186221 2018-06-01 20:22:16 -0700 throw/catch(e) abandons a Document 2018-06-04 14:45:54 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 186277 InRadar P2 Normal --- 1 simon.fraser webkit-unassigned ap ggaren keith_miller koivisto mark.lam rniwa simon.fraser webkit-bug-importer oldest_to_newest 1429487 0 simon.fraser 2018-06-01 20:22:16 -0700 If you load LayoutTests/fast/css/invalid-import-rule-insertion.html, then load another page and clear the page cache, the Document for LayoutTests/fast/css/invalid-import-rule-insertion.html is never released. It seems to be trapped in a retain cycle. 1429488 1 webkit-bug-importer 2018-06-01 20:22:33 -0700 <rdar://problem/40743441> 1429492 2 simon.fraser 2018-06-01 20:36:47 -0700 This is triggered by the throw and a catch that references the exception. Minimal test case: <script> try { throw('The document is abandoned'); } catch(e) { } </script> 1429497 3 simon.fraser 2018-06-01 20:55:59 -0700 My heap inspector tool shows a reference chain thus: Exception (GC root—VM exceptions) -> Internal -> ProgramCodeBlock -> Internal -> Window -> Variable document -> HTMLDocument “file:///Volumes/Data/Development/apple/webkit/OpenSource/LayoutTests/fast/css/invalid-import-rule-insertion.html” m_vm->lastException() is a GC root (see slotVisitor.appendUnbarriered(m_vm->lastException()) in Heap.cpp). Seems like we should clear this at some point. 1429498 4 simon.fraser 2018-06-01 20:58:29 -0700 I guess we clear lastException() next time we run script (in the VMEntryScope constructor). 1429503 5 simon.fraser 2018-06-01 21:26:44 -0700 Maybe GCController should call clearLastException() in some code paths. 1429570 6 ggaren 2018-06-02 09:49:42 -0700 Two promising places to clear lastException: (1) ~JSLock() (2) A zero-delay timer The purpose of lastException is to provide an out-of-band accessor to the exception thrown by the current task / micro task. So, it's OK to throw it away after the task / micro task ends. 1429909 7 keith_miller 2018-06-04 14:45:54 -0700 *** This bug has been marked as a duplicate of bug 186277 ***