Garbage Collector Memory Accounting in Language-Based Systems

Language run-time systems are often called upon tosafely execute mutually distrustful tasks within the sameruntime, protecting them from other tasks' bugs or otherwisehostile behavior. Well-studied access controls exist insystems such as Java to prevent unauthorized reading orwriting of data, but techniques to measure and control resourceusage are less prevalent. In particular, most languagerun-time systems include no facility to account forand regulate heap memory usage on a per-task basis. Thisoversight can be exploited by a misbehaving task, whichmight allocate and hold live enough memory to cause adenial-of-service attack, crashing or slowing down othertasks. In addition, tasks can legitimately share referencesto the same objects, and traditional approaches that chargememory to its allocator fail to properly account for thissharing. We present a method for modifying the garbagecollector, already present in most modern language run-timesystems, to measure the amount of live memory reachablefrom each task as it performs its regular duties. Oursystem naturally distinguishes memory shared across tasksfrom memory reachable from only a single task without requiringincompatible changes to the semantics of the programminglanguage. Our prototype implementation imposesnegligible performance overheads in a variety ofbenchmarks, yet provides enough information for the expressionof rich policies to express the limits on a task'smemory usage.