Bug 313364
| Summary: | REGRESSION (304469@main): WTR::supportedAttributes() leaks NSMutableArray | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | David Kilzer (:ddkilzer) <ddkilzer> |
| Component: | Accessibility | Assignee: | David Kilzer (:ddkilzer) <ddkilzer> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | andresg_22, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar, Regression |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Bug Depends on: | 304071 | ||
| Bug Blocks: | |||
David Kilzer (:ddkilzer)
`WTR::supportedAttributes()` in `AccessibilityUIElementMac.mm` leaks an `NSMutableArray` on every call. The function assigns the result of `-[NSArray mutableCopy]` directly to a `RetainPtr<NSMutableArray>` without wrapping it in `adoptNS()`. Since `-mutableCopy` returns a +1 (retained) object and `RetainPtr::operator=` retains again, the array ends up at +2. When the `RetainPtr` destructor releases once, the array is left at +1 -- leaked.
The leak was introduced in Bug 304071 (304469@main) which changed `supportedAttributes()` from returning a plain `RetainPtr<NSArray>` (assigned from `-accessibilityAttributeNames`, a +0 return) to a `RetainPtr<NSMutableArray>` (assigned from `-mutableCopy`, a +1 return) without adding `adoptNS()`.
The leak is visible when running layout tests with `--leaks`. Each call to `supportedAttributes()` leaks one 64-byte `NSMutableArray` plus its 512-byte backing storage.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/175635842>
David Kilzer (:ddkilzer)
Pull request: https://github.com/WebKit/WebKit/pull/63643
EWS
Committed 312056@main (9323616ae50b): <https://commits.webkit.org/312056@main>
Reviewed commits have been landed. Closing PR #63643 and removing active labels.