Why malloc in WebAssembly requires 4x the memory? - memory-management

Question

I wrote a script in C to allocate memory with malloc() on a infinite loop.
My aim was to realize a simple Denial of Service using WebAssembly by opening multiple tabs and make the browser crash.
I can allocate about 2 GB max for each tab to prevent the tab crash (memory limitation for x64 browsers).
#include <stdlib.h>
#define MAX_MEM 2147483630 //2 GB
int main() {
long int mem_used=209715000;
while(1){
if(mem_used<MAX_MEM){
int *ptr = malloc(sizeof(int));
mem_used+=4;
}
}
return 0;
}
I expected it to work, but instead the tab crashes.
From tests I've made, mem_used+=16 is the right choice to prevent the tab crash.
I don't know deeply the WebAssembly memory management, so my thought is that maybe it requires 4x the memory. Is that correct?

Answer 1

With emscripten, malloc adds some minimum chunk size and then aligns the address to at least 8 byte boundaries. So for small allocations (even zero bytes), malloc will appear to take significantly more space than needed. For big allocations, the overhead will be relatively small.
See comments in dlmalloc.c.
The following program demonstrates how much space malloc takes:
#include <iostream>
int main() {
char *previous, *current;
previous = (char*)malloc(0);
for(int i=0; i<32; ++i) {
current = (char*)malloc(i+1);
std::cout << "malloc(" << i << ") consumed " << (current-previous) << " bytes\n";
previous = current;
}
std::cout << "\n";
previous = (char*)malloc(1);
for(int i=0; i<12; ++i) {
current = (char*)malloc( 1<<(i+1) );
std::cout << "malloc(" << (1<<i) << ") consumed " << (current-previous) << " bytes\n";
previous = current;
}
return 0;
}
This yields the following output:
malloc(0) consumed 16 bytes
malloc(1) consumed 16 bytes
malloc(2) consumed 16 bytes
malloc(3) consumed 16 bytes
malloc(4) consumed 16 bytes
malloc(5) consumed 16 bytes
malloc(6) consumed 16 bytes
malloc(7) consumed 16 bytes
malloc(8) consumed 16 bytes
malloc(9) consumed 16 bytes
malloc(10) consumed 16 bytes
malloc(11) consumed 16 bytes
malloc(12) consumed 16 bytes
malloc(13) consumed 24 bytes
malloc(14) consumed 24 bytes
malloc(15) consumed 24 bytes
malloc(16) consumed 24 bytes
malloc(17) consumed 24 bytes
malloc(18) consumed 24 bytes
malloc(19) consumed 24 bytes
malloc(20) consumed 24 bytes
malloc(21) consumed 32 bytes
malloc(22) consumed 32 bytes
malloc(23) consumed 32 bytes
malloc(24) consumed 32 bytes
malloc(25) consumed 32 bytes
malloc(26) consumed 32 bytes
malloc(27) consumed 32 bytes
malloc(28) consumed 32 bytes
malloc(29) consumed 40 bytes
malloc(30) consumed 40 bytes
malloc(31) consumed 40 bytes
malloc(1) consumed 16 bytes
malloc(2) consumed 16 bytes
malloc(4) consumed 16 bytes
malloc(8) consumed 16 bytes
malloc(16) consumed 24 bytes
malloc(32) consumed 40 bytes
malloc(64) consumed 72 bytes
malloc(128) consumed 136 bytes
malloc(256) consumed 264 bytes
malloc(512) consumed 520 bytes
malloc(1024) consumed 1032 bytes
malloc(2048) consumed 2056 bytes
See full source code in this repo

Answer 2

Your problem is that malloc implementations typically:
a) Include overhead; and
b) Round up to some unit
malloc (sizeof(int)) is using more than sizeof(int) bytes behind the scenes.

Answer 3

In any system, malloc() always slightly uses more memory than you request. Emscripten uses dlmalloc, a popular malloc() implementation, as default. According to Wikipedia:
Memory on the heap is allocated as "chunks", an 8-byte aligned data structure which contains a header, and usable memory. Allocated memory contains an 8 or 16 byte overhead for the size of the chunk and usage flags. Unallocated chunks also store pointers to other free chunks in the usable space area, making the minimum chunk size 16 bytes (32-bit system) and 24 bytes (64-bit system).
This means that even a single byte allocated memory block malloc(1) uses at least 16 bytes to 24 bytes. This is because memory alignment problem and each allocated block needs additional bytes to store metadata of the block. You can easily google how malloc() works to understand why there is such overhead.
Therefore, to meet your purpose, the test should allocate much larger memory block at each iteration to minimize such overhead. I would personally recommend 4kb or 1MB instead of sizeof(int).