erts: Fix memory leak of enif_inspect_* on independent environment

Affects enif_inspect_iolist_as_binary() on iolists
and enif_inspect_binary() on byte-unaligned binaries.

Also need to allocate inspection buffers in ERTS_ALC_T_NIF for
process independent environments, as we don't know when and where
the environment will be freed.

3 files changed, 68 insertions, 12 deletions

diff --git a/erts/emulator/beam/erl_nif.c b/erts/emulator/beam/erl_nif.c
index 51f1fad811..0ca659eaea 100644
--- a/erts/emulator/beam/erl_nif.c
+++ b/erts/emulator/beam/erl_nif.c
@@ -130,10 +130,13 @@ static void pre_nif_noproc(ErlNifEnv* env, struct erl_module_nif* mod_nif)
     env->tmp_obj_list = NULL;
 }
 
-/* Temporary object header, auto-deallocated when NIF returns. */
+/* Temporary object header, auto-deallocated when NIF returns
+ * or when independent environment is cleared.
+ */
 struct enif_tmp_obj_t {
     struct enif_tmp_obj_t* next;
     void (*dtor)(struct enif_tmp_obj_t*);
+    ErtsAlcType_t allocator;
     /*char data[];*/
 };
 
@@ -244,7 +247,7 @@ ErlNifEnv* enif_alloc_env(void)
     msg_env->env.hp_end = phony_heap;
     msg_env->env.heap_frag = NULL;
     msg_env->env.mod_nif = NULL;
-    msg_env->env.tmp_obj_list = (struct enif_tmp_obj_t*) 1; /* invalid non-NULL */
+    msg_env->env.tmp_obj_list = NULL;
     msg_env->env.proc = &msg_env->phony_proc;
     memset(&msg_env->phony_proc, 0, sizeof(Process));
     HEAP_START(&msg_env->phony_proc) = phony_heap;
@@ -289,6 +292,7 @@ void enif_clear_env(ErlNifEnv* env)
     menv->env.hp = menv->env.hp_end = HEAP_TOP(p);
     
     ASSERT(!is_offheap(&MSO(p)));
+    free_tmp_objs(env);
 }
 int enif_send(ErlNifEnv* env, const ErlNifPid* to_pid,
 	      ErlNifEnv* msg_env, ERL_NIF_TERM msg)
@@ -440,24 +444,31 @@ int enif_is_number(ErlNifEnv* env, ERL_NIF_TERM term)
     return is_number(term);
 }
 
+static ERTS_INLINE int is_proc_bound(ErlNifEnv* env)
+{
+    return env->mod_nif != NULL;
+}
+
 static void aligned_binary_dtor(struct enif_tmp_obj_t* obj)
 {
-    erts_free_aligned_binary_bytes_extra((byte*)obj,ERTS_ALC_T_TMP);
+    erts_free_aligned_binary_bytes_extra((byte*)obj, obj->allocator);
 }
 
 int enif_inspect_binary(ErlNifEnv* env, Eterm bin_term, ErlNifBinary* bin)
 {
+    ErtsAlcType_t allocator = is_proc_bound(env) ? ERTS_ALC_T_TMP : ERTS_ALC_T_NIF;
     union {
 	struct enif_tmp_obj_t* tmp;
 	byte* raw_ptr;
     }u;
     u.tmp = NULL;
-    bin->data = erts_get_aligned_binary_bytes_extra(bin_term, &u.raw_ptr, ERTS_ALC_T_TMP,
+    bin->data = erts_get_aligned_binary_bytes_extra(bin_term, &u.raw_ptr, allocator,
 						    sizeof(struct enif_tmp_obj_t));
     if (bin->data == NULL) {
 	return 0;
     }
     if (u.tmp != NULL) {
+	u.tmp->allocator = allocator;
 	u.tmp->next = env->tmp_obj_list;
 	u.tmp->dtor = &aligned_binary_dtor;
 	env->tmp_obj_list = u.tmp;
@@ -471,12 +482,13 @@ int enif_inspect_binary(ErlNifEnv* env, Eterm bin_term, ErlNifBinary* bin)
 
 static void tmp_alloc_dtor(struct enif_tmp_obj_t* obj)
 {
-    erts_free(ERTS_ALC_T_TMP,  obj);
+    erts_free(obj->allocator,  obj);
 }
 
