feat(memory): Allocator-backed global memory limits (#544)

Policy evaluation at scale needs to be able to set memory limits
so that a bad policy does not hog memory or to ensure that
policy evaluation itself does not use too much memory which could
cause other components to suffer.

This PR introduces capability to set and enforce global memory limits.
It also lays the groundwork for enabling per evaluation limits in future.

Once a global memory limit is set, Regorus maintains per thread counters
to track memory activity (allocation, deallocation) of a thread.
These counters are periodically flushed to global memory counters.
Per thread counters avoid the contention that updating global counters
on each alloc/free would cause.

Policy evaluation periodically checks these counters and raises errors
if allocated memory has exceeded the configured limit.

Currently memory limit capability is exposed only to FFI and C#.

Also update mimalloc to v2.2.6

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

bindings/csharp/Regorus/CompiledPolicy.cs

@@ -2,7 +2,6 @@
 // Licensed under the MIT License.
 
 using System;
-using System.Text;
 using System.Text.Json;
 using System.Threading;
 using Regorus.Internal;
@@ -146,36 +145,23 @@ namespace Regorus
                 throw new ObjectDisposedException(nameof(CompiledPolicy));
         }
 
-        private string? StringFromUTF8(IntPtr ptr)
-        {
-#if NETSTANDARD2_1
-            return System.Runtime.InteropServices.Marshal.PtrToStringUTF8(ptr);
-#else
-            int len = 0;
-            while (System.Runtime.InteropServices.Marshal.ReadByte(ptr, len) != 0) { ++len; }
-            byte[] buffer = new byte[len];
-            System.Runtime.InteropServices.Marshal.Copy(ptr, buffer, 0, buffer.Length);
-            return Encoding.UTF8.GetString(buffer);
-#endif
-        }
-
         private string? CheckAndDropResult(Internal.RegorusResult result)
         {
             try
             {
                 if (result.status != Internal.RegorusStatus.Ok)
                 {
-                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    var message = Internal.Utf8Marshaller.FromUtf8(result.error_message);
                     throw result.status.CreateException(message);
                 }
 
                 return result.data_type switch
                 {
-                    Internal.RegorusDataType.String => StringFromUTF8((IntPtr)result.output),
+                    Internal.RegorusDataType.String => Internal.Utf8Marshaller.FromUtf8(result.output),
                     Internal.RegorusDataType.Boolean => result.bool_value.ToString().ToLowerInvariant(),
                     Internal.RegorusDataType.Integer => result.int_value.ToString(),
                     Internal.RegorusDataType.None => null,
-                    _ => StringFromUTF8((IntPtr)result.output)
+                    _ => Internal.Utf8Marshaller.FromUtf8(result.output)
                 };
             }
             finally

bindings/csharp/Regorus/Compiler.cs

@@ -4,8 +4,6 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
-using System.Runtime.InteropServices;
-using System.Text;
 using Regorus.Internal;
 
 #nullable enable
@@ -157,26 +155,13 @@ namespace Regorus
             }
         }
 
-        private static string? StringFromUTF8(IntPtr ptr)
-        {
-#if NETSTANDARD2_1
-            return System.Runtime.InteropServices.Marshal.PtrToStringUTF8(ptr);
-#else
-            int len = 0;
-            while (System.Runtime.InteropServices.Marshal.ReadByte(ptr, len) != 0) { ++len; }
-            byte[] buffer = new byte[len];
-            System.Runtime.InteropServices.Marshal.Copy(ptr, buffer, 0, buffer.Length);
-            return Encoding.UTF8.GetString(buffer);
-#endif
-        }
-
         private static CompiledPolicy GetCompiledPolicyResult(Internal.RegorusResult result)
         {
             try
             {
                 if (result.status != Internal.RegorusStatus.Ok)
                 {
-                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    var message = Utf8Marshaller.FromUtf8(result.error_message);
                     throw result.status.CreateException(message);
                 }
 

bindings/csharp/Regorus/Engine.cs

@@ -2,8 +2,6 @@
 // Licensed under the MIT License.
 
 using System;
-using System.Runtime.InteropServices;
-using System.Text;
 using Regorus.Internal;
 
