fix(scripting): unload compiled-script assemblies via collectible ALC
Core.Scripting-008 resolution: replace the legacy CSharpScript.CreateDelegate
path with hand-rolled CSharpCompilation + Emit + collectible AssemblyLoadContext,
so per-publish compile accretion no longer requires a server restart to reclaim.
Why this was needed:
Roslyn's CSharpScript path emits dynamically-compiled script assemblies into
the default AssemblyLoadContext, which is non-collectible. Across config-
publish generations each Clear() drops dictionary entries but the emitted
assemblies stay loaded for process lifetime, so memory grows steadily on
long-running servers with frequent publishes. The accepted-limitation note
in docs/VirtualTags.md recommended scheduled restarts as the workaround;
operator feedback was that restarts are difficult, so the underlying
limitation was the right thing to fix.
Implementation:
- New ScriptAssemblyLoadContext(name, isCollectible: true) hosts one emitted
script assembly per evaluator.
- ScriptEvaluator.Compile synthesises a wrapper class around the user source
(CompiledScript.Run(globals) — explicit return required per ordinary C#
semantics, which every existing script already uses), builds a
CSharpCompilation against the sandbox references, runs the
ForbiddenTypeAnalyzer over the semantic model unchanged, emits to an
in-memory PE stream, loads via ScriptAssemblyLoadContext.LoadFromStream,
and binds a strongly-typed Func<ScriptGlobals<TContext>, TResult> delegate
via reflection.
- ScriptEvaluator now implements IDisposable — Dispose calls
AssemblyLoadContext.Unload(), which makes the emitted assembly eligible
for GC at the next collection cycle.
- CompiledScriptCache.Clear() disposes every materialised evaluator before
dropping its dictionary entry; CompiledScriptCache itself is now
IDisposable for graceful server shutdown.
- ScriptSandbox.Build returns a new SandboxConfig (References + Imports)
instead of a Roslyn ScriptOptions; references now span BCL via the
TRUSTED_PLATFORM_ASSEMBLIES set filtered to System.* + netstandard +
Microsoft.Win32.Registry, so forbidden BCL types resolve at compile and
ForbiddenTypeAnalyzer is the sole security gate (consistent with the
Core.Scripting-001 / -002 model — references-list-only restriction is
porous against type forwarding, so the analyzer must be the real gate).
Verification:
- All 104 Core.Scripting tests pass (was 101 — three new regression tests
locking the unload contract).
- All 56 VirtualTags tests pass (unchanged).
- All 63 ScriptedAlarms tests pass (unchanged).
- New CompiledScriptCacheTests:
- Dispose_unloads_compiled_script_assembly_load_context — proves single-
evaluator ALC unload via WeakReference + bounded GC.Collect() loop.
- Clear_disposes_every_materialised_evaluator — proves publish-replace
releases every prior generation's ALC.
- GetOrCompile_after_Dispose_throws_ObjectDisposedException — locks the
post-dispose contract.
Docs:
- docs/VirtualTags.md "Compile cache" section rewritten: the accepted-
limitation note replaced with the unload contract + the new authoring
convention (explicit return).
- docs/ScriptedAlarms.md cross-reference updated to drop the obsolete
restart guidance.
- code-reviews/Core.Scripting/findings.md Core.Scripting-008 flipped
Won't Fix → Resolved with the implementation summary.
- code-reviews/README.md regenerated.
Pre-existing breakage note: Driver.Galaxy fails the solution-wide build on
master because its ProjectReference to the sibling mxaccessgw repo's
MxGateway.Client targets a path that the sibling repo no longer has after a
recent restructuring. This is unrelated to Core.Scripting-008 and was
verified to exist on master before this branch was cut.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Joseph Doherty
@@ -240,7 +240,7 @@ race ordering.
|
||||
| Severity | Low |
|
||||
| Category | Performance & resource management |
|
||||
| Location | `CompiledScriptCache.cs:34`, `ScriptEvaluator.cs:34` |
|
||||
| Status | Won't Fix |
|
||||
| Status | Resolved |
|
||||
|
||||
**Description:** `CompiledScriptCache` has no capacity bound (acknowledged in the class
|
||||
remarks) and no eviction. Each cached `ScriptEvaluator` holds a Roslyn `ScriptRunner<T>`
|
||||
@@ -257,7 +257,33 @@ compile scripts into a collectible `AssemblyLoadContext` so `Clear()` can unload
|
||||
generations. At minimum add a note to `docs/ScriptedAlarms.md` so operators with
|
||||
high-publish-frequency deployments are aware.
|
||||
|
||||
**Resolution:** Resolved 2026-05-23 — accepted as a documented known limitation rather than fixing in code (collectible `AssemblyLoadContext` for Roslyn-emitted assemblies is a v3 concern). The "Compile cache" section of `docs/VirtualTags.md` now carries a "Per-publish assembly accretion (accepted limitation, Core.Scripting-008)" note that operators with high-publish-frequency deployments can scan, and `docs/ScriptedAlarms.md` cross-references it. The accretion is benign at the expected "low thousands" of scripts scale; recommended mitigation is a scheduled server restart for deployments that publish very frequently.
|
||||
**Resolution:** Resolved 2026-05-23 — switched the compile pipeline off the legacy
|
||||
`CSharpScript.CreateDelegate` path (which emits into the default, non-collectible
|
||||
`AssemblyLoadContext`) and onto a hand-rolled `CSharpCompilation` →
|
||||
`Compilation.Emit(MemoryStream)` → `ScriptAssemblyLoadContext.LoadFromStream` chain,
|
||||
with the new `ScriptAssemblyLoadContext` constructed `isCollectible: true`. Each
|
||||
compiled script lives in its own ALC; `ScriptEvaluator` now implements `IDisposable`
|
||||
and calls `AssemblyLoadContext.Unload()` on dispose. `CompiledScriptCache.Clear()`
|
||||
disposes every materialised evaluator before dropping its dictionary entry, and
|
||||
`CompiledScriptCache` itself is now `IDisposable` for graceful server shutdown.
|
||||
After a publish-replace cycle the prior generation's emitted assemblies become
|
||||
eligible for GC; the reclaim is GC-timing-sensitive (Unload is
|
||||
*eligible-for-collection*, not synchronous) and the next collection cycle reclaims
|
||||
them. The references list is now BCL-wide (System.* + netstandard + Microsoft.Win32.Registry
|
||||
via the TRUSTED_PLATFORM_ASSEMBLIES set) so forbidden BCL types resolve at compile and
|
||||
`ForbiddenTypeAnalyzer` is the sole security gate (consistent with the
|
||||
Core.Scripting-001 / -002 model). `docs/VirtualTags.md` "Compile cache" section rewritten;
|
||||
`docs/ScriptedAlarms.md` cross-reference updated to drop the obsolete restart guidance.
