Bug 22753 – Reproducible global object leak caused by setInterval

• Component: WebCore JavaScript
• Status: RESOLVED FIXED

[Oliver Hunt]

I have discovered a reproducible global object leak (a valuable property of our GC: when you leak a global object, it takes very little time for maths to become ludicrously expensive and my browsing patterns show tihs really quickly.  Because all i look at are js raytracers :D )

Steps to reproduce:
1. Start webkit
2. Open caches window
3. Navigate to http://ejohn.org/apps/processing.js/examples/basic/noisewave.html
4. Navigate to another page (say google.com)
5. Close browser window
6. Force GC a few times

Results:
We end up with 2 global objects leaked, probably due to the one protected function that hangs around indefinitely. The global object contained by that function, then history probably holds onto all the other global objects, and subsequently everything else.

[Oliver Hunt]

<rdar://problem/6429894>

[Alexey Proskuryakov]

What version of WebKit are you seeing this with?

[Oliver Hunt]

r39131, but i was seeing this from a revision earlier today and updated to verify it still existed in tot

[Alexey Proskuryakov]

The leaking protected object is a setInterval() callback in processing.js. There is no leak in r38860, so this is likely to be a regression from DOMTimer refactoring.

[Alexey Proskuryakov]

Created attachment 25879 [details]
reduction

[Dmitry Titov]

Not enough calls to stopActiveDOMObjects().
In this case, the suspended CachedPages are cleared when window is closed. This code path never calls stopActiveDOMObjects() and it caused live JS wrappers to stay alive.
After window close, the cached pages are cleared and it seems Document::detach() is a good place to stop active objects. I hope documents can not 'attach' back.

[Dmitry Titov]

Created attachment 25883 [details]
Proposed patch

[Dmitry Titov]

Working on a test. Will add as a separate patch.

[Dmitry Titov]

Can't create a test because DumpRenderTree has the page cache disabled. The known way to repro the leak is when CachedPages are destroyed.

[Darin Adler]

Comment on attachment 25883 [details]
Proposed patch

Is it correct behavior to stop XMLHttpRequest in this case?

I'll assume the answer is yes and say r=me

[Oliver Hunt]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	WebCore/ChangeLog
	M	WebCore/dom/Document.cpp
Committed r39193

[Dmitry Titov]

added a regression test - bug 22806