136970 2014-09-19 18:46:31 -0700 Leak of mallocs under StructureSet::OutOfLineList::create 2014-09-19 20:02:00 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 joepeck rniwa commit-queue fpizlo ggaren joepeck rniwa oldest_to_newest 1036265 0 joepeck 2014-09-19 18:46:31 -0700 The leaks bot is seeing a lot of leaks of mallocs under StructureSet::OutOfLineList::create. The leak itself is small (48 bytes), but that is a large number of leaks: <http://build.webkit.org/builders/Apple%20MountainLion%20%28Leaks%29/builds/11637/steps/layout-test/logs/stdio> I don't have a test case, but the bots run frequently. Example back traces show OutOfLineLists created in add, merge, and addOutOfLine: Call stack: [thread 0x12f65a000]: | thread_start | _pthread_start | WTF::wtfThreadEntryPoint(void*) ThreadingPthreads.cpp:170 | WTF::threadEntryPoint(void*) Threading.cpp:68 | JSC::DFG::Worklist::threadFunction(void*) DFGWorklist.cpp:401 | JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) DFGWorklist.cpp:358 | JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) DFGPlan.cpp:162 | JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) DFGPlan.cpp:347 | JSC::DFG::performCFA(JSC::DFG::Graph&) DFGCFAPhase.cpp:168 | bool JSC::DFG::runPhase<JSC::DFG::CFAPhase>(JSC::DFG::Graph&) DFGPhase.h:87 | bool JSC::DFG::runAndLog<JSC::DFG::CFAPhase>(JSC::DFG::CFAPhase&) DFGPhase.h:77 | JSC::DFG::CFAPhase::run() DFGCFAPhase.cpp:80 | JSC::DFG::CFAPhase::performForwardCFA() DFGCFAPhase.cpp:151 | JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock*) DFGCFAPhase.cpp:125 | JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::execute(unsigned int) DFGAbstractInterpreterInlines.h:1992 | JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects(unsigned int, JSC::DFG::Node*) DFGAbstractInterpreterInlines.h:1655 | JSC::StructureSet::merge(JSC::StructureSet const&) StructureSet.cpp:104 | JSC::StructureSet::OutOfLineList::create(unsigned int) StructureSet.cpp:387 | WTF::fastMalloc(unsigned long) FastMalloc.cpp:282 | malloc | malloc_zone_malloc Call stack: [thread 0x11b7a9000]: | thread_start | _pthread_start | WTF::wtfThreadEntryPoint(void*) ThreadingPthreads.cpp:170 | WTF::threadEntryPoint(void*) Threading.cpp:68 | JSC::DFG::Worklist::threadFunction(void*) DFGWorklist.cpp:401 | JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) DFGWorklist.cpp:358 | JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) DFGPlan.cpp:162 | JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) DFGPlan.cpp:260 | JSC::DFG::performCFA(JSC::DFG::Graph&) DFGCFAPhase.cpp:168 | bool JSC::DFG::runPhase<JSC::DFG::CFAPhase>(JSC::DFG::Graph&) DFGPhase.h:87 | bool JSC::DFG::runAndLog<JSC::DFG::CFAPhase>(JSC::DFG::CFAPhase&) DFGPhase.h:77 | JSC::DFG::CFAPhase::run() DFGCFAPhase.cpp:80 | JSC::DFG::CFAPhase::performForwardCFA() DFGCFAPhase.cpp:151 | JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock*) DFGCFAPhase.cpp:125 | JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::execute(unsigned int) DFGAbstractInterpreterInlines.h:1992 | JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects(unsigned int, JSC::DFG::Node*) DFGAbstractInterpreterInlines.h:1489 | JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::observeTransition(unsigned int, JSC::Structure*, JSC::Structure*) DFGAbstractInterpreter.h:2077 | void JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::forAllValues<JSC::DFG::AbstractValue::TransitionObserver>(unsigned int, JSC::DFG::AbstractValue::TransitionObserver&) DFGAbstractInterpreterInlines.h:2059 | JSC::DFG::AbstractValue::TransitionObserver::operator()(JSC::DFG::AbstractValue&) DFGAbstractValue.h:131 | JSC::DFG::AbstractValue::observeTransition(JSC::Structure*, JSC::Structure*) DFGAbstractValue.h:113 | JSC::DFG::StructureAbstractValue::observeTransition(JSC::Structure*, JSC::Structure*) DFGStructureAbstractValue.cpp:95 | JSC::StructureSet::add(JSC::Structure*) StructureSet.cpp:50 | JSC::StructureSet::OutOfLineList::create(unsigned int) StructureSet.cpp:387 | WTF::fastMalloc(unsigned long) FastMalloc.cpp:282 | malloc | malloc_zone_malloc Leak: 0x7f912ce560e0 size=64 zone: DefaultMallocZone_0x10b933000 0x00000006 0x00000006 0x1a4937a0 0x00000001 .........7I..... 0x1a492c40 0x00000001 0x1a492460 0x00000001 @,I.....