 int enif_inspect_iolist_as_binary(ErlNifEnv* env, Eterm term, ErlNifBinary* bin)
 {
     struct enif_tmp_obj_t* tobj;
+    ErtsAlcType_t allocator;
     Uint sz;
     if (is_binary(term)) {
 	return enif_inspect_binary(env,term,bin);
@@ -491,8 +503,10 @@ int enif_inspect_iolist_as_binary(ErlNifEnv* env, Eterm term, ErlNifBinary* bin)
     if (erts_iolist_size(term, &sz)) {
 	return 0;
     }
-    
-    tobj = erts_alloc(ERTS_ALC_T_TMP, sz + sizeof(struct enif_tmp_obj_t));
+
+    allocator = is_proc_bound(env) ? ERTS_ALC_T_TMP : ERTS_ALC_T_NIF;
+    tobj = erts_alloc(allocator, sz + sizeof(struct enif_tmp_obj_t));
+    tobj->allocator = allocator;
     tobj->next = env->tmp_obj_list;
     tobj->dtor = &tmp_alloc_dtor;
     env->tmp_obj_list = tobj;
@@ -1743,8 +1757,10 @@ struct readonly_check_t
 };
 static void add_readonly_check(ErlNifEnv* env, unsigned char* ptr, unsigned sz)
 {
-    struct readonly_check_t* obj = erts_alloc(ERTS_ALC_T_TMP, 
+    ErtsAlcType_t allocator = is_proc_bound(env) ? ERTS_ALC_T_TMP : ERTS_ALC_T_NIF;
+    struct readonly_check_t* obj = erts_alloc(allocator, 
 					      sizeof(struct readonly_check_t));
+    obj->hdr.allocator = allocator;
     obj->hdr.next = env->tmp_obj_list;
     env->tmp_obj_list = &obj->hdr;
     obj->hdr.dtor = &readonly_check_dtor;
@@ -1761,7 +1777,7 @@ static void readonly_check_dtor(struct enif_tmp_obj_t* o)
 		" %x != %x\r\nABORTING\r\n", chksum, obj->checksum);
 	abort();
     }
-    erts_free(ERTS_ALC_T_TMP,  obj);
+    erts_free(obj->hdr.allocator,  obj);
 }
 static unsigned calc_checksum(unsigned char* ptr, unsigned size)
 {
diff --git a/erts/emulator/test/nif_SUITE.erl b/erts/emulator/test/nif_SUITE.erl
index 5c82a01bd1..370363bf9e 100644
--- a/erts/emulator/test/nif_SUITE.erl
+++ b/erts/emulator/test/nif_SUITE.erl
@@ -35,7 +35,9 @@
 	 resource_takeover/1,
 	 threading/1, send/1, send2/1, send3/1, send_threaded/1, neg/1, 
 	 is_checks/1,
-	 get_length/1, make_atom/1, make_string/1, reverse_list_test/1]).
+	 get_length/1, make_atom/1, make_string/1, reverse_list_test/1,
+	 otp_9668/1
+	]).
 
 -export([many_args_100/100]).
 
@@ -60,7 +62,9 @@ all() ->
      iolist_as_binary, resource, resource_binary,
      resource_takeover, threading, send, send2, send3,
      send_threaded, neg, is_checks, get_length, make_atom,
-     make_string,reverse_list_test].
+     make_string,reverse_list_test,
+     otp_9668
+    ].
 
 groups() -> 
     [].
@@ -1236,6 +1240,20 @@ reverse_list_test(Config) ->
     ?line RevList = reverse_list(List),
     ?line badarg = reverse_list(foo).
 
+otp_9668(doc) -> ["Memory leak of tmp-buffer when inspecting iolist or unaligned binary in unbound environment"];
+otp_9668(Config) ->
+    ensure_lib_loaded(Config, 1),
+    TmpMem = tmpmem(),
+    IOList = ["This",' ',<<"is">>,' ',[<<"an iolist">>,'.']],    
+    otp_9668_nif(IOList),
+
+    <<_:5/bitstring,UnalignedBin:10/binary,_/bitstring>> = <<"Abuse me as unaligned">>,
+    otp_9668_nif(UnalignedBin),
+
+    ?line verify_tmpmem(TmpMem),
+    ok.
+
+
 tmpmem() ->
     case erlang:system_info({allocator,temp_alloc}) of
 	false -> undefined;
@@ -1345,6 +1363,7 @@ send_term(_,_) -> ?nif_stub.
 reverse_list(_) -> ?nif_stub.
 echo_int(_) -> ?nif_stub.
 type_sizes() -> ?nif_stub.
+otp_9668_nif(_) -> ?nif_stub.
 
 nif_stub_error(Line) ->
     exit({nif_not_loaded,module,?MODULE,line,Line}).
diff --git a/erts/emulator/test/nif_SUITE_data/nif_SUITE.c b/erts/emulator/test/nif_SUITE_data/nif_SUITE.c
index 35f54d62c5..7d7903af25 100644
--- a/erts/emulator/test/nif_SUITE_data/nif_SUITE.c
+++ b/erts/emulator/test/nif_SUITE_data/nif_SUITE.c
@@ -1431,6 +1431,26 @@ static ERL_NIF_TERM reverse_list(ErlNifEnv* env, int argc, const ERL_NIF_TERM ar
     return rev_list;
 }
 
+static ERL_NIF_TERM otp_9668_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{
+    /* Inspect in process independent env */
+    ErlNifEnv* myenv = enif_alloc_env();
+    ERL_NIF_TERM mycopy = enif_make_copy(myenv, argv[0]);
+    ErlNifBinary obin, cbin;
+
+    if ((enif_inspect_binary(env, argv[0], &obin)
+	 && enif_inspect_binary(myenv, mycopy, &cbin))
+	||
+	(enif_inspect_iolist_as_binary(env, argv[0], &obin)
+	 && enif_inspect_iolist_as_binary(myenv, mycopy, &cbin)))
+    {
+	assert(obin.size == cbin.size);
+	assert(memcmp(obin.data, cbin.data, obin.size) == 0);
+    }	
+    enif_free_env(myenv);
+    return atom_ok;
+}
+
 static ErlNifFunc nif_funcs[] =
 {
     {"lib_version", 0, lib_version},
@@ -1478,7 +1498,8 @@ static ErlNifFunc nif_funcs[] =
     {"send_term", 2, send_term},
     {"reverse_list",1, reverse_list},
     {"echo_int", 1, echo_int},
-    {"type_sizes", 0, type_sizes}
+    {"type_sizes", 0, type_sizes},
+    {"otp_9668_nif", 1, otp_9668_nif}
 };
 
 ERL_NIF_INIT(nif_SUITE,nif_funcs,load,reload,upgrade,unload)