[V8] HTML attribute listeners leak memory.

[Vitaly Repeshko]

[V8] HTML attribute listeners leak memory.

Creating DOM elements using innerHTML with listeners will leak memory in case these listeners are invoked at least once.

function leak() {
  var node = document.createElement("span");
  node.innerHTML = "<span onclick=''></span>";
  node.childNodes[0].onclick();  // (*)
}

If you remove (*) line everything is back to normal. The cycle looks like this:

  C++ Span Element <---------------------- JS node wrapper
        |                                        ^
        v                                        |
V8LazyEventListener --[strong handle]--> JS function (onclick)

The reference between JS function and JS wrapper gets created in V8LazyEventListener when it lazily compiles the function. This is very similar to http://crbug.com/17400 but with a different C++ listener type.

This can be fixed like http://crbug.com/17400 by making the handle in V8LazyEventListener weak and adding a hidden dependency from JS wrapper to JS function to prevent the function from being collected.

[Vitaly Repeshko]

Created attachment 39277 [details]
Test page to demonstrate the leak.

[Brian Burg]

Closing some V8-related work items.