Created attachment 238016 [details] Crash log On the most recent build of iOS 8 (currently the GM release) Safari's tab process will crash when creating arrays (and possibly other regular objects as well). It seems that objects that no longer have references are not getting garbage collected and memory runs out. The attached URL will show how to crash it in an easy to understand manner. In this example a large array is created and setTimeout is called on the same function again. The large array in the old function should be gone when the setTimeout's call happens, yet when another array of that size is allocated the tab crashes with the attached crash log. The point of this is that things are not getting garbage collected it seems. You do not need a setTimeout. You could have a lot of allocations while nulling the previous arrays inline in a row and the crash will still occur. The size also doesn't seem to matter, just as long as the total amount of memory used in the end is more than the system has available.
The crash log doesn't imply any relationship to GC - seems like we are just crashing in JIT code. The fact that the test case is allocating memory seems unrelated to the crash.
Created attachment 238018 [details] HTML version of the test case
<rdar://problem/18328854>
(In reply to comment #3) > <rdar://problem/18328854> Can we know the current status of the above bug? This might be a wrong place to ask about iOS issues. But it would be helpful if we could discuss the bug someplace. Thanks.