|
||||
Regression tests added in `CompiledScriptCacheTests`:
|
||||
`Dispose_unloads_compiled_script_assembly_load_context`,
|
||||
`Clear_disposes_every_materialised_evaluator`, and
|
||||
`GetOrCompile_after_Dispose_throws_ObjectDisposedException`; the first two
|
||||
prove ALC unload via `WeakReference` + bounded `GC.Collect()` loops. Suite now 104
|
||||
green (was 101). Authoring convention: the synthesized wrapper is an ordinary
|
||||
C# static method, so scripts must end with explicit `return …;` per ordinary C# rules
|
||||
(the legacy `CSharpScript` "last expression yields result" shorthand no longer applies);
|
||||
every script in the existing corpus already uses explicit `return` so this is a doc-only
|
||||
change for new authors.
|
||||
|
||||
### Core.Scripting-009
|
||||
|
||||
|
||||
@@ -286,7 +286,7 @@ Findings with status `Resolved`, `Won't Fix`, or `Deferred`.
|
||||
| Core.ScriptedAlarms-011 | Low | Resolved | Code organization & conventions | `Part9StateMachine.cs:275` |
|
||||
| Core.Scripting-005 | Low | Resolved | Correctness & logic bugs | `DependencyExtractor.cs:97` |
|
||||
| Core.Scripting-006 | Low | Resolved | Concurrency & thread safety | `CompiledScriptCache.cs:55` |
|
||||
| Core.Scripting-008 | Low | Won't Fix | Performance & resource management | `CompiledScriptCache.cs:34`, `ScriptEvaluator.cs:34` |
|
||||
| Core.Scripting-008 | Low | Resolved | Performance & resource management | `CompiledScriptCache.cs:34`, `ScriptEvaluator.cs:34` |
|
||||
| Core.Scripting-009 | Low | Resolved | Design-document adherence | `ForbiddenTypeAnalyzer.cs:45` |
|
||||
| Core.Scripting-011 | Low | Resolved | Testing coverage | `tests/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Tests/` |
|
||||
| Core.VirtualTags-004 | Low | Resolved | Correctness & logic bugs | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagEngine.cs:349` |
|
||||
|
||||
@@ -35,7 +35,7 @@ new ScriptedAlarmDefinition(
|
||||
|
||||
## Predicate evaluation
|
||||
|
||||
Alarm predicates reuse the same Roslyn sandbox as virtual tags — `ScriptEvaluator<AlarmPredicateContext, bool>` compiles the source, `TimedScriptEvaluator` wraps it with the configured timeout (default from `TimedScriptEvaluator.DefaultTimeout`), and `DependencyExtractor` statically harvests the tag paths the script reads. The sandbox rules (forbidden types, cancellation, logging sinks) are documented in [VirtualTags.md](VirtualTags.md); ScriptedAlarms does not redefine them. The known resource limits — unbounded script-side memory, the per-publish accretion of dynamically-emitted script assemblies (Core.Scripting-008), and the orphan-thread CPU-budget caveat — are documented in that file as well.
|
||||
Alarm predicates reuse the same Roslyn sandbox as virtual tags — `ScriptEvaluator<AlarmPredicateContext, bool>` compiles the source, `TimedScriptEvaluator` wraps it with the configured timeout (default from `TimedScriptEvaluator.DefaultTimeout`), and `DependencyExtractor` statically harvests the tag paths the script reads. The sandbox rules (forbidden types, cancellation, logging sinks) are documented in [VirtualTags.md](VirtualTags.md); ScriptedAlarms does not redefine them. The known resource limits — unbounded script-side memory and the orphan-thread CPU-budget caveat — are documented in that file as well; per-publish assembly accretion was resolved by the Core.Scripting-008 collectible-`AssemblyLoadContext` rewrite and no longer requires periodic server restarts.
|
||||
|
||||
`AlarmPredicateContext` (`AlarmPredicateContext.cs`) is the script's `ScriptContext` subclass:
|
||||
|
||||
|
||||
@@ -30,7 +30,9 @@ Similarly, **`System.Threading.Tasks` is now denied** (Core.Scripting-003), whic
|
||||
|
||||
`ConcurrentDictionary<string, Lazy<ScriptEvaluator<...>>>` keyed on `SHA-256(UTF8(source))` rendered to hex. `Lazy<T>` with `ExecutionAndPublication` mode means two threads racing a miss compile exactly once. Failed compiles evict the entry (via the `TryRemove(KeyValuePair<,>)` overload so a concurrently re-added retry entry is not collateral damage — Core.Scripting-006) so a corrected retry can succeed (used during Admin UI authoring). No capacity bound — scripts are operator-authored and bounded by the config DB. Whitespace changes miss the cache on purpose. `Clear()` is called on config-publish.
|
||||
|
||||
**Per-publish assembly accretion (accepted limitation, Core.Scripting-008).** Each compiled `ScriptEvaluator` holds a Roslyn `ScriptRunner<T>` delegate, which keeps the dynamically-emitted script assembly loaded for the process lifetime. Emitted assemblies in the default `AssemblyLoadContext` cannot be unloaded; `CompiledScriptCache.Clear()` drops the dictionary entries but does **not** unload the underlying assemblies. Across many config-publish generations (each `Clear()` followed by recompiling every script), the process accumulates dead script assemblies. For the expected "low thousands" of scripts this is benign, but a long-running server with very frequent publishes will see steady managed-memory growth that does not return until the process restarts. Out-of-process script evaluation or a collectible `AssemblyLoadContext` is a v3 concern; deployments with high-publish-frequency requirements should schedule a periodic server restart to reclaim the accrued assemblies.
|
||||
**Per-publish assembly unload (Core.Scripting-008 resolved).** Each compiled `ScriptEvaluator` emits its script into a dedicated **collectible** `AssemblyLoadContext` — the BCL escape hatch for assemblies that can be unloaded. The compile path is hand-rolled `CSharpCompilation.Create` + `Emit(MemoryStream)` + `ScriptAssemblyLoadContext.LoadFromStream` rather than the legacy `CSharpScript.CreateDelegate` (which emits into the default ALC and cannot be unloaded). `ScriptEvaluator.Dispose()` calls `AssemblyLoadContext.Unload()` and `CompiledScriptCache.Clear()` disposes every materialised evaluator before dropping its dictionary entry, so the emitted assemblies become eligible for GC immediately after a config-publish. The reclaim is GC-timing-sensitive (Unload is *eligible-for-collection*, not synchronous); the next collection cycle reclaims them. Regression tests `Dispose_unloads_compiled_script_assembly_load_context` and `Clear_disposes_every_materialised_evaluator` in `CompiledScriptCacheTests` lock this contract via `WeakReference` + `GC.Collect()` assertions. Server restarts are no longer required to reclaim compiled-script memory.
