Bug 24806

Summary: addEventListener to node with closure+circular ref leaks DOM nodes
Product: WebKit Reporter: Greg <280lifestyle>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: UNCONFIRMED ---    
Severity: Normal CC: ddkilzer, emacemac7, ggaren, pam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   

Description Greg 2009-03-25 10:37:43 PDT 
The following JS leaks DOM nodes until the document is thrown away. Safari 4, also tested with Chrome 1.x/v8 which shows the same behavior.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
  "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
  <title>listTest</title>

  <script type="text/javascript" charset="utf-8">
				
		makeClosure= function(object) {
		  return function() {
		    return object;
		  }
		};
		
		gIntervalCount = 0;

		myLeakyFunc = function() {		
			var i, widget;
			
			console.log("myLeakyFunc: "+gIntervalCount++);
			
			for(i=0; i<1000; i++) {
				
				// The leak seems to be caused by an event listener on a node, 
				// where the listener's closure has a circular reference to the node.
				widget = document.createElement('div');
				widget.addEventListener('whatever', makeClosure(widget), false);
				
				// Adding some extra chold nodes to the leaked div makes the memory leak more apparent, but is not necessary.
				widget.innerHTML = '<div></div><div></div><div></div><div></div><div></div><div></div><div></div><div></div>';				
			}
		}

		window.setInterval(myLeakyFunc, 500);

  </script>
</head>

<body>
</body>
</html>
Comment 1 Greg 2009-03-25 10:38:17 PDT 
Does not leak in Firefox 3.x
Comment 2 David Kilzer (:ddkilzer) 2009-03-25 15:14:03 PDT 
Looks like a duplicate of Bug 21260.
Comment 3 David Kilzer (:ddkilzer) 2009-04-06 15:10:08 PDT 
Geoff, was this fixed by Bug 21260?

http://trac.webkit.org/changeset/42256