56045 2011-03-09 12:26:25 -0800 REGRESSION (r79781-r79968): Many leaks seen beneath JSWorkerContextBase and WorkerScriptController constructors (leaking a JSGlobalData/JSGlobalObject?) 2011-03-17 23:02:26 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED DUPLICATE 56619 http://build.webkit.org/LeaksViewer/?url=http://build.webkit.org/results/SnowLeopard%20Intel%20Leaks/r80646%20(15446)/DumpRenderTree12-leaks.txt InRadar P2 Normal --- 1 aroben webkit-unassigned ap barraclough dimich ggaren levin oliver oldest_to_newest 364689 0 aroben 2011-03-09 12:26:25 -0800 To see the leaks: 1. Go to http://build.webkit.org/LeaksViewer/?url=http://build.webkit.org/results/SnowLeopard%20Intel%20Leaks/r80646%20(15446)/DumpRenderTree12-leaks.txt 2. Select "Tree (Top Down)" at the bottom of the page 3. Sort by "Total" 4. Start digging in Pretty much all of the leaks seem to be beneath the JSWorkerContextBase and WorkerScriptController constructors. It looks like we're leaking a JSGlobalObject and a JSGlobalData. I don't know whether this is a regression. 364690 1 aroben 2011-03-09 12:26:59 -0800 <rdar://problem/9109988> 366131 2 aroben 2011-03-11 11:09:25 -0800 Looks like the leaks started happening in this range: http://build.webkit.org/builders/SnowLeopard%20Intel%20Leaks/builds/15150 http://build.webkit.org/builders/SnowLeopard%20Intel%20Leaks/builds/15280 366139 3 aroben 2011-03-11 11:16:35 -0800 Narrowed it down a little further: http://build.webkit.org/builders/SnowLeopard%20Intel%20Leaks/builds/15164 (good) http://build.webkit.org/builders/SnowLeopard%20Intel%20Leaks/builds/15255 (bad) 366141 4 aroben 2011-03-11 11:17:54 -0800 http://build.webkit.org/builders/SnowLeopard%20Intel%20Leaks/builds/15235 (bad) 366143 5 aroben 2011-03-11 11:18:27 -0800 http://build.webkit.org/builders/SnowLeopard%20Intel%20Leaks/builds/15220 (bad) 366152 6 aroben 2011-03-11 11:23:23 -0800 Looks like there were a lot of JSC changes in this period and no workers changes. 366158 7 levin 2011-03-11 11:27:38 -0800 fwiw it seems like all leaks were related to strings allocated for Identifier. I haven't been able to figure out where the ref count goes wrong on them yet (and likely won't have much time over the next few days to get further as I'm on tap to be the Chrome WebKit gardener for the next 4 working days). 366216 8 ap 2011-03-11 12:11:18 -0800 I briefly looked at Identifier string handling, and I don't see how strings are removed from HashSet. If we can get dangling pointers there, that would be pretty bad. 367164 9 aroben 2011-03-14 13:18:17 -0700 Looks like the leaks don't happen in every build: http://build.webkit.org/builders/SnowLeopard%20Intel%20Leaks/builds/15500 367177 10 ap 2011-03-14 13:29:10 -0700 See also: bug 56304. 367208 11 ap 2011-03-14 14:08:41 -0700 > I don't see how strings are removed from HashSet It's it StringImpl destructor: #if USE(JSC) if (isIdentifier()) { if (!wtfThreadData().currentIdentifierTable()->remove(this)) CRASH(); } #endif 367335 12 mrowe 2011-03-14 16:26:33 -0700 This also happens outside of the context of workers. <http://build.webkit.org/results/SnowLeopard%20Intel%20Leaks/r81055%20(15563)/DumpRenderTree14-leaks.txt> shows a number of leaks originating from DRT’s JavaScriptCore thread. 369515 13 ggaren 2011-03-17 23:02:26 -0700 *** This bug has been marked as a duplicate of bug 56619 ***