|
||||
|
||||
**Scripting authoring convention.** With the collectible-ALC rewrite, the wrapper around a user script is an ordinary C# static method, not a Roslyn `Script` submission. The script body is pasted verbatim as the method body and must therefore end with an explicit `return …;` per ordinary C# rules — the legacy `CSharpScript` "last expression yields result" shorthand is gone. Every script in the existing test corpus already uses explicit `return`; this convention is operator-visible only when authoring a brand-new script from scratch.
|
||||
|
||||
### Per-evaluation timeout (`TimedScriptEvaluator<TContext, TResult>`)
|
||||
|
||||
|
||||
@@ -30,11 +30,20 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Scripting;
|
||||
/// bounded by config DB (typically low thousands). If that changes in v3, add an
|
||||
/// LRU eviction policy — the API stays the same.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>Lifecycle:</b> compiled scripts hold a collectible
|
||||
/// <see cref="System.Runtime.Loader.AssemblyLoadContext"/> per evaluator
|
||||
/// (Core.Scripting-008 fix). <see cref="Clear"/> disposes every materialised
|
||||
/// evaluator before dropping its dictionary entry so the emitted assemblies are
|
||||
/// eligible for GC immediately after a publish. <see cref="Dispose"/> drops the
|
||||
/// cache itself for graceful server shutdown.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public sealed class CompiledScriptCache<TContext, TResult>
|
||||
public sealed class CompiledScriptCache<TContext, TResult> : IDisposable
|
||||
where TContext : ScriptContext
|
||||
{
|
||||
private readonly ConcurrentDictionary<string, Lazy<ScriptEvaluator<TContext, TResult>>> _cache = new();
|
||||
private bool _disposed;
|
||||
|
||||
/// <summary>
|
||||
/// Return the compiled evaluator for <paramref name="scriptSource"/>, compiling
|
||||
@@ -46,6 +55,7 @@ public sealed class CompiledScriptCache<TContext, TResult>
|
||||
public ScriptEvaluator<TContext, TResult> GetOrCompile(string scriptSource)
|
||||
{
|
||||
if (scriptSource is null) throw new ArgumentNullException(nameof(scriptSource));
|
||||
if (_disposed) throw new ObjectDisposedException(nameof(CompiledScriptCache<TContext, TResult>));
|
||||
|
||||
var key = HashSource(scriptSource);
|
||||
var lazy = _cache.GetOrAdd(key, _ => new Lazy<ScriptEvaluator<TContext, TResult>>(
|
||||
@@ -72,13 +82,58 @@ public sealed class CompiledScriptCache<TContext, TResult>
|
||||
/// <summary>Current entry count. Exposed for Admin UI diagnostics / tests.</summary>
|
||||
public int Count => _cache.Count;
|
||||
|
||||
/// <summary>Drop every cached compile. Used on config generation publish + tests.</summary>
|
||||
public void Clear() => _cache.Clear();
|
||||
/// <summary>
|
||||
/// Drop every cached compile. Used on config generation publish + tests.
|
||||
/// Disposes each materialised evaluator before removing it so its collectible
|
||||
/// <see cref="System.Runtime.Loader.AssemblyLoadContext"/> unloads and the
|
||||
/// emitted script assembly becomes eligible for GC (Core.Scripting-008).
|
||||
/// </summary>
|
||||
public void Clear()
|
||||
{
|
||||
if (_disposed) return;
|
||||
// Snapshot the entries, swap them out, then dispose. We use TryRemove rather
|
||||
// than _cache.Clear() so a concurrent GetOrCompile re-add after our snapshot
|
||||
// is not silently lost — a new compile starts a fresh cache entry, the old
|
||||
// evaluator is still disposed.
|
||||
foreach (var key in _cache.Keys.ToArray())
|
||||
{
|
||||
if (_cache.TryRemove(key, out var lazy))
|
||||
DisposeLazyIfMaterialised(lazy);
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>True when the exact source has been compiled at least once + is still cached.</summary>
|
||||
public bool Contains(string scriptSource)
|
||||
=> _cache.ContainsKey(HashSource(scriptSource));
|
||||
|
||||
/// <summary>
|
||||
/// Drop the cache and dispose every materialised evaluator. After disposal
|
||||
/// <see cref="GetOrCompile"/> throws <see cref="ObjectDisposedException"/>.
|
||||
/// </summary>
|
||||
public void Dispose()
|
||||
{
|
||||
if (_disposed) return;
|
||||
_disposed = true;
|
||||
Clear();
|
||||
}
|
||||
|
||||
private static void DisposeLazyIfMaterialised(Lazy<ScriptEvaluator<TContext, TResult>> lazy)
|
||||
{
|
||||
// IsValueCreated is false for a faulted Lazy too, so the catch in GetOrCompile
|
||||
// has already taken care of failed compiles — there's no evaluator to dispose.
|
||||
if (!lazy.IsValueCreated) return;
|
||||
try
|
||||
{
|
||||
lazy.Value.Dispose();
|
||||
}
|
||||
catch
|
||||
{
|
||||
// Dispose is best-effort here: an evaluator disposal failure would leak its
|
||||
// ALC but mustn't prevent the rest of the cache from clearing. The ALC
|
||||
// unload itself is exception-free in practice; this is defensive.
|
||||
}
|
||||
}
|
||||
|
||||
private static string HashSource(string source)
|
||||
{
|
||||
var bytes = Encoding.UTF8.GetBytes(source);
|
||||
|
||||
@@ -1,75 +1,315 @@
|
||||
using Microsoft.CodeAnalysis.CSharp.Scripting;
|
||||
using Microsoft.CodeAnalysis.Scripting;
|
||||
using System.Reflection;
|
||||
using System.Runtime.Loader;
|
||||
using System.Text;
|
||||
using Microsoft.CodeAnalysis;
|
||||
using Microsoft.CodeAnalysis.CSharp;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.Core.Scripting;
|
||||
|
||||
/// <summary>
|
||||
/// Compiles + runs user scripts against a <see cref="ScriptContext"/> subclass. Core
|
||||
/// evaluator — no caching, no timeout, no logging side-effects yet (those land in
|
||||
/// Stream A.3, A.4, A.5 respectively). Stream B + C wrap this with the dependency
|
||||
/// scheduler + alarm state machine.
|
||||
/// evaluator — no caching, no timeout, no logging side-effects (those land in
|
||||
/// <see cref="CompiledScriptCache{TContext, TResult}"/>,
|
||||
/// <see cref="TimedScriptEvaluator{TContext, TResult}"/>, and
|
||||
/// <see cref="ScriptLogCompanionSink"/> respectively).