 
@@ -357,32 +355,24 @@ namespace Regorus
             });
         }
 
-        string? StringFromUTF8(IntPtr ptr)
-        {
-
-#if NETSTANDARD2_1
-				return System.Runtime.InteropServices.Marshal.PtrToStringUTF8(ptr);
-#else
-            int len = 0;
-            while (Marshal.ReadByte(ptr, len) != 0) { ++len; }
-            byte[] buffer = new byte[len];
-            Marshal.Copy(ptr, buffer, 0, buffer.Length);
-            return Encoding.UTF8.GetString(buffer);
-#endif
-        }
-
         string? CheckAndDropResult(Regorus.Internal.RegorusResult result)
         {
             try
             {
                 if (result.status != Regorus.Internal.RegorusStatus.Ok)
                 {
-                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    var message = Utf8Marshaller.FromUtf8(result.error_message);
                     throw result.status.CreateException(message);
                 }
 
-                var output = result.output is not null ? StringFromUTF8((IntPtr)result.output) : null;
-                return output ?? string.Empty;
+                return result.data_type switch
+                {
+                    Regorus.Internal.RegorusDataType.String => Utf8Marshaller.FromUtf8(result.output),
+                    Regorus.Internal.RegorusDataType.Boolean => result.bool_value.ToString().ToLowerInvariant(),
+                    Regorus.Internal.RegorusDataType.Integer => result.int_value.ToString(),
+                    Regorus.Internal.RegorusDataType.None => null,
+                    _ => Utf8Marshaller.FromUtf8(result.output)
+                };
             }
             finally
             {

bindings/csharp/Regorus/MemoryLimits.cs

@@ -0,0 +1,126 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using Regorus.Internal;
+
+#nullable enable
+namespace Regorus
+{
+    /// <summary>
+    /// Helpers for configuring and inspecting Regorus memory limits via the native allocator bridge.
+    /// </summary>
+    public static class MemoryLimits
+    {
+        /// <summary>
+        /// Configure the process-wide global memory limit in bytes. Pass <c>null</c> to remove the limit.
+        /// </summary>
+        /// <param name="bytes">Maximum number of bytes the allocator may reserve before signalling an error.</param>
+        public static void SetGlobalMemoryLimit(ulong? bytes)
+        {
+            var result = API.regorus_set_global_memory_limit(bytes ?? 0, bytes.HasValue);
+            EnsureSuccess(result, nameof(SetGlobalMemoryLimit));
+        }
+
+        /// <summary>
+        /// Returns the currently configured global memory limit, if any.
+        /// </summary>
+        public static ulong? GetGlobalMemoryLimit()
+        {
+            var result = API.regorus_get_global_memory_limit();
+            return ExtractOptionalU64(result, "Failed to get global memory limit");
+        }
+
+        /// <summary>
+        /// Forces the allocator to flush this thread's pending counters into the global aggregates.
+        /// </summary>
+        public static void FlushThreadMemoryCounters()
+        {
+            var result = API.regorus_flush_thread_memory_counters();
+            EnsureSuccess(result, nameof(FlushThreadMemoryCounters));
+        }
+
+        /// <summary>
+        /// Immediately checks the global memory limit and throws if the allocator reports exhaustion.
+        /// </summary>
+        public static void CheckGlobalMemoryLimit()
+        {
+            var result = API.regorus_check_global_memory_limit();
+            EnsureSuccess(result, nameof(CheckGlobalMemoryLimit));
+        }
+
+        /// <summary>
+        /// Override the per-thread automatic flush threshold in bytes. Pass <c>null</c> to restore the default.
+        /// </summary>
+        public static void SetThreadFlushThresholdOverride(ulong? bytes)
+        {
+            var result = API.regorus_set_thread_flush_threshold_override(bytes ?? 0, bytes.HasValue);
+            EnsureSuccess(result, nameof(SetThreadFlushThresholdOverride));
+        }
+
+        /// <summary>
+        /// Returns the per-thread flush threshold, if automatic flushing is enabled.
+        /// </summary>
+        public static ulong? GetThreadMemoryFlushThreshold()
+        {
+            var result = API.regorus_get_thread_memory_flush_threshold();
+            return ExtractOptionalU64(result, "Failed to get thread memory flush threshold");
+        }
+
+        private static unsafe ulong? ExtractOptionalU64(RegorusResult result, string errorContext)
+        {
+            try
+            {
+                if (result.status != RegorusStatus.Ok)
+                {
+                    var message = Utf8Marshaller.FromUtf8(result.error_message) ?? $"{errorContext}: native call failed";
+                    throw result.status.CreateException(message);
+                }
+
+                if (!result.bool_value)
+                {
+                    return null;
+                }
+
+                if (result.data_type != RegorusDataType.Integer)
+                {
+                    throw new InvalidOperationException(
+                        $"{errorContext}: native call returned {result.data_type} ({(int)result.data_type}) with bool_value={result.bool_value}"
+                    );
+                }
+
+                if (result.int_value < 0)
+                {
+                    throw new OverflowException($"{errorContext}: native value was negative ({result.int_value})");
+                }
+
+                return (ulong)result.int_value;
+            }
+            finally
+            {
+                API.regorus_result_drop(result);
+            }
+        }
+
+        private static void EnsureSuccess(RegorusResult result, string operation)
+        {
+            try
+            {
+                if (result.status != RegorusStatus.Ok)
+                {
+                    string? message;
+                    unsafe
+                    {
+                        message = Utf8Marshaller.FromUtf8(result.error_message);
+                    }
+
+                    throw result.status.CreateException(message);
+                }
+            }
+            finally
+            {
+                API.regorus_result_drop(result);
+            }
+        }
+    }
+}

