Which seems to indicate that there is a trade-off here and moving away from "no-expr-simplify" will make the installs/refreshes slower but also reduces memory usage. It also seems like our normal tests do not catch the memory explosion that we saw here.
I did a quick experiment in our "interfaces- many-snap- provided" test to see what impact the options have. I ran spread with:
$ spread -shell-after -v qemu:ubuntu- 22.04-64: tests/main/ interfaces- many-snap- provided
And inside spread (on 22.04) compiled the profiles with/without no-expr-simplify:
With "no-expr-simplify" snapd/apparmor/ profiles/ snap.{test- snapd-policy- app-consumer, test-snapd- policy- app-provider- classic} .* >/dev/null
# /usr/bin/time -f '%E real, %M max-mem' apparmor_parser -O no-expr-simplify -S /var/lib/
0:22.07 real, 22908 max-mem
Without "no-expr-simplify" snapd/apparmor/ profiles/ snap.{test- snapd-policy- app-consumer, test-snapd- policy- app-provider- classic} .* >/dev/null
# /usr/bin/time -f '%E real, %M max-mem' apparmor_parser -S /var/lib/
0:49.45 real, 13720 max-mem
Which seems to indicate that there is a trade-off here and moving away from "no-expr-simplify" will make the installs/refreshes slower but also reduces memory usage. It also seems like our normal tests do not catch the memory explosion that we saw here.