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// Scripts are compiled against <see cref="ScriptGlobals{TContext}"/> so the
|
||||
/// context member is named <c>ctx</c> in the script, matching the
|
||||
/// <see cref="DependencyExtractor"/>'s walker and the Admin UI type stub.
|
||||
/// Scripts are wrapped in a synthesized <c>CompiledScript.Run(globals)</c> method
|
||||
/// and compiled via <see cref="CSharpCompilation"/> into a regular .NET assembly
|
||||
/// that is loaded into a <b>collectible</b>
|
||||
/// <see cref="AssemblyLoadContext"/>. The collectible ALC is the fix for
|
||||
/// Core.Scripting-008: per-publish recompile accretion was previously unbounded
|
||||
/// because Roslyn's <c>CSharpScript.CreateDelegate</c> emits into the default ALC
|
||||
/// (non-collectible); now <see cref="Dispose"/> unloads the entire ALC and the
|
||||
/// emitted assembly becomes eligible for GC.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Compile pipeline is a three-step gate: (1) Roslyn compile — catches syntax
|
||||
/// errors + type-resolution failures, throws <see cref="CompilationErrorException"/>;
|
||||
/// (2) <see cref="ForbiddenTypeAnalyzer"/> runs against the semantic model —
|
||||
/// catches sandbox escapes that slipped past reference restrictions due to .NET's
|
||||
/// type forwarding, throws <see cref="ScriptSandboxViolationException"/>; (3)
|
||||
/// delegate creation — throws at this layer only for internal Roslyn bugs, not
|
||||
/// user error.
|
||||
/// Compile pipeline is a three-step gate, unchanged in intent from the legacy
|
||||
/// <c>CSharpScript</c> path: (1) Roslyn parse + compile against the
|
||||
/// <see cref="ScriptSandbox"/> allow-list — catches syntax errors, unresolved
|
||||
/// types (the sandbox's first line of defense), and most type-resolution
|
||||
/// failures, throwing <see cref="CompilationErrorException"/>; (2)
|
||||
/// <see cref="ForbiddenTypeAnalyzer"/> runs against the semantic model — catches
|
||||
/// sandbox escapes that slipped past reference restrictions due to .NET's type
|
||||
/// forwarding, throwing <see cref="ScriptSandboxViolationException"/>; (3) emit
|
||||
/// to an in-memory PE stream + load into the collectible ALC — throws at this
|
||||
/// layer only for internal Roslyn bugs, not user error.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Runtime exceptions thrown from user code propagate unwrapped. The virtual-tag
|
||||
/// engine (Stream B) catches them per-tag + maps to <c>BadInternalError</c>
|
||||
/// quality per Phase 7 decision #11 — this layer doesn't swallow anything so
|
||||
/// tests can assert on the original exception type.
|
||||
/// engine catches them per-tag and maps to <c>BadInternalError</c> quality
|
||||
/// per Phase 7 decision #11; this layer doesn't swallow anything so tests can
|
||||
/// assert on the original exception type.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Scripts are expected to be statement bodies that end with an explicit
|
||||
/// <c>return …;</c> — the wrapper provides only the surrounding method body, so
|
||||
/// the script's final-expression-yields-result behavior of legacy
|
||||
/// <c>CSharpScript</c> is replaced by ordinary C# method semantics. Every script
|
||||
/// in the existing test corpus already uses explicit <c>return</c>; this is a
|
||||
/// documented authoring convention.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public sealed class ScriptEvaluator<TContext, TResult>
|
||||
public sealed class ScriptEvaluator<TContext, TResult> : IDisposable
|
||||
where TContext : ScriptContext
|
||||
{
|
||||
private readonly ScriptRunner<TResult> _runner;
|
||||
private readonly ScriptAssemblyLoadContext _alc;
|
||||
private readonly Func<ScriptGlobals<TContext>, TResult> _func;
|
||||
private bool _disposed;
|
||||
|
||||
private ScriptEvaluator(ScriptRunner<TResult> runner)
|
||||
private ScriptEvaluator(ScriptAssemblyLoadContext alc, Func<ScriptGlobals<TContext>, TResult> func)
|
||||
{
|
||||
_runner = runner;
|
||||
_alc = alc;
|
||||
_func = func;
|
||||
}
|
||||
|
||||
public static ScriptEvaluator<TContext, TResult> Compile(string scriptSource)
|
||||
{
|
||||
if (scriptSource is null) throw new ArgumentNullException(nameof(scriptSource));
|
||||
|
||||
var options = ScriptSandbox.Build(typeof(TContext));
|
||||
var script = CSharpScript.Create<TResult>(
|
||||
code: scriptSource,
|
||||
options: options,
|
||||
globalsType: typeof(ScriptGlobals<TContext>));
|
||||
var sandbox = ScriptSandbox.Build(typeof(TContext));
|
||||
|
||||
// Step 1 — Roslyn compile. Throws CompilationErrorException on syntax / type errors.
|
||||
var diagnostics = script.Compile();
|
||||
// Step 1 — synthesize a wrapper class around the script body and parse it. The
|
||||
// wrapper's `Run` method is what we invoke at runtime; the user's source is
|
||||
// pasted in as its body so explicit `return` semantics apply.
|
||||
var wrapperSource = BuildWrapperSource(scriptSource, sandbox.Imports);
|
||||
var syntaxTree = CSharpSyntaxTree.ParseText(wrapperSource);
|
||||
|
||||
// Step 2 — forbidden-type semantic analysis. Defense-in-depth against reference-list
|
||||
// leaks due to type forwarding.
|
||||
var rejections = ForbiddenTypeAnalyzer.Analyze(script.GetCompilation());
|
||||
// Step 2 — Roslyn compile against the sandbox allow-list. Anything not in the
|
||||
// references set is unresolved and produces a compiler error.
|
||||
var assemblyName = "ZB.MOM.WW.OtOpcUa.Core.Scripting.Compiled." +
|
||||
Guid.NewGuid().ToString("N");
|
||||
var compileOptions = new CSharpCompilationOptions(
|
||||
OutputKind.DynamicallyLinkedLibrary,
|
||||
optimizationLevel: OptimizationLevel.Release,
|
||||
allowUnsafe: false,
|
||||
// Don't generate XML doc warnings for the synthesized wrapper.
