Bug 176269 – Performance / PerformanceObserver leaks seen on bots

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Joseph Pecoraro]

Performance / PerformanceObserver leaks seen on bots

Steps to reproduce:
1. $ run-webkit-tests --leaks performance-api -1
  => Leaks

Leaks:

> Leak: 0x7ff45552af20  size=224  zone: WebKit Using System Malloc_0x10d333000   WebCore::Performance  C++  WebCore
> 	0x0ba9b348 0x00000001 0x00000000 0x00000000 	H...............
> 	0x00000001 0xaaaaaaaa 0x0ba9b390 0x00000001 	................
> 	0x00000000 0x00000000 0x5552af58 0x00007ff4 	........X.RU....
> 	0x00000002 0x00000000 0xaaaaaaaa 0xaaaaaaaa 	................
> 	0xaaaaaaaa 0xaaaaaaaa 0xaaaaaaaa 0xaaaaaaaa 	................
> 	0xaaaaaaaa 0xaaaaaaaa 0xaaaaaa00 0xaaaaaaaa 	................
> 	0xaaaaaa00 0xaaaaaaaa 0x00000000 0x00000000 	................
> 	0x00000000 0x00000000 0x00000000 0x00000000 	................
> 	...
> 	Call stack: [thread 0x700004870000]: 
>         | thread_start 
>         | _pthread_body 
>         | _pthread_body 
>         | WTF::wtfThreadEntryPoint(void*) ThreadingPthreads.cpp:229 
>         | WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) memory:2602 
>         | WebCore::WorkerThread::workerThread() WorkerThread.cpp:163 
>         | WebCore::DedicatedWorkerThread::createWorkerGlobalScope(WebCore::URL const&, WTF::String const&, WTF::String const&, WebCore::ContentSecurityPolicyResponseHeaders const&, bool, WTF::Ref<WebCore::SecurityOrigin>&&, WTF::MonotonicTime, PAL::SessionID) DedicatedWorkerThread.cpp:53 
>         | WebCore::DedicatedWorkerGlobalScope::create(WebCore::URL const&, WTF::String const&, WTF::String const&, WebCore::DedicatedWorkerThread&, WebCore::ContentSecurityPolicyResponseHeaders const&, bool, WTF::Ref<WebCore::SecurityOrigin>&&, WTF::MonotonicTime, WebCore::IDBClient::IDBConnectionProxy*, WebCore::SocketProvider*, PAL::SessionID) DedicatedWorkerGlobalScope.cpp:53 
>         | WebCore::WorkerGlobalScope::WorkerGlobalScope(WebCore::URL const&, WTF::String const&, WTF::String const&, WebCore::WorkerThread&, bool, WTF::Ref<WebCore::SecurityOrigin>&&, WTF::MonotonicTime, WebCore::IDBClient::IDBConnectionProxy*, WebCore::SocketProvider*, PAL::SessionID) RefCounted.h:140 
>         | WTF::fastMalloc(unsigned long) FastMalloc.cpp:258 
>         | bmalloc::DebugHeap::malloc(unsigned long) DebugHeap.cpp:49 
>         | malloc_zone_malloc 
> 
> Leak: 0x7ff4555471a0  size=64  zone: WebKit Using System Malloc_0x10d333000
> 	0x00000000 0x00000000 0x00000000 0x00000000 	................
> 	0x00000000 0x00000000 0x00000000 0x00000000 	................
> 	0x00000000 0x00000000 0xffffffff 0xffffffff 	................
> 	0x5554fa50 0x00007ff4 0x00000000 0x00000000 	P.TU............
> 	Call stack: [thread 0x700004870000]: 
>         | thread_start 
>         | _pthread_body 
>         | _pthread_body 
>         | WTF::wtfThreadEntryPoint(void*) ThreadingPthreads.cpp:229 
>         | WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) memory:2602 
>         | WebCore::WorkerThread::workerThread() utility:889 
>         | WebCore::WorkerScriptController::evaluate(WebCore::ScriptSourceCode const&) WorkerScriptController.cpp:110 
>         | WebCore::WorkerScriptController::evaluate(WebCore::ScriptSourceCode const&, WTF::NakedPtr<JSC::Exception>&) WorkerScriptController.cpp:0 
>         | JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) Completion.cpp:102 
>         | JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) Interpreter.cpp:912 
>         | JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) JITCode.cpp:82 
>         | vmEntryToJavaScript LowLevelInterpreter64.asm:258 
>         | llint_entry LowLevelInterpreter.asm:789 
>         | 0x5c0607c0c368 
>         | WebCore::jsPerformanceObserverPrototypeFunctionObserve(JSC::ExecState*) ExceptionOr.h:162 
>         | WebCore::PerformanceObserver::observe(WebCore::PerformanceObserver::Init&&) PerformanceObserver.cpp:72 
>         | WebCore::Performance::registerPerformanceObserver(WebCore::PerformanceObserver&) utility:889 
>         | WTF::ListHashSet<WTF::RefPtr<WebCore::PerformanceObserver>, WTF::PtrHash<WTF::RefPtr<WebCore::PerformanceObserver> > >::add(WTF::RefPtr<WebCore::PerformanceObserver>&&) HashTable.h:1196 
>         | WTF::fastZeroedMalloc(unsigned long) Allocator.h:91 
>         | bmalloc::DebugHeap::malloc(unsigned long) DebugHeap.cpp:49 
>         | malloc_zone_malloc 

Notes:

  Performance has:
      ListHashSet<RefPtr<PerformanceObserver>> m_observers;

  PerformanceObserver has:
      RefPtr<Performance> m_performance;

This appears to be a cycle between these RefCounted objects. We have to break that cycle at some point.

It seems a time similar to removeAllEventListeners() would be appropriate.

[Joseph Pecoraro]

Created attachment 319691 [details]
[PATCH] Proposed Fix

[WebKit Commit Bot]

Comment on attachment 319691 [details]
[PATCH] Proposed Fix

Clearing flags on attachment: 319691

Committed r221539: <http://trac.webkit.org/changeset/221539>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/34693742>