bindings/csharp/Regorus/NativeMethods.cs

@@ -28,6 +28,46 @@ namespace Regorus.Internal
 
         #endregion
 
+        #region Memory Limit Methods
+
+        /// <summary>
+        /// Set the global memory limit. Pass hasLimit=false to clear the limit.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_set_global_memory_limit", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_set_global_memory_limit(ulong limit, [MarshalAs(UnmanagedType.U1)] bool hasLimit);
+
+        /// <summary>
+        /// Get the current global memory limit. bool_value indicates whether a limit is set.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_get_global_memory_limit", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_get_global_memory_limit();
+
+        /// <summary>
+        /// Check the global memory limit immediately.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_check_global_memory_limit", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_check_global_memory_limit();
+
+        /// <summary>
+        /// Flush the current thread's pending allocation counters into global aggregates.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_flush_thread_memory_counters", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_flush_thread_memory_counters();
+
+        /// <summary>
+        /// Set the per-thread flush threshold override. Pass hasThreshold=false to restore defaults.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_set_thread_flush_threshold_override", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_set_thread_flush_threshold_override(ulong threshold, [MarshalAs(UnmanagedType.U1)] bool hasThreshold);
+
+        /// <summary>
+        /// Get the per-thread flush threshold. bool_value indicates whether a threshold is configured.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_get_thread_memory_flush_threshold", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_get_thread_memory_flush_threshold();
+
+        #endregion
+
         #region Engine Methods
 
         /// <summary>
@@ -520,6 +560,7 @@ namespace Regorus.Internal
         /// Boolean value.
         /// Valid when data_type is Boolean.
         /// </summary>
+        [MarshalAs(UnmanagedType.I1)]
         public bool bool_value;
         /// <summary>
         /// Integer value.

bindings/csharp/Regorus/SchemaRegistry.cs

@@ -2,7 +2,6 @@
 // Licensed under the MIT License.
 
 using System;
-using System.Text;
 using Regorus.Internal;
 
 #nullable enable
@@ -220,36 +219,23 @@ namespace Regorus
             CheckAndDropResult(Internal.API.regorus_effect_schema_clear());
         }
 
-        private static string? StringFromUTF8(IntPtr ptr)
-        {
-#if NETSTANDARD2_1
-            return System.Runtime.InteropServices.Marshal.PtrToStringUTF8(ptr);
-#else
-            int len = 0;
-            while (System.Runtime.InteropServices.Marshal.ReadByte(ptr, len) != 0) { ++len; }
-            byte[] buffer = new byte[len];
-            System.Runtime.InteropServices.Marshal.Copy(ptr, buffer, 0, buffer.Length);
-            return Encoding.UTF8.GetString(buffer);
-#endif
-        }
-
         private static string? CheckAndDropResult(Internal.RegorusResult result)
         {
             try
             {
                 if (result.status != Internal.RegorusStatus.Ok)
                 {
-                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    var message = Utf8Marshaller.FromUtf8(result.error_message);
                     throw result.status.CreateException(message);
                 }
 
                 return result.data_type switch
                 {
-                    Internal.RegorusDataType.String => StringFromUTF8((IntPtr)result.output),
+                    Internal.RegorusDataType.String => Utf8Marshaller.FromUtf8(result.output),
                     Internal.RegorusDataType.Boolean => result.bool_value.ToString().ToLowerInvariant(),
                     Internal.RegorusDataType.Integer => result.int_value.ToString(),
                     Internal.RegorusDataType.None => null,
-                    _ => StringFromUTF8((IntPtr)result.output)
+                    _ => Utf8Marshaller.FromUtf8(result.output)
                 };
             }
             finally
@@ -264,7 +250,7 @@ namespace Regorus
             {
                 if (result.status != Internal.RegorusStatus.Ok)
                 {
-                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    var message = Utf8Marshaller.FromUtf8(result.error_message);
                     throw result.status.CreateException(message);
                 }
 