|
||||
warningLevel: 4,
|
||||
nullableContextOptions: NullableContextOptions.Enable);
|
||||
var compilation = CSharpCompilation.Create(
|
||||
assemblyName,
|
||||
syntaxTrees: new[] { syntaxTree },
|
||||
references: sandbox.References,
|
||||
options: compileOptions);
|
||||
|
||||
var compileDiagnostics = compilation.GetDiagnostics();
|
||||
var compileErrors = compileDiagnostics
|
||||
.Where(d => d.Severity == DiagnosticSeverity.Error)
|
||||
.ToArray();
|
||||
if (compileErrors.Length > 0)
|
||||
throw new CompilationErrorException(compileErrors);
|
||||
|
||||
// Step 3 — forbidden-type semantic analysis. Defense-in-depth against
|
||||
// reference-list leaks due to type forwarding.
|
||||
var rejections = ForbiddenTypeAnalyzer.Analyze(compilation);
|
||||
if (rejections.Count > 0)
|
||||
throw new ScriptSandboxViolationException(rejections);
|
||||
|
||||
// Step 3 — materialize the callable delegate.
|
||||
var runner = script.CreateDelegate();
|
||||
return new ScriptEvaluator<TContext, TResult>(runner);
|
||||
// Step 4 — emit to an in-memory PE stream and load into a collectible ALC.
|
||||
using var peStream = new MemoryStream();
|
||||
var emitResult = compilation.Emit(peStream);
|
||||
if (!emitResult.Success)
|
||||
{
|
||||
var emitErrors = emitResult.Diagnostics
|
||||
.Where(d => d.Severity == DiagnosticSeverity.Error)
|
||||
.ToArray();
|
||||
throw new CompilationErrorException(emitErrors);
|
||||
}
|
||||
|
||||
peStream.Position = 0;
|
||||
var alc = new ScriptAssemblyLoadContext(assemblyName);
|
||||
Assembly assembly;
|
||||
try
|
||||
{
|
||||
assembly = alc.LoadFromStream(peStream);
|
||||
}
|
||||
catch
|
||||
{
|
||||
// Failed to load — drop the ALC so we don't leak a half-initialised one.
|
||||
alc.Unload();
|
||||
throw;
|
||||
}
|
||||
|
||||
// Step 5 — resolve the wrapper's Run method and bind a typed delegate. The
|
||||
// wrapper source above puts the type in this exact namespace + class — keep the
|
||||
// names in sync with BuildWrapperSource.
|
||||
Func<ScriptGlobals<TContext>, TResult> func;
|
||||
try
|
||||
{
|
||||
var wrapperType = assembly.GetType(
|
||||
"ZB.MOM.WW.OtOpcUa.Core.Scripting.Compiled.CompiledScript",
|
||||
throwOnError: true)!;
|
||||
var runMethod = wrapperType.GetMethod(
|
||||
"Run",
|
||||
BindingFlags.Public | BindingFlags.Static)
|
||||
?? throw new InvalidOperationException(
|
||||
"Synthesized wrapper is missing the public static Run method.");
|
||||
func = (Func<ScriptGlobals<TContext>, TResult>)Delegate.CreateDelegate(
|
||||
typeof(Func<ScriptGlobals<TContext>, TResult>), runMethod);
|
||||
}
|
||||
catch
|
||||
{
|
||||
alc.Unload();
|
||||
throw;
|
||||
}
|
||||
|
||||
return new ScriptEvaluator<TContext, TResult>(alc, func);
|
||||
}
|
||||
|
||||
/// <summary>Run against an already-constructed context.</summary>
|
||||
public Task<TResult> RunAsync(TContext context, CancellationToken ct = default)
|
||||
{
|
||||
if (_disposed) throw new ObjectDisposedException(nameof(ScriptEvaluator<TContext, TResult>));
|
||||
if (context is null) throw new ArgumentNullException(nameof(context));
|
||||
ct.ThrowIfCancellationRequested();
|
||||
var globals = new ScriptGlobals<TContext> { ctx = context };
|
||||
return _runner(globals, ct);
|
||||
// The user's script is synchronous (Roslyn emits a static method that returns
|
||||
// TResult directly). We surface a Task<TResult> only to keep the existing
|
||||
// RunAsync contract consumers depend on. TimedScriptEvaluator wraps this in
|
||||
// Task.Run so a long-running script still honours its wall-clock budget.
|
||||
var result = _func(globals);
|
||||
return Task.FromResult(result);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Unload the collectible <see cref="AssemblyLoadContext"/> that holds the emitted
|
||||
/// script assembly so the runtime can reclaim it. After disposal the evaluator can
|
||||
/// no longer be invoked — call <see cref="ScriptEvaluator{TContext, TResult}.Compile"/>
|
||||
/// again for a fresh one. Dispose is idempotent.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Unload is <i>eligible-for-collection</i>, not synchronous: the assembly is
|
||||
/// reclaimed when the GC determines no live references remain. The cache disposes
|
||||
/// evaluators in <see cref="CompiledScriptCache{TContext, TResult}.Clear"/> so a
|
||||
/// config-generation publish releases the prior generation in one sweep; the
|
||||
/// reclaim then races with the next GC cycle. Tests verify the reclaim via
|
||||
/// <see cref="WeakReference"/> + <see cref="GC.Collect()"/>.
|
||||
/// </remarks>
|
||||
public void Dispose()
|
||||
{
|
||||
if (_disposed) return;
|
||||
_disposed = true;
|
||||
_alc.Unload();
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Synthesize the source we hand to Roslyn. The user's script body is pasted
|
||||
/// verbatim inside <c>CompiledScript.Run</c>; the <c>using</c> directives mirror
|
||||
/// <see cref="ScriptSandbox"/>'s imports so scripts can write <c>Math.Abs</c>
|
||||
/// instead of <c>System.Math.Abs</c>.
|
||||
/// </summary>
|
||||
private static string BuildWrapperSource(string userSource, IReadOnlyList<string> imports)
|
||||
{
|
||||
var sb = new StringBuilder();
|
||||
foreach (var import in imports)
|
||||
sb.Append("using ").Append(import).AppendLine(";");
|
||||
sb.AppendLine();
|
||||
sb.AppendLine("namespace ZB.MOM.WW.OtOpcUa.Core.Scripting.Compiled;");
|
||||
sb.AppendLine();
|
||||
sb.AppendLine("public static class CompiledScript");
|
||||
sb.AppendLine("{");
|
||||
sb.Append(" public static ").Append(ToCSharpTypeName(typeof(TResult)))
|
||||
.Append(" Run(").Append(ToCSharpTypeName(typeof(ScriptGlobals<TContext>)))
|
||||
.AppendLine(" globals)");
|
||||
sb.AppendLine(" {");
|
||||
sb.AppendLine(" var ctx = globals.ctx;");
|
||||
// User source ends with `return X;` per the authoring convention; we paste it
|
||||
// verbatim. The leading newline keeps Roslyn diagnostics' line numbers usable
|
||||
// by operators (errors point at the user's source line, not the wrapper).
