Memory Management

A process maps several regions with different rules: read-only code and constants, initialized static data, zero-filled static data, one growable heap, one stack per thread, and per-thread thread-local storage. Placement decides lifetime and who may write.

A call frame holds that call's return address, saved registers, local variables and spilled temporaries, plus space for outgoing arguments. Returning moves the stack pointer back past the whole frame, so release is one instruction with no bookkeeping.

A literal lives in the read-only constants region, mapped without write permission, so the hardware refuses the store. A heap block sits in a writable mapping, so the identical instruction succeeds. The region's permissions decide, not the pointer.

Divide the thread's stack size by the average frame size: a 1 MiB stack with 80-byte frames allows roughly 13,000 nested calls. Frame size is the lever - adding a 256-byte local buffer per frame cuts that to about 3,100.

That no reference to the object can be followed once the creating frame returns: it is never stored in longer-lived memory, returned, or published to another thread. Without that proof the object must go on the heap.

Allocation aligns one cursor, hands back its old position and advances it past the object, storing no per-object metadata. Nothing is released individually: at the response boundary the cursor is rewound to the start, which releases everything in the region at once.

That 28 MB gap is internal fragmentation: bytes lost rounding each request up to a whole block. It cannot see external fragmentation, the free-but-scattered space between blocks, because nobody occupies those bytes.

Boundary tags repeat each block's size and free flag in a header and a footer, so a released block reaches both address neighbours by arithmetic and merges with whichever are free — no list scan.

First fit stops at the first adequate block, so the search is short but early splits leave small remainders near the list head. Best fit scans the whole list for the tightest block, paying a full walk to leave a smaller remainder.

A per-thread allocator cache gives each thread its own free list per size class. Allocation pops that private list's head, and since no other thread can reach it, the pop needs no lock — only refill and flush synchronize.

Most objects die very young — the weak generational hypothesis. Splitting the heap by age lets a collector sweep the young area often and cheaply, where almost everything is already garbage, and touch the older area rarely.

A root is a reference the collector can find without tracing anything first — a running thread's stack slot or register, a global table entry, a handle registered by code outside the collected heap. Everything the program can still touch starts at one of them.

Black means already scanned, so the marker will not revisit it on its own. A reference from a black object to a white one is therefore a live object the trace never reaches — and would wrongly reclaim.

Many brief suspensions rather than one long one. The collector marks a bounded slice of the heap, hands control back, and resumes later from where it stopped. The longest pause shrinks; total collection work usually grows.

Tracing cost follows the live set, not the free space, while each cycle reclaims everything above the live set. Extra headroom therefore spreads the same tracing work over far more allocation before the next cycle is needed.

Each copy and drop of a counted handle is an atomic read-modify-write of one shared count, so read-only sharing is still a write workload: cores must take exclusive turns owning that counter's cache line.

Each object's count is held above zero by the other, so no decrement ever reaches zero. A count records whether anything points at an object, not whether anything reachable does, so an unreachable ring keeps itself alive.

Every new owning handle to an object increments its count; every handle dropped or overwritten decrements it. At zero the object's cleanup runs, every handle it holds is released in turn, and its memory is reclaimed.

It reads as absent from that moment on. Only owning handles are counted, so the last one dropping destroys the object immediately; weak handles are not counted, cannot delay that, and are never allowed to yield destroyed storage.

One decrement can destroy a whole structure. The thread that dropped the head handle runs a million cleanups, decrements and frees inline, in the middle of whatever request it was serving, so a cheap-looking assignment becomes an unbounded pause.

A borrow is temporary non-owning access to a value someone else must release. It carries no release duty, so it stays valid only while that owner still holds the value; outliving the owner leaves it naming storage already reclaimed.

Readers all observe one unchanging value, so overlapping them changes nothing. A writer can resize, move or half-update it, so any other reference alive at that moment could read a torn or stale view. Exclusivity for writers is what rules that out.

A leak is memory that is still owned and still reachable — a cache that never evicts, a registration nobody cancels. The checks prove every access is valid; they say nothing about how long an owner chooses to keep a block.

Use-after-free, double free, and dangling references into a moved or resized container become unrepresentable: single ownership plus lifetime-checked borrows reject them before the program builds. Leaks and logic errors are untouched, because keeping memory reachable is safe.

A move transfers the release duty to the destination handle and leaves the source owning nothing. The block stays at the same address; only the small owning record is copied, so the cost is the same for 4 KiB and 64 MiB.

Automatic reclamation frees only what nothing can reach. A leak there is memory that stays reachable from something live - an unbounded cache, a growing registry, a collection nobody trims - but will never be used again.

A container ceiling counts every byte the whole process holds; the configured maximum heap bounds only one region inside it. Thread stacks, runtime metadata, allocator caches and buffers living outside the managed heap are charged against the ceiling too.

The post-collection floor is the live set: the bytes still reachable once the collector has finished. Peaks only record how much garbage piled up since the previous collection, so only a rising floor shows that memory is being retained.

That is churn, not a leak. The flat 1.2 GB floor says the live set is constant; the 1.8 GB reclaimed every forty seconds says the service allocates roughly 45 MB a second of short-lived objects. The fix is allocation rate, not a retainer hunt.

Shallow size is the bytes of the object itself: header, fields and its reference slots, but not their targets. Retained size adds everything that would become unreachable if that object did, so it measures what the object keeps alive.