decrementing the now-orphaned reference.
Severity: MEDIUM

Suggested Fix

Before calling thing_set_child in thing_clone_children, the reference to the old child at that index should be retrieved and decremented. The thing_set_child function could also be modified to decrement the reference count of the existing value at the target index before assigning the new value, similar to the pattern used in sentry_value_set_by_index.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/sentry_value.c#L953

Potential issue: A memory leak occurs in the `thing_clone_children` function when
cloning a value that contains nested containers. The function calls `thing_detach`,
which creates a private copy of the container and increments the reference count of all
its items. Subsequently, `thing_set_child` is used to replace a nested container with
its cloned version. However, `thing_set_child` directly overwrites the item in the
container's list without decrementing the reference count of the old item that was just
incremented. This results in a leaked reference for each cloned nested container.

Did we get this right? 👍 / 👎 to inform future reviews.

@jpnurmi jpnurmi Jul 6, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thing_detach() does increment the copied child references when it creates the private parent container. However, thing_clone_children() explicitly balances that copied-slot reference before overwriting the slot:

sentry_value_t cloned = sentry__value_clone(child);
if (sentry_value_is_null(cloned)) {
    return false;
}
sentry_value_decref(child);
thing_set_child(thing, i, cloned);

So thing_set_child() intentionally does not decref the old value itself; the caller has already done it at sentry_value_decref(child). The local child variable is just a borrowed copy of the slot value, not an additional owned reference.

This should also be covered by CI if it were real: the unit suite includes nested clone coverage, and CI runs those tests under leak checkers including ASan/LSan and Valgrind. A leaked nested-container reference in this path should be reported there.

}
return true;
Comment thread
cursor[bot] marked this conversation as resolved.
}

sentry_value_t
sentry__value_clone(sentry_value_t value)
{
Expand All @@ -800,20 +964,30 @@ sentry__value_clone(sentry_value_t value)
}
switch (thing_get_type(thing)) {
case THING_TYPE_LIST: {
const list_t *list = thing->payload._ptr;
sentry_value_t rv = sentry__value_new_list_with_size(list->len);
for (size_t i = 0; i < list->len; i++) {
sentry_value_incref(list->items[i]);
sentry_value_append(rv, list->items[i]);
list_t *list = thing->payload._ptr;
sentry__atomic_fetch_and_add(&list->refcount, 1);
sentry_value_t rv = new_thing_value(list, THING_TYPE_LIST);
if (sentry_value_is_null(rv)) {
list_free(list);
return rv;
}
if (!thing_clone_children(value_as_thing(rv), list->len)) {
sentry_value_decref(rv);
return sentry_value_new_null();
}
return rv;
}
case THING_TYPE_OBJECT: {
const obj_t *obj = thing->payload._ptr;
sentry_value_t rv = sentry__value_new_object_with_size(obj->len);
for (size_t i = 0; i < obj->len; i++) {
sentry_value_incref(obj->pairs[i].v);
sentry_value_set_by_key(rv, obj->pairs[i].k, obj->pairs[i].v);
obj_t *obj = thing->payload._ptr;
sentry__atomic_fetch_and_add(&obj->refcount, 1);
sentry_value_t rv = new_thing_value(obj, THING_TYPE_OBJECT);
if (sentry_value_is_null(rv)) {
obj_free(obj);
return rv;
}
if (!thing_clone_children(value_as_thing(rv), obj->len)) {
sentry_value_decref(rv);
return sentry_value_new_null();
}
return rv;
}
Expand All @@ -832,7 +1006,8 @@ int
sentry_value_set_by_index(sentry_value_t value, size_t index, sentry_value_t v)
{
thing_t *thing = value_as_unfrozen_thing(value);
if (!thing || thing_get_type(thing) != THING_TYPE_LIST) {
if (!thing || thing_get_type(thing) != THING_TYPE_LIST
|| !thing_detach(thing)) {
goto fail;
}

Expand Down Expand Up @@ -862,7 +1037,8 @@ int
sentry_value_remove_by_index(sentry_value_t value, size_t index)
{
thing_t *thing = value_as_unfrozen_thing(value);
if (!thing || thing_get_type(thing) != THING_TYPE_LIST) {
if (!thing || thing_get_type(thing) != THING_TYPE_LIST
|| !thing_detach(thing)) {
return 1;
}

Expand Down
Loading
Loading