|
||||
sb.AppendLine("#line 1");
|
||||
sb.AppendLine(userSource);
|
||||
sb.AppendLine(" }");
|
||||
sb.AppendLine("}");
|
||||
return sb.ToString();
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Convert a runtime <see cref="Type"/> to a C# type-name string suitable for
|
||||
/// emitting into Roslyn source. Uses <c>global::</c>-qualified FQNs to avoid
|
||||
/// accidental capture by the wrapper's <c>using</c> directives, handles nested
|
||||
/// types (<c>+</c> → <c>.</c>), and recurses for generic arguments so the
|
||||
/// <c>ScriptGlobals<TContext></c> parameter is emitted correctly.
|
||||
/// </summary>
|
||||
private static string ToCSharpTypeName(Type t)
|
||||
{
|
||||
if (t == typeof(void)) return "void";
|
||||
// Primitive aliases keep the synthesized source readable when diagnostic
|
||||
// logging dumps it; functionally identical to the FQN form.
|
||||
if (t == typeof(bool)) return "bool";
|
||||
if (t == typeof(byte)) return "byte";
|
||||
if (t == typeof(sbyte)) return "sbyte";
|
||||
if (t == typeof(short)) return "short";
|
||||
if (t == typeof(ushort)) return "ushort";
|
||||
if (t == typeof(int)) return "int";
|
||||
if (t == typeof(uint)) return "uint";
|
||||
if (t == typeof(long)) return "long";
|
||||
if (t == typeof(ulong)) return "ulong";
|
||||
if (t == typeof(float)) return "float";
|
||||
if (t == typeof(double)) return "double";
|
||||
if (t == typeof(decimal)) return "decimal";
|
||||
if (t == typeof(string)) return "string";
|
||||
if (t == typeof(object)) return "object";
|
||||
|
||||
if (Nullable.GetUnderlyingType(t) is { } inner)
|
||||
return ToCSharpTypeName(inner) + "?";
|
||||
|
||||
if (t.IsArray)
|
||||
return ToCSharpTypeName(t.GetElementType()!) + "[]";
|
||||
|
||||
if (t.IsGenericType)
|
||||
{
|
||||
var def = t.GetGenericTypeDefinition();
|
||||
var rawName = def.FullName!.Replace('+', '.');
|
||||
var nameNoArity = rawName.Substring(0, rawName.IndexOf('`'));
|
||||
var args = string.Join(", ", t.GetGenericArguments().Select(ToCSharpTypeName));
|
||||
return "global::" + nameNoArity + "<" + args + ">";
|
||||
}
|
||||
|
||||
return "global::" + t.FullName!.Replace('+', '.');
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Collectible <see cref="AssemblyLoadContext"/> that hosts a single emitted script
|
||||
/// assembly. Created per <see cref="ScriptEvaluator{TContext, TResult}"/> instance so
|
||||
/// <see cref="AssemblyLoadContext.Unload"/> releases exactly that script. Resolves
|
||||
/// dependencies via the default ALC — script assemblies reference the BCL + the
|
||||
/// application's own types, all of which live in the default context.
|
||||
/// </summary>
|
||||
internal sealed class ScriptAssemblyLoadContext : AssemblyLoadContext
|
||||
{
|
||||
public ScriptAssemblyLoadContext(string name) : base(name, isCollectible: true)
|
||||
{
|
||||
}
|
||||
|
||||
protected override Assembly? Load(AssemblyName assemblyName) => null;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Thrown by <see cref="ScriptEvaluator{TContext, TResult}.Compile"/> when Roslyn
|
||||
/// reports compile-time errors against the wrapper source. Mirrors the
|
||||
/// <c>Microsoft.CodeAnalysis.Scripting.CompilationErrorException</c> from the legacy
|
||||
/// <c>CSharpScript</c> path so callers (engines + the Admin test-harness) keep the
|
||||
/// same catch site after the Core.Scripting-008 rewrite.
|
||||
/// </summary>
|
||||
public sealed class CompilationErrorException : Exception
|
||||
{
|
||||
public IReadOnlyList<Diagnostic> Diagnostics { get; }
|
||||
|
||||
public CompilationErrorException(IReadOnlyList<Diagnostic> diagnostics)
|
||||
: base(BuildMessage(diagnostics))
|
||||
{
|
||||
Diagnostics = diagnostics;
|
||||
}
|
||||
|
||||
private static string BuildMessage(IReadOnlyList<Diagnostic> diagnostics)
|
||||
{
|
||||
if (diagnostics.Count == 0) return "Script compile failed.";
|
||||
// Operators see this — match the legacy Roslyn format ("(line,col): error CSxxxx:
|
||||
// message") so existing operator runbooks still match.
|
||||
var first = diagnostics[0];
|
||||
var rest = diagnostics.Count == 1 ? "" : $" (and {diagnostics.Count - 1} more)";
|
||||
return first.ToString() + rest;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,11 +1,10 @@
|
||||
using Microsoft.CodeAnalysis.CSharp.Scripting;
|
||||
using Microsoft.CodeAnalysis.Scripting;
|
||||
using Microsoft.CodeAnalysis;
|
||||
using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.Core.Scripting;
|
||||
|
||||
/// <summary>
|
||||
/// Factory for the <see cref="ScriptOptions"/> every user script is compiled against.
|
||||
/// Factory for the compile-time sandbox every user script is built against.
|
||||
/// Implements Phase 7 plan decision #6 (read-only sandbox) by whitelisting only the
|
||||
/// assemblies + namespaces the script API needs; no <c>System.IO</c>, no
|
||||
/// <c>System.Net</c>, no <c>System.Diagnostics.Process</c>, no
|
||||
@@ -15,9 +14,12 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Scripting;
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// Roslyn's default <see cref="ScriptOptions"/> references <c>mscorlib</c> /
|
||||
/// <c>System.Runtime</c> transitively which pulls in every type in the BCL — this
|
||||
/// class overrides that with an explicit minimal allow-list.
|
||||
/// Roslyn would otherwise pull in every type in the BCL transitively via
|
||||
/// <c>mscorlib</c> / <c>System.Runtime</c> — this class overrides that with an
|
||||
/// explicit minimal allow-list. The list is the same regardless of whether
|
||||
/// <see cref="ScriptEvaluator{TContext, TResult}"/> uses the legacy
|
||||
/// <c>CSharpScript</c> path or the collectible-<c>AssemblyLoadContext</c> path
|
||||
/// (Core.Scripting-008): both go through <see cref="Build"/>.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Namespaces pre-imported so scripts don't have to write <c>using</c> clauses:
|
||||
@@ -35,29 +37,21 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Scripting;
|
||||
public static class ScriptSandbox
|
||||
{
|
||||
/// <summary>
|
||||
/// Build the <see cref="ScriptOptions"/> used for every virtual-tag / alarm
|
||||
/// script. <paramref name="contextType"/> is the concrete
|
||||
/// <see cref="ScriptContext"/> subclass the globals will be of — the compiler
|
||||
/// uses its type to resolve <c>ctx.GetTag(...)</c> calls.