`$I..... 0x1a491b30 0x00000001 0x1a4984a0 0x00000001 0.I.......I..... 0x1a497ef0 0x00000001 0x00000000 0x00040000 .~I............. Call stack: [thread 0x11fe42000]: | thread_start | _pthread_start | WTF::wtfThreadEntryPoint(void*) ThreadingPthreads.cpp:170 | WTF::threadEntryPoint(void*) Threading.cpp:68 | JSC::DFG::Worklist::threadFunction(void*) DFGWorklist.cpp:401 | JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) DFGWorklist.cpp:358 | JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) DFGPlan.cpp:162 | JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) DFGPlan.cpp:207 | JSC::DFG::parse(JSC::DFG::Graph&) DFGByteCodeParser.cpp:3941 | JSC::DFG::ByteCodeParser::parse() DFGByteCodeParser.cpp:3916 | JSC::DFG::ByteCodeParser::parseCodeBlock() DFGByteCodeParser.cpp:3856 | JSC::DFG::ByteCodeParser::parseBlock(unsigned int) DFGByteCodeParser.cpp:2854 | JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, JSC::CodeOrigin, WTF::StringImpl*) GetByIdStatus.cpp:264 | JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, unsigned int, WTF::StringImpl*) GetByIdStatus.cpp:102 | JSC::GetByIdStatus::computeForStubInfo(JSC::ConcurrentJITLocker const&, JSC::CodeBlock*, JSC::StructureStubInfo*, WTF::StringImpl*, JSC::CallLinkStatus::ExitSiteData) GetByIdStatus.cpp:208 | JSC::GetByIdStatus::appendVariant(JSC::GetByIdVariant const&) GetByIdStatus.cpp:45 | JSC::GetByIdVariant::attemptToMerge(JSC::GetByIdVariant const&) GetByIdVariant.cpp:99 | JSC::StructureSet::merge(JSC::StructureSet const&) StructureSet.cpp:97 | JSC::StructureSet::add(JSC::Structure*) StructureSet.cpp:58 | JSC::StructureSet::addOutOfLine(JSC::Structure*) StructureSet.cpp:355 | JSC::StructureSet::OutOfLineList::create(unsigned int) StructureSet.cpp:387 | WTF::fastMalloc(unsigned long) FastMalloc.cpp:282 | malloc | malloc_zone_malloc 1036276 1 238405 rniwa 2014-09-19 19:34:40 -0700 Created attachment 238405 Fixes the leak 1036284 2 238405 commit-queue 2014-09-19 20:01:57 -0700 Comment on attachment 238405 Fixes the leak Clearing flags on attachment: 238405 Committed r173787: <http://trac.webkit.org/changeset/173787> 1036285 3 commit-queue 2014-09-19 20:02:00 -0700 All reviewed patches have been landed. Closing bug. 238405 2014-09-19 19:34:40 -0700 2014-09-19 20:01:56 -0700 Fixes the leak bug-136970-20140919193423.patch text/plain 1265 rniwa SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTczNzg1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDE0LTA5LTE5ICBSeW9zdWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAg IExlYWsgb2YgbWFsbG9jcyB1bmRlciBTdHJ1Y3R1cmVTZXQ6Ok91dE9mTGluZUxpc3Q6OmNyZWF0 ZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTM2OTcw CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgYWRkT3V0 T2ZMaW5lIHNob3VsZCBmcmVlIHRoZSBvbGQgbGlzdCB3aGVuIGV4cGFuZGluZyB0aGUgY2FwYWNp dHkuCisKKyAgICAgICAgKiBieXRlY29kZS9TdHJ1Y3R1cmVTZXQuY3BwOgorICAgICAgICAoSlND OjpTdHJ1Y3R1cmVTZXQ6OmFkZE91dE9mTGluZSk6CisKIDIwMTQtMDktMTkgIERhbmllbCBCYXRl cyAgPGRhYmF0ZXNAYXBwbGUuY29tPgogCiAgICAgICAgIEFsd2F5cyBhc3N1bWUgaW50ZXJuYWwg U0RLIHdoZW4gYnVpbGRpbmcgY29uZmlndXJhdGlvbiBQcm9kdWN0aW9uCkluZGV4OiBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvU3RydWN0dXJlU2V0LmNwcAo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBT b3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvU3RydWN0dXJlU2V0LmNwcAkocmV2aXNpb24g MTczNzg0KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2J5dGVjb2RlL1N0cnVjdHVyZVNldC5j cHAJKHdvcmtpbmcgY29weSkKQEAgLTM1Nyw2ICszNTcsNyBAQCBib29sIFN0cnVjdHVyZVNldDo6 YWRkT3V0T2ZMaW5lKFN0cnVjdHVyCiAgICAgZm9yICh1bnNpZ25lZCBpID0gbGlzdC0+bV9sZW5n dGg7IGktLTspCiAgICAgICAgIG5ld0xpc3QtPmxpc3QoKVtpXSA9IGxpc3QtPmxpc3QoKVtpXTsK ICAgICBuZXdMaXN0LT5saXN0KClbbGlzdC0+bV9sZW5ndGhdID0gc3RydWN0dXJlOworICAgIE91 dE9mTGluZUxpc3Q6OmRlc3Ryb3kobGlzdCk7CiAgICAgc2V0KG5ld0xpc3QpOwogICAgIHJldHVy biB0cnVlOwogfQo=