Bug 119049 - JavaScriptCore Doesn't GC Typed Arrays
Summary: JavaScriptCore Doesn't GC Typed Arrays
Status: RESOLVED DUPLICATE of bug 119064
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Macintosh OS X 10.8
: P2 Normal
Assignee: Nobody
URL: http://people.cs.umass.edu/~jvilk/saf...
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2013-07-24 10:41 PDT by John Vilk
Modified: 2013-07-24 14:55 PDT (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Vilk 2013-07-24 10:41:29 PDT
Summary:

Safari does not appear to garbage collect typed arrays / ArrayBuffers. Once allocated, they remain a part of Safari's memory footprint, even when they are no longer reachable by the JavaScript program. As a result, a web page that makes regular use of typed arrays can crash Safari through a series of allocations.

I am unsure of which version of JavaScriptCore/WebKit is applicable. I am using the latest Safari on Mountain Lion.

Steps to Reproduce:

1) Visit http://people.cs.umass.edu/~jvilk/safari-crash.html
2) Click on one of the buttons in Safari.

(Or more generally)

1) Repeatedly allocate a 1MB ArrayBuffer to the same variable a large number of times (such that you allocate more than your system's memory). Each allocation should make the previous allocation unreachable.

Expected Results:

Safari does not freeze. The page pops up an alert with either "Congratulations, your browser didn't crash! Check your memory usage, though.", or "Looks like your browser limits how much we allocate. Received the following exception: [exception text]".

Actual Results:

Safari uses all system memory, starts swapping to disk, and either becomes completely unresponsive or crashes.
Comment 1 Geoffrey Garen 2013-07-24 10:58:04 PDT
<rdar://problem/14535469>
Comment 2 Alexey Proskuryakov 2013-07-24 11:12:34 PDT
See also: bug 118223, bug 114824.
Comment 3 Filip Pizlo 2013-07-24 14:55:36 PDT
I'm so over our typed array implementation.
Comment 4 Filip Pizlo 2013-07-24 14:55:47 PDT

*** This bug has been marked as a duplicate of bug 119064 ***