|
||||
/// Build the sandbox configuration used for every virtual-tag / alarm script.
|
||||
/// <paramref name="contextType"/> is the concrete <see cref="ScriptContext"/>
|
||||
/// subclass the script's <c>ctx</c> will be of — the compiler uses its assembly
|
||||
/// to resolve <c>ctx.GetTag(...)</c> calls.
|
||||
/// </summary>
|
||||
public static ScriptOptions Build(Type contextType)
|
||||
public static SandboxConfig Build(Type contextType)
|
||||
{
|
||||
if (contextType is null) throw new ArgumentNullException(nameof(contextType));
|
||||
if (!typeof(ScriptContext).IsAssignableFrom(contextType))
|
||||
throw new ArgumentException(
|
||||
$"Script context type must derive from {nameof(ScriptContext)}", nameof(contextType));
|
||||
|
||||
// Allow-listed assemblies — each explicitly chosen. Adding here is a
|
||||
// plan-level decision; do not expand casually. HashSet so adding the
|
||||
// contextType's assembly is idempotent when it happens to be Core.Scripting
|
||||
// already.
|
||||
var allowedAssemblies = new HashSet<System.Reflection.Assembly>
|
||||
// OtOpcUa-owned assemblies — pinned by typeof(...) so they survive a rename.
|
||||
var pinnedAssemblies = new HashSet<System.Reflection.Assembly>
|
||||
{
|
||||
// System.Private.CoreLib — primitives (int, double, bool, string, DateTime,
|
||||
// TimeSpan, Math, Convert, nullable<T>). Can't practically script without it.
|
||||
typeof(object).Assembly,
|
||||
// System.Linq — IEnumerable extensions (Where / Select / Sum / Average / etc.).
|
||||
typeof(System.Linq.Enumerable).Assembly,
|
||||
// Core.Abstractions — DataValueSnapshot + DriverDataType so scripts can name
|
||||
// the types they receive from ctx.GetTag.
|
||||
typeof(DataValueSnapshot).Assembly,
|
||||
@@ -72,7 +66,23 @@ public static class ScriptSandbox
|
||||
contextType.Assembly,
|
||||
};
|
||||
|
||||
var allowedImports = new[]
|
||||
// BCL references. We list the trusted-platform-assemblies set restricted to
|
||||
// System.* and netstandard so the synthesized wrapper can reference every BCL
|
||||
// type by FQN — including the ones we forbid (HttpClient, File, Process,
|
||||
// Registry, etc.). Letting those types resolve at compile is intentional: the
|
||||
// hard security gate is ForbiddenTypeAnalyzer in step 3 of the compile pipeline
|
||||
// (Core.Scripting-001 / -002 established the analyzer must be the sole gate
|
||||
// because type forwarding makes any references-list-only restriction porous).
|
||||
// The references list now serves only as scoping hygiene — out-of-band BCL
|
||||
// surface (operator-authored hosting helpers, third-party packages, app code)
|
||||
// is not on the list and stays unreachable.
|
||||
var references = new List<MetadataReference>();
|
||||
foreach (var asm in pinnedAssemblies)
|
||||
references.Add(MetadataReference.CreateFromFile(asm.Location));
|
||||
foreach (var path in EnumerateBclAssemblyPaths())
|
||||
references.Add(MetadataReference.CreateFromFile(path));
|
||||
|
||||
var imports = new[]
|
||||
{
|
||||
"System",
|
||||
"System.Linq",
|
||||
@@ -80,8 +90,56 @@ public static class ScriptSandbox
|
||||
"ZB.MOM.WW.OtOpcUa.Core.Scripting",
|
||||
};
|
||||
|
||||
return ScriptOptions.Default
|
||||
.WithReferences(allowedAssemblies)
|
||||
.WithImports(allowedImports);
|
||||
return new SandboxConfig(references, imports);
|
||||
}
|
||||
|
||||
private static IEnumerable<string> EnumerateBclAssemblyPaths()
|
||||
{
|
||||
// The .NET host advertises the resolved runtime-shared-framework + BCL DLL set
|
||||
// via the TRUSTED_PLATFORM_ASSEMBLIES AppContext data slot. This is what the
|
||||
// ALC fallback uses when resolving assemblies, so anything in here is already
|
||||
// loadable by the host process. We restrict to System.* and netstandard to keep
|
||||
// the script's reachable surface to the BCL — anything else (Microsoft.*,
|
||||
// application code, third-party packages happening to be in the runtime store)
|
||||
// would expand the analyzer's deny-list job unnecessarily.
|
||||
var raw = (string?)AppContext.GetData("TRUSTED_PLATFORM_ASSEMBLIES");
|
||||
if (string.IsNullOrEmpty(raw))
|
||||
yield break;
|
||||
|
||||
var separator = OperatingSystem.IsWindows() ? ';' : ':';
|
||||
foreach (var path in raw.Split(separator, StringSplitOptions.RemoveEmptyEntries))
|
||||
{
|
||||
var name = System.IO.Path.GetFileName(path);
|
||||
if (name.StartsWith("System.", StringComparison.Ordinal) ||
|
||||
string.Equals(name, "netstandard.dll", StringComparison.Ordinal) ||
|
||||
string.Equals(name, "mscorlib.dll", StringComparison.Ordinal) ||
|
||||
// Microsoft.Win32.Registry isn't a System.* DLL but the analyzer's
|
||||
// Microsoft.Win32 deny-list relies on the type being resolvable so it
|
||||
// can identify + reject it (Core.Scripting-001 / -002). Add the one
|
||||
// DLL we need rather than broadening to Microsoft.* (which would also
|
||||
// pull in compilers, build tooling, etc.).
|
||||
string.Equals(name, "Microsoft.Win32.Registry.dll", StringComparison.Ordinal))
|
||||
{
|
||||
yield return path;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Compile-time sandbox configuration. Returned by <see cref="ScriptSandbox.Build"/>;
|
||||
/// consumed by <see cref="ScriptEvaluator{TContext, TResult}"/>'s manual
|
||||
/// <c>CSharpCompilation</c> path.
