Bug 55899 – [Chromium] Detached DOM trees leak because of CSSStyleDeclaration wrapper sharing

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit Misc.

[Mikhail Naganov]

A common pattern of detached DOM trees leak is observed. The common repro scenario is like this: an application sets a style value on some node, then a whole DOM subtree to which this node belongs stays uncollected, even after being detached from the document.

This happens because V8 object group for the node includes CSSStyleDeclaration wrapper, which participates in two object groups -- the node group, and the group containing all style declarations. The latter group is thus held by any DOM subtree, including the document object group, and it effectively prevents all other object groups from being collected. Graphically the situation looks like this:

   Document DOM tree <--> CSSStyleDeclaration <--> Group with style decls. <--> CSSStyleDeclaration <--> Detached DOM subtree

Thanks to Rick Byers for providing the example.

[Mikhail Naganov]

Created attachment 84974 [details]
repro page

[anton muhin]

Should be fixed now.  See https://bugs.webkit.org/show_bug.cgi?id=56117 for more details.