Bug 83823 – StructureStubInfo::reset() causes leaks of PolymorphicAccessStructureList and ExecutableMemoryHandle objects

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

The current implementation of StructureStubInfo::reset() causes leaks.

        void reset()
        {
            accessType = access_unset;
            deref();
            stubRoutine = MacroAssemblerCodeRef();
        }

deref() depends on accessType to delete referenced objects, but clearing of accessType to access_unset eliminate these delete calls.

The fix is to change the order of the two statements.

This can lead to large (100KB) leaks of PolymorphicAccessStructureList and ExecutableMemoryHandle objects.  From looking at the code it can also lead to PolymorphicPutByIdList leaks as well, but these haven't been observed.

[Michael Saboff]

Created attachment 136978 [details]
Patch

[WebKit Review Bot]

Comment on attachment 136978 [details]
Patch

Rejecting attachment 136978 [details] from commit-queue.

New failing tests:
svg/transforms/text-with-mask-with-svg-transform.svg
Full output: http://queues.webkit.org/results/12396443

[WebKit Review Bot]

Created attachment 136997 [details]
Archive of layout-test-results from ec2-cq-02

The attached test failures were seen while running run-webkit-tests on the commit-queue.
Bot: ec2-cq-02  Port: <class 'webkitpy.common.config.ports.ChromiumXVFBPort'>  Platform: Linux-2.6.35-28-virtual-x86_64-with-Ubuntu-10.10-maverick

[Michael Saboff]

(In reply to comment #2)
> (From update of attachment 136978 [details])
> Rejecting attachment 136978 [details] from commit-queue.
> 
> New failing tests:
> svg/transforms/text-with-mask-with-svg-transform.svg
> Full output: http://queues.webkit.org/results/12396443

THere is no reason that this change should cause this failure.  The change is in JSC JIT code which chromium doesn't use.  Checking in manually.

[Michael Saboff]

Committed r114052: <http://trac.webkit.org/changeset/114052>