Bug 4797 – leaks of DOMStringImpl called from HTMLTokenizer::processToken, seen running webkit tests

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit Misc.

[John Sullivan]

This bug is also in Radar as <rdar://4231952>

This is split off from 4665. This is one of the many leaks found with these steps:

1. Build a development build of tip-of-tree WebKit
2. use run-webkit-tests --leaks

Leak: 0x1d3fbb20  size=176	
	0x00540068 0x00690073 0x00200076 0x00650072 	.T.h.i.s. .v.e.r
	0x00790020 0x006c006f 0x006e0067 0x00200070 	.y. .l.o.n.g. .p
	0x00610072 0x00610067 0x00720061 0x00700068 	.a.r.a.g.r.a.p.h
	0x00200073 0x0068006f 0x0075006c 0x00640020 	. .s.h.o.u.l.d. 
	0x00680061 0x00760065 0x00200061 0x00200062 	.h.a.v.e. .a. .b
	0x00690067 0x00200066 0x00690072 0x00730074 	.i.g. .f.i.r.s.t
	0x0020006c 0x00650074 0x00740065 0x0072000a 	. .l.e.t.t.e.r..
	0x00200020 0x00200020 0x00200020 0x00200077 	. . . . . . . .w
	...
	Call stack: [thread 239f]: | 0x0 | start | _start | main | dumpRenderTree | -[NSRunLoop 
runMode:beforeDate:] | CFRunLoopRunSpecific | __CFRunLoopRun | __CFRunLoopDoSources0 | 
_sendCallbacks | -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] | -[NSURLConnection
(NSURLConnectionInternal) _sendDidReceiveDataCallback] | -[WebLoader 
connection:didReceiveData:lengthReceived:] | -[WebMainResourceLoader 
didReceiveData:lengthReceived:] | -[WebLoader didReceiveData:lengthReceived:] | -
[WebMainResourceLoader addData:] | -[WebDataSource(WebPrivate) _receivedData:] | -
[WebHTMLRepresentation receivedData:withDataSource:] | -[WebBridge 
receivedData:textEncodingName:] | -[WebCoreBridge addData:] | KWQKHTMLPart::addData(char const*, 
int) | KHTMLPart::write(char const*, int) | khtml::HTMLTokenizer::write(khtml::TokenizerString const&, 
bool) | khtml::HTMLTokenizer::processToken() | DOM::DOMStringImpl::DOMStringImpl[in-charge]
(QChar const*, unsigned) | DOM::DOMStringImpl::DOMStringImpl[unified](QChar const*, unsigned) | 
khtml::main_thread_malloc(unsigned long) | malloc 

This one still occurs in tip of tree, though most of the bugs in 4665 have been fixed. I see it (at least 
sometimes) in leaks output from fast/dom/outerText and in fast/dom/outerText-no-element.

[Darin Adler]

Created attachment 3776 [details]
fix for leak in setOuterText -- one call to removeChild that I missed

[John Sullivan]

Comment on attachment 3776 [details]
fix for leak in setOuterText -- one call to removeChild that I missed

whitespace looks wrong for textNext->parentNode()->removeChild() line, but r=me

[Darin Adler]

Created attachment 3777 [details]
revised patch that fixes even more removeChild and replaceChild leaks

[John Sullivan]

Comment on attachment 3777 [details]
revised patch that fixes even more removeChild and replaceChild leaks

I had a couple of comments on IRC.

[Darin Adler]

Note to self: the "replaceChild(s, foot, exceptioncode);" needs to use "f" instead of "foot" when landing.

[Darin Adler]

Checked in a fix that should fix the leak described in this bug, as well as two others. The three bugs are 
bug 4795, bug 4796, and bug 4797.