Bug 208324 – CSSCalcOperationNode objects are leaking on CNN.com

• Status: NEW
• Component: CSS

[Chris Dumez]

CSSCalcOperationNode objects are leaking on CNN.com.

Steps to reproduce:
1. Add some logging in CSSCalcOperationNode constructors / destructor with a static count to log how many objects are alive
2. Visit cnn.com and wait ~10 seconds
3. Navigate tab to about:blank
4. Send memory pressure signal (notifyutil -p org.WebKit.lowMemory)
-> Notice that some of the CSSCalcOperationNode stay around (but many of them do get destroyed)

[Chris Dumez]

It looks like they usually get destroy via a call to CSSValue::destroy():
1   0x107fd65ac WebCore::CSSCalcOperationNode::~CSSCalcOperationNode()
2   0x108028f50 WebCore::CSSValue::destroy()
3   0x10800fc98 WebCore::CSSPrimitiveValue::cleanup()
4   0x108028da1 WebCore::CSSValue::destroy()
5   0x108062801 WebCore::StylePropertiesBase::deref() const
6   0x10805f798 WebCore::StyleRuleBase::destroy()
7   0x10805f9bb WebCore::StyleRuleBase::destroy()
8   0x108064dd5 WebCore::StyleSheetContents::clearRules()
9   0x108064903 WebCore::StyleSheetContents::~StyleSheetContents()
10  0x10801dc2a WebCore::CSSStyleSheet::~CSSStyleSheet()
11  0x10801dc6e WebCore::CSSStyleSheet::~CSSStyleSheet()
12  0x108b3a7ab WebCore::Style::Scope::~Scope()
13  0x10810d2cc WebCore::Document::~Document()
14  0x1082eef0e WebCore::HTMLDocument::~HTMLDocument()
15  0x10818688f WebCore::Node::~Node()
16  0x1080effc9 WebCore::ContainerNode::~ContainerNode()
17  0x10837ce5a WebCore::HTMLScriptElement::~HTMLScriptElement()

It does not look like CSSValue objects are leaking though.

[Chris Dumez]

Hierarchy:
CSSCalcOperationNode -> CSSCalcExpressionNode -> RefCounted<CSSCalcExpressionNode>

[Chris Dumez]

(In reply to Chris Dumez from comment #1)
> It looks like they usually get destroy via a call to CSSValue::destroy():
> 1   0x107fd65ac WebCore::CSSCalcOperationNode::~CSSCalcOperationNode()
> 2   0x108028f50 WebCore::CSSValue::destroy()
> 3   0x10800fc98 WebCore::CSSPrimitiveValue::cleanup()
> 4   0x108028da1 WebCore::CSSValue::destroy()
> 5   0x108062801 WebCore::StylePropertiesBase::deref() const
> 6   0x10805f798 WebCore::StyleRuleBase::destroy()
> 7   0x10805f9bb WebCore::StyleRuleBase::destroy()
> 8   0x108064dd5 WebCore::StyleSheetContents::clearRules()
> 9   0x108064903 WebCore::StyleSheetContents::~StyleSheetContents()
> 10  0x10801dc2a WebCore::CSSStyleSheet::~CSSStyleSheet()
> 11  0x10801dc6e WebCore::CSSStyleSheet::~CSSStyleSheet()
> 12  0x108b3a7ab WebCore::Style::Scope::~Scope()
> 13  0x10810d2cc WebCore::Document::~Document()
> 14  0x1082eef0e WebCore::HTMLDocument::~HTMLDocument()
> 15  0x10818688f WebCore::Node::~Node()
> 16  0x1080effc9 WebCore::ContainerNode::~ContainerNode()
> 17  0x10837ce5a WebCore::HTMLScriptElement::~HTMLScriptElement()
> 
> It does not look like CSSValue objects are leaking though.

Actually, CSSCalcValue objects seem to be leaking too, and they hold on to CSSCalcOperationNode objects.

