29093 2009-09-09 10:29:58 -0700 [V8] HTML attribute listeners leak memory. 2014-12-16 00:48:28 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) PC All RESOLVED INVALID P2 Normal --- 0 vitalyr webkit-unassigned dglazkov oldest_to_newest 145824 0 vitalyr 2009-09-09 10:29:58 -0700 [V8] HTML attribute listeners leak memory. Creating DOM elements using innerHTML with listeners will leak memory in case these listeners are invoked at least once. function leak() { var node = document.createElement("span"); node.innerHTML = "<span onclick=''></span>"; node.childNodes[0].onclick(); // (*) } If you remove (*) line everything is back to normal. The cycle looks like this: C++ Span Element <---------------------- JS node wrapper | ^ v | V8LazyEventListener --[strong handle]--> JS function (onclick) The reference between JS function and JS wrapper gets created in V8LazyEventListener when it lazily compiles the function. This is very similar to http://crbug.com/17400 but with a different C++ listener type. This can be fixed like http://crbug.com/17400 by making the handle in V8LazyEventListener weak and adding a hidden dependency from JS wrapper to JS function to prevent the function from being collected. 145826 1 39277 vitalyr 2009-09-09 10:32:07 -0700 Created attachment 39277 Test page to demonstrate the leak. 1055951 2 burg 2014-12-16 00:48:28 -0800 Closing some V8-related work items. 39277 2009-09-09 10:32:07 -0700 2009-09-09 10:32:07 -0700 Test page to demonstrate the leak. leak.html text/html 335 vitalyr PGh0bWw+CjxoZWFkPgo8L2hlYWQ+Cjxib2R5Pgo8c2NyaXB0PgpmdW5jdGlvbiBsZWFrT25lKCkg ewogIHZhciBub2RlID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic3BhbiIpOwogIG5vZGUuaW5u ZXJIVE1MID0gIjxzcGFuIG9uY2xpY2s9Jyc+PC9zcGFuPiI7CiAgbm9kZS5jaGlsZE5vZGVzWzBd Lm9uY2xpY2soKTsKfQpmdW5jdGlvbiBsZWFrKCkgewogIGZvciAodmFyIGkgPSAwOyBpIDwgMTAw MDA7ICsraSkgbGVha09uZSgpOwp9Cjwvc2NyaXB0PgoKPGlucHV0IHR5cGU9ImJ1dHRvbiIgdmFs dWU9IkxlYWsgTW9yZSIgb25jbGljaz0ibGVhaygpIj4KCjwvYm9keT4KPC9odG1sPgo=