perf: share compiled RegexSet cache across scanners

lib/src/compiler/mod.rs

@@ -814,9 +814,11 @@ impl<'a> Compiler<'a> {
             warnings: self.warnings.into(),
             filesize_bounds: self.filesize_bounds,
             regex_sets: self.regex_sets,
+            compiled_regex_sets: Default::default(),
             fast_scan_patterns: self.fast_scan_patterns,
         };
 
+        rules.init_regex_set_cache();
         rules.build_ac_automaton();
         rules
     }

lib/src/compiler/rules.rs

@@ -2,6 +2,7 @@ use std::fmt;
 use std::io::{BufWriter, Read, Write};
 use std::ops::{Bound, RangeBounds};
 use std::slice::Iter;
+use std::sync::OnceLock;
 #[cfg(feature = "logging")]
 use std::time::Instant;
 
@@ -165,6 +166,17 @@ pub struct Rules {
     /// set automata for single-pass evaluation.
     pub(in crate::compiler) regex_sets: FxHashMap<RegexSetId, Vec<RegexId>>,
 
+    /// Lazily compiled `RegexSet` automata shared by all scanners using these
+    /// rules.
+    ///
+    /// The definitions in `regex_sets` are serialized with the rules, but the
+    /// compiled automata are runtime-only. The vector is initialized when the
+    /// [`Rules`] are built or deserialized, while each individual `RegexSet`
+    /// is compiled lazily on first use.
+    #[serde(skip)]
+    pub(in crate::compiler) compiled_regex_sets:
+        Vec<OnceLock<regex::bytes::RegexSet>>,
+
     /// BitVec where the N-th bit indicates whether the pattern with
     /// PatternId = N is a fast-scan pattern.
     ///
@@ -268,6 +280,7 @@ impl Rules {
             info!("WASM build time: {:?}", Instant::elapsed(&start));
         }
 
+        rules.init_regex_set_cache();
         rules.build_ac_automaton();
 
         Ok(rules)
@@ -370,12 +383,28 @@ impl Rules {
             })
     }
 
+    /// Initializes the runtime-only cache for compiled `RegexSet` automata.
+    pub(in crate::compiler) fn init_regex_set_cache(&mut self) {
+        self.compiled_regex_sets =
+            (0..self.regex_sets.len()).map(|_| OnceLock::new()).collect();
+    }
+
     /// Returns a compiled multi-pattern `RegexSet` for a given `RegexSetId`.
     #[inline]
     pub(crate) fn get_regex_set(
         &self,
         set_id: RegexSetId,
-    ) -> regex::bytes::RegexSet {
+    ) -> &regex::bytes::RegexSet {
+        let regex_set = self
+            .compiled_regex_sets
+            .get(usize::from(set_id))
+            .unwrap_or_else(|| panic!("invalid RegexSetId: {set_id:?}"));
+
+        regex_set.get_or_init(|| self.build_regex_set(set_id))
+    }
+
+    /// Builds the `RegexSet` automaton for a given [`RegexSetId`].
+    fn build_regex_set(&self, set_id: RegexSetId) -> regex::bytes::RegexSet {
         let re_ids = self.regex_sets.get(&set_id).unwrap();
         let mut patterns = Vec::with_capacity(re_ids.len());
 

lib/src/scanner/context.rs

@@ -24,7 +24,7 @@ use rustc_hash::{FxHashMap, FxHashSet};
 use smallvec::SmallVec;
 
 use crate::compiler::{
-    NamespaceId, PatternId, RegexId, RegexSetId, RuleId, Rules, SubPattern,
+    NamespaceId, PatternId, RegexId, RuleId, Rules, SubPattern,
     SubPatternAtom, SubPatternFlags, SubPatternId,
 };
 use crate::errors::VariableError;
@@ -153,15 +153,6 @@ pub struct ScanContext<'r, 'd> {
     /// is evaluated, it is compiled the first time and stored in this hash
     /// map.
     pub(crate) regex_cache: RefCell<FxHashMap<RegexId, Regex>>,
-    /// Persistent cache for grouped `RegexSet` automata.
-    ///
-    /// Like individual regular expressions, compiling a multi-pattern
-    /// `RegexSet` is an expensive operation. This cache compiles the set
-    /// automata lazily upon the very first match request and preserves the
-    /// compiled automata across all subsequent scans performed by the
-    /// scanner instance.
-    pub(crate) regex_set_cache:
-        RefCell<FxHashMap<RegexSetId, regex::bytes::RegexSet>>,
     /// Engines for custom base64 alphabets used by base64 string modifiers.
     ///
     /// These engines are derived from rule literals and reused across scans.
@@ -306,11 +297,7 @@ impl ScanContext<'_, '_> {
         set_id: crate::compiler::RegexSetId,
         haystack: &[u8],
     ) -> bool {
-        let mut automata_cache = self.regex_set_cache.borrow_mut();
-        let regex_set = automata_cache
-            .entry(set_id)
-            .or_insert_with(|| self.compiled_rules.get_regex_set(set_id));
-        regex_set.is_match(haystack)
+        self.compiled_rules.get_regex_set(set_id).is_match(haystack)
     }
 
     /// Returns the protobuf struct produced by a module.
@@ -1919,7 +1906,6 @@ pub fn create_wasm_store_and_ctx<'r>(
         },
         deadline: 0,
         regex_cache: RefCell::new(FxHashMap::default()),
-        regex_set_cache: RefCell::new(FxHashMap::default()),
         vm: VM {
             pike_vm: PikeVM::new(rules.re_code()),
             fast_vm: FastVM::new(rules.re_code()),