Bug 3856 – 16 byte leak each time HTMLCollectionImpl::resetCollectionInfo() is called

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: DOM

[Timothy Hatcher]

The linked page uses the children collection. This triggers a leak each time one of the collection items is 
accessed (since reset is called each time). Attached is a leaks output with the stack trace. Below is a short 
snip to aid in the search-ability of this info.

DOM::HTMLCollectionImpl::resetCollectionInfo() const | 
DOM::HTMLCollectionImpl::CollectionInfo::CollectionInfo[in-charge]() | KWQDictImpl::KWQDictImpl[in-
charge](int, bool, void (*)(void*)) | KWQPtrDictImpl::KWQPtrDictImpl[not-in-charge](int, void (*)(void*), 
CFDictionaryKeyCallBacks const*) | operator new(unsigned long) | malloc

[Timothy Hatcher]

Created attachment 2798 [details]
Leaks output from Safari

[Timothy Hatcher]

Custom built WebKit from TOT, July 4th 10:00 PM EST.

[Timothy Hatcher]

I have started a fix for this. Should have a patch tomorrow when I have more time to test.

[Timothy Hatcher]

Created attachment 2825 [details]
Fix for the leaks

Leaks were more extensive than initially thought. There were 2 NSCFDictionary
objects leaked, along with a few more ints, bools and long. A whole struct.

[Timothy Hatcher]

Comment on attachment 2825 [details]
Fix for the leaks

THis patch causes a crash. I will investigate further. Don't review/land!

[Timothy Hatcher]

Created attachment 2841 [details]
Crash that randomly happened

This is the crash I got randomly in a related area of my first patch.

The memory appears to be alloced and deleted correctly, accounting for the
possible shared collection info. Below is a log of the memory alloc and delete
process.

construct HTMLCollectionImpl(0x395c800) shared info(0x3a05bfc) type(13)
destruct HTMLCollectionImpl(0x395c800) kept info(0x3a05bfc)
construct HTMLCollectionImpl(0x395c800) blank info(0x0) type(14)
HTMLCollectionImpl(0x395c800) new info(0x56639a0) in
HTMLCollectionImpl::resetCollectionInfo()
construct HTMLCollectionImpl(0x143bec0) shared info(0x3a05bfc) type(13)
destruct HTMLCollectionImpl(0x143bec0) kept info(0x3a05bfc)
construct HTMLCollectionImpl(0x143bec0) blank info(0x0) type(14)
HTMLCollectionImpl(0x143bec0) new info(0x568b870) in
HTMLCollectionImpl::resetCollectionInfo()
construct HTMLCollectionImpl(0x396a8c0) blank info(0x0) type(14)
HTMLCollectionImpl(0x396a8c0) new info(0x1410c20) in
HTMLCollectionImpl::resetCollectionInfo()
construct HTMLCollectionImpl(0x567a0a0) blank info(0x0) type(14)
HTMLCollectionImpl(0x567a0a0) new info(0x39c6fe0) in
HTMLCollectionImpl::resetCollectionInfo()
construct HTMLCollectionImpl(0x140f8f0) blank info(0x0) type(14)
HTMLCollectionImpl(0x140f8f0) new info(0x56778c0) in
HTMLCollectionImpl::resetCollectionInfo()
construct HTMLCollectionImpl(0x1414320) blank info(0x0) type(14)
HTMLCollectionImpl(0x1414320) new info(0x5685dd0) in
HTMLCollectionImpl::resetCollectionInfo()
construct HTMLCollectionImpl(0x1455790) blank info(0x0) type(14)
HTMLCollectionImpl(0x1455790) new info(0x140f740) in
HTMLCollectionImpl::resetCollectionInfo()
construct HTMLCollectionImpl(0x5678570) blank info(0x0) type(14)
HTMLCollectionImpl(0x5678570) new info(0x56784f0) in
HTMLCollectionImpl::resetCollectionInfo()
construct HTMLCollectionImpl(0x140fab0) blank info(0x0) type(14)
HTMLCollectionImpl(0x140fab0) new info(0x56862b0) in
HTMLCollectionImpl::resetCollectionInfo()
construct HTMLCollectionImpl(0x1410b70) blank info(0x0) type(14)
HTMLCollectionImpl(0x1410b70) new info(0x567a260) in
HTMLCollectionImpl::resetCollectionInfo()
construct HTMLCollectionImpl(0x1424f70) blank info(0x0) type(14)
HTMLCollectionImpl(0x1424f70) new info(0x5691690) in
HTMLCollectionImpl::resetCollectionInfo()
construct HTMLCollectionImpl(0x5692e00) blank info(0x0) type(14)
HTMLCollectionImpl(0x5692e00) new info(0x5692360) in
HTMLCollectionImpl::resetCollectionInfo()
destruct HTMLCollectionImpl(0x395c800) deleted info(0x56639a0)
destruct HTMLCollectionImpl(0x143bec0) deleted info(0x568b870)
destruct HTMLCollectionImpl(0x396a8c0) deleted info(0x1410c20)
destruct HTMLCollectionImpl(0x567a0a0) deleted info(0x39c6fe0)
destruct HTMLCollectionImpl(0x140f8f0) deleted info(0x56778c0)
destruct HTMLCollectionImpl(0x1414320) deleted info(0x5685dd0)
destruct HTMLCollectionImpl(0x1455790) deleted info(0x140f740)
destruct HTMLCollectionImpl(0x5678570) deleted info(0x56784f0)
destruct HTMLCollectionImpl(0x140fab0) deleted info(0x56862b0)
destruct HTMLCollectionImpl(0x1410b70) deleted info(0x567a260)
destruct HTMLCollectionImpl(0x1424f70) deleted info(0x5691690)
destruct HTMLCollectionImpl(0x5692e00) deleted info(0x5692360)

[John Sullivan]

This might be the same as 4450, which Maciej recently fixed. You might want to get Maciej to confirm this 
so you don't spend too much time on it.

[John Sullivan]

Definitely the same as 4450, marking as duplicate.

*** This bug has been marked as a duplicate of 4450 ***