@@ -282,7 +268,7 @@ namespace Regorus
             {
                 if (result.status != Internal.RegorusStatus.Ok)
                 {
-                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    var message = Utf8Marshaller.FromUtf8(result.error_message);
                     throw result.status.CreateException(message);
                 }
 

bindings/csharp/Regorus/StatusExtensions.cs

@@ -17,7 +17,7 @@ namespace Regorus.Internal
             {
                 RegorusStatus.Panic => new InvalidOperationException($"Regorus engine panicked: {details}"),
                 RegorusStatus.Poisoned => new InvalidOperationException($"Regorus engine is poisoned: {details}"),
-                _ => new Exception(details),
+                _ => new InvalidOperationException(details),
             };
         }
     }

bindings/csharp/Regorus/TargetRegistry.cs

@@ -2,7 +2,6 @@
 // Licensed under the MIT License.
 
 using System;
-using System.Text;
 using Regorus.Internal;
 
 #nullable enable
@@ -115,36 +114,23 @@ namespace Regorus
             }
         }
 
-        private static string? StringFromUTF8(IntPtr ptr)
-        {
-#if NETSTANDARD2_1
-            return System.Runtime.InteropServices.Marshal.PtrToStringUTF8(ptr);
-#else
-            int len = 0;
-            while (System.Runtime.InteropServices.Marshal.ReadByte(ptr, len) != 0) { ++len; }
-            byte[] buffer = new byte[len];
-            System.Runtime.InteropServices.Marshal.Copy(ptr, buffer, 0, buffer.Length);
-            return Encoding.UTF8.GetString(buffer);
-#endif
-        }
-
         private static string? CheckAndDropResult(Internal.RegorusResult result)
         {
             try
             {
                 if (result.status != Internal.RegorusStatus.Ok)
                 {
-                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    var message = Utf8Marshaller.FromUtf8(result.error_message);
                     throw result.status.CreateException(message);
                 }
 
                 return result.data_type switch
                 {
-                    Internal.RegorusDataType.String => StringFromUTF8((IntPtr)result.output),
+                    Internal.RegorusDataType.String => Utf8Marshaller.FromUtf8(result.output),
                     Internal.RegorusDataType.Boolean => result.bool_value.ToString().ToLowerInvariant(),
                     Internal.RegorusDataType.Integer => result.int_value.ToString(),
                     Internal.RegorusDataType.None => null,
-                    _ => StringFromUTF8((IntPtr)result.output)
+                    _ => Utf8Marshaller.FromUtf8(result.output)
                 };
             }
             finally
@@ -159,7 +145,7 @@ namespace Regorus
             {
                 if (result.status != Internal.RegorusStatus.Ok)
                 {
-                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    var message = Utf8Marshaller.FromUtf8(result.error_message);
                     throw result.status.CreateException(message);
                 }
 
@@ -177,7 +163,7 @@ namespace Regorus
             {
                 if (result.status != Internal.RegorusStatus.Ok)
                 {
-                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    var message = Utf8Marshaller.FromUtf8(result.error_message);
                     throw result.status.CreateException(message);
                 }
 

bindings/csharp/Regorus/Utf8Marshaller.cs

@@ -150,5 +150,48 @@ namespace Regorus.Internal
         {
             return new PinnedUtf8(value);
         }
+
+        internal static unsafe string? FromUtf8(byte* pointer)
+        {
+            if (pointer is null)
+            {
+                return null;
+            }
+
+#if NETSTANDARD2_1
+            return Marshal.PtrToStringUTF8((IntPtr)pointer);
+#else
+            var intPtr = (IntPtr)pointer;
+            var length = 0;
+            while (Marshal.ReadByte(intPtr, length) != 0)
+            {
+                length++;
+            }
+
+            if (length == 0)
+            {
+                return string.Empty;
+            }
+
+            var buffer = ArrayPool<byte>.Shared.Rent(length);
+            try
+            {
+                Marshal.Copy(intPtr, buffer, 0, length);
+                return Encoding.UTF8.GetString(buffer, 0, length);
+            }
+            finally
+            {
+                ArrayPool<byte>.Shared.Return(buffer);
+            }
+#endif
+        }
+
+        internal static string? FromUtf8(IntPtr pointer)
+        {
+            unsafe
+            {
+                return FromUtf8((byte*)pointer);
+            }
+        }
     }
 }