|
||||
/// </summary>
|
||||
/// <param name="References">
|
||||
/// Metadata references (allow-listed assemblies) the script compilation is built
|
||||
/// against. Anything not in this set is unresolved at compile, which is the sandbox's
|
||||
/// first line of defense — <see cref="ForbiddenTypeAnalyzer"/> is the second.
|
||||
/// </param>
|
||||
/// <param name="Imports">
|
||||
/// Namespaces pre-imported into the wrapper compilation as <c>using</c> directives
|
||||
/// so scripts can write <c>Math.Abs</c> rather than <c>System.Math.Abs</c>.
|
||||
/// </param>
|
||||
public sealed record SandboxConfig(
|
||||
IReadOnlyList<MetadataReference> References,
|
||||
IReadOnlyList<string> Imports);
|
||||
|
||||
@@ -221,4 +221,107 @@ public sealed class CompiledScriptCacheTests
|
||||
Should.Throw<Exception>(() => cache.GetOrCompile("""return unknownIdentifier + 1;"""));
|
||||
cache.Count.ShouldBe(0, "faulted Lazy must still be evicted after compile failure");
|
||||
}
|
||||
|
||||
// --- Core.Scripting-008: collectible AssemblyLoadContext unload ---
|
||||
|
||||
[Fact]
|
||||
public void Dispose_unloads_compiled_script_assembly_load_context()
|
||||
{
|
||||
// The whole point of switching the emit path off CSharpScript.CreateDelegate
|
||||
// and onto a collectible ALC: after Dispose, the runtime can reclaim the
|
||||
// emitted assembly. We assert this via a WeakReference to the compiled
|
||||
// assembly itself — if the ALC unloads correctly the reference is dead after
|
||||
// a forced GC; if the assembly stayed rooted (the pre-fix behaviour) the
|
||||
// reference survives. The exact reclaim is GC-timing-sensitive, so we loop a
|
||||
// bounded number of times to absorb GC scheduling noise.
|
||||
var weak = CompileAndCaptureWeakAssembly();
|
||||
// Help the runtime — ALC.Unload is *eligible-for-collection*, not synchronous.
|
||||
for (int i = 0; i < 10 && weak.IsAlive; i++)
|
||||
{
|
||||
GC.Collect();
|
||||
GC.WaitForPendingFinalizers();
|
||||
GC.Collect();
|
||||
}
|
||||
weak.IsAlive.ShouldBeFalse(
|
||||
"the collectible ALC must release the emitted script assembly after Dispose " +
|
||||
"(Core.Scripting-008). If this fails, either the cache held a reference past " +
|
||||
"Dispose, or a delegate/closure rooted the assembly in the default ALC.");
|
||||
}
|
||||
|
||||
[System.Runtime.CompilerServices.MethodImpl(
|
||||
System.Runtime.CompilerServices.MethodImplOptions.NoInlining)]
|
||||
private static WeakReference CompileAndCaptureWeakAssembly()
|
||||
{
|
||||
// Isolation method so the JIT cannot keep the local references rooted past
|
||||
// its return — without [NoInlining] the GC may decide the locals are still
|
||||
// live and the WeakReference test becomes flaky.
|
||||
var evaluator = ScriptEvaluator<FakeScriptContext, int>.Compile("""return 42;""");
|
||||
var weak = new WeakReference(evaluator.GetType().Assembly is var asm &&
|
||||
asm is not null ? GetEmittedAssembly(evaluator) : null);
|
||||
evaluator.Dispose();
|
||||
return weak;
|
||||
}
|
||||
|
||||
[System.Runtime.CompilerServices.MethodImpl(
|
||||
System.Runtime.CompilerServices.MethodImplOptions.NoInlining)]
|
||||
private static object GetEmittedAssembly(ScriptEvaluator<FakeScriptContext, int> evaluator)
|
||||
{
|
||||
// The evaluator's delegate Method lives on the synthesized wrapper class in
|
||||
// the emitted assembly. The delegate field is private; we reach it via a
|
||||
// reflection probe rather than expose internals — keeps the public surface
|
||||
// unchanged.
|
||||
var funcField = typeof(ScriptEvaluator<FakeScriptContext, int>).GetField(
|
||||
"_func", System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic)!;
|
||||
var del = (Delegate)funcField.GetValue(evaluator)!;
|
||||
return del.Method.Module.Assembly;
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Clear_disposes_every_materialised_evaluator()
|
||||
{
|
||||
// Locks the contract that Clear() is publish-safe: after a config-generation
|
||||
// publish drops the cache, every prior script's ALC should unload so the
|
||||
// process memory plateaus rather than growing across publishes.
|
||||
var weaks = CompileFiveAndCaptureWeakAssemblies();
|
||||
for (int i = 0; i < 10 && weaks.Any(w => w.IsAlive); i++)
|
||||
{
|
||||
GC.Collect();
|
||||
GC.WaitForPendingFinalizers();
|
||||
GC.Collect();
|
||||
}
|
||||
weaks.ShouldAllBe(w => !w.IsAlive,
|
||||
"after Clear() every compiled-script ALC must be unloadable " +
|
||||
"(Core.Scripting-008). If this fails the publish-replace pattern leaks " +
|
||||
"emitted assemblies, which is exactly the v3 concern this rewrite fixes.");
|
||||
}
|
||||
|
||||
[System.Runtime.CompilerServices.MethodImpl(
|
||||
System.Runtime.CompilerServices.MethodImplOptions.NoInlining)]
|
||||
private static List<WeakReference> CompileFiveAndCaptureWeakAssemblies()
|
||||
{
|
||||
var cache = new CompiledScriptCache<FakeScriptContext, int>();
|
||||
var weaks = new List<WeakReference>();
|
||||
for (int i = 0; i < 5; i++)
|
||||
{
|
||||
// Distinct source per iteration so each compiles to its own assembly.
|
||||
var e = cache.GetOrCompile($"""return {i};""");
|
||||
var funcField = typeof(ScriptEvaluator<FakeScriptContext, int>).GetField(
|
||||
"_func", System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic)!;
|
||||
var del = (Delegate)funcField.GetValue(e)!;
|
||||
weaks.Add(new WeakReference(del.Method.Module.Assembly));
|
||||
}
|
||||
cache.Count.ShouldBe(5);
|
||||
cache.Clear();
|
||||
cache.Count.ShouldBe(0);
|
||||
return weaks;
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void GetOrCompile_after_Dispose_throws_ObjectDisposedException()
|
||||
{
|
||||
var cache = new CompiledScriptCache<FakeScriptContext, int>();
|
||||
cache.GetOrCompile("""return 1;""");
|
||||
cache.Dispose();
|
||||
Should.Throw<ObjectDisposedException>(() => cache.GetOrCompile("""return 2;"""));
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user