[Chris Dumez]

(In reply to Chris Dumez from comment #3)
> (In reply to Chris Dumez from comment #1)
> > It looks like they usually get destroy via a call to CSSValue::destroy():
> > 1   0x107fd65ac WebCore::CSSCalcOperationNode::~CSSCalcOperationNode()
> > 2   0x108028f50 WebCore::CSSValue::destroy()
> > 3   0x10800fc98 WebCore::CSSPrimitiveValue::cleanup()
> > 4   0x108028da1 WebCore::CSSValue::destroy()
> > 5   0x108062801 WebCore::StylePropertiesBase::deref() const
> > 6   0x10805f798 WebCore::StyleRuleBase::destroy()
> > 7   0x10805f9bb WebCore::StyleRuleBase::destroy()
> > 8   0x108064dd5 WebCore::StyleSheetContents::clearRules()
> > 9   0x108064903 WebCore::StyleSheetContents::~StyleSheetContents()
> > 10  0x10801dc2a WebCore::CSSStyleSheet::~CSSStyleSheet()
> > 11  0x10801dc6e WebCore::CSSStyleSheet::~CSSStyleSheet()
> > 12  0x108b3a7ab WebCore::Style::Scope::~Scope()
> > 13  0x10810d2cc WebCore::Document::~Document()
> > 14  0x1082eef0e WebCore::HTMLDocument::~HTMLDocument()
> > 15  0x10818688f WebCore::Node::~Node()
> > 16  0x1080effc9 WebCore::ContainerNode::~ContainerNode()
> > 17  0x10837ce5a WebCore::HTMLScriptElement::~HTMLScriptElement()
> > 
> > It does not look like CSSValue objects are leaking though.
> 
> Actually, CSSCalcValue objects seem to be leaking too, and they hold on to
> CSSCalcOperationNode objects.

And those CSSCalcValue objects seem to be held by CSSPrimitiveValue objects which are also not getting destroyed.

[Chris Dumez]

(In reply to Chris Dumez from comment #4)
> (In reply to Chris Dumez from comment #3)
> > (In reply to Chris Dumez from comment #1)
> > > It looks like they usually get destroy via a call to CSSValue::destroy():
> > > 1   0x107fd65ac WebCore::CSSCalcOperationNode::~CSSCalcOperationNode()
> > > 2   0x108028f50 WebCore::CSSValue::destroy()
> > > 3   0x10800fc98 WebCore::CSSPrimitiveValue::cleanup()
> > > 4   0x108028da1 WebCore::CSSValue::destroy()
> > > 5   0x108062801 WebCore::StylePropertiesBase::deref() const
> > > 6   0x10805f798 WebCore::StyleRuleBase::destroy()
> > > 7   0x10805f9bb WebCore::StyleRuleBase::destroy()
> > > 8   0x108064dd5 WebCore::StyleSheetContents::clearRules()
> > > 9   0x108064903 WebCore::StyleSheetContents::~StyleSheetContents()
> > > 10  0x10801dc2a WebCore::CSSStyleSheet::~CSSStyleSheet()
> > > 11  0x10801dc6e WebCore::CSSStyleSheet::~CSSStyleSheet()
> > > 12  0x108b3a7ab WebCore::Style::Scope::~Scope()
> > > 13  0x10810d2cc WebCore::Document::~Document()
> > > 14  0x1082eef0e WebCore::HTMLDocument::~HTMLDocument()
> > > 15  0x10818688f WebCore::Node::~Node()
> > > 16  0x1080effc9 WebCore::ContainerNode::~ContainerNode()
> > > 17  0x10837ce5a WebCore::HTMLScriptElement::~HTMLScriptElement()
> > > 
> > > It does not look like CSSValue objects are leaking though.
> > 
> > Actually, CSSCalcValue objects seem to be leaking too, and they hold on to
> > CSSCalcOperationNode objects.
> 
> And those CSSCalcValue objects seem to be held by CSSPrimitiveValue objects
> which are also not getting destroyed.

Hmm. Even though they are reported as leaked by the leaks tool, it could be that those are static. The number of "leaked" CSSCalcOperationNode objects is 16 on my machine and does not grow, even if I keep visiting new cnn.com pages.
Hopefully it makes sense to Simon. It looks like it may not be a true leak though.