Bug 75746 – [Qt] [WK2] Minibrowser leaks memory ~6-7Mb per reload

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit Qt

[Viatcheslav Ostapenko]

Valgrind memcheck run of Minibrowser with several reloads of http://google.com:

==17353== 81,106,512 (25,040 direct, 81,081,472 indirect) bytes in 313 blocks are definitely lost in loss record 628 of 628
==17353==    at 0x402641D: operator new(unsigned int) (vg_replace_malloc.c:255)
==17353==    by 0x895B20C: QImageData::create(QSize const&, QImage::Format, int) (qimage.cpp:187)
==17353==    by 0x895B8AC: QImage::QImage(int, int, QImage::Format) (qimage.cpp:766)
==17353==    by 0x895C2FC: QImage::copy(QRect const&) const (qimage.cpp:1126)
==17353==    by 0x45DDD0F: WebKit::LayerTreeHostProxy::updateTileForLayer(int, int, WebKit::UpdateInfo const&) (LayerTreeHostProxyQt.cpp:524)
==17353==    by 0x4665383: void CoreIPC::callMemberFunction<WebKit::LayerTreeHostProxy, void (WebKit::LayerTreeHostProxy::*)(int, int, WebKit::UpdateInfo const&), unsigned int, int, WebKit::UpdateInfo>(CoreIPC::Arguments3<unsigned int, int, WebKit::UpdateInfo> const&, WebKit::LayerTreeHostProxy*, void (WebKit::LayerTreeHostProxy::*)(int, int, WebKit::UpdateInfo const&)) (HandleMessage.h:31)
==17353==    by 0x4665028: void CoreIPC::handleMessage<Messages::LayerTreeHostProxy::UpdateTileForLayer, WebKit::LayerTreeHostProxy, void (WebKit::LayerTreeHostProxy::*)(int, int, WebKit::UpdateInfo const&)>(CoreIPC::ArgumentDecoder*, WebKit::LayerTreeHostProxy*, void (WebKit::LayerTreeHostProxy::*)(int, int, WebKit::UpdateInfo const&)) (HandleMessage.h:277)
==17353==    by 0x4664C2B: WebKit::LayerTreeHostProxy::didReceiveLayerTreeHostProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) (LayerTreeHostProxyMessageReceiver.cpp:56)
==17353==    by 0x45C6BA0: WebKit::DrawingAreaProxyImpl::didReceiveLayerTreeHostProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) (DrawingAreaProxyImpl.cpp:356)
==17353==    by 0x44B2C2E: WebKit::WebPageProxy::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) (WebPageProxy.cpp:1629)
==17353==    by 0x44EDE44: WebKit::WebProcessProxy::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) (WebProcessProxy.cpp:307)
==17353==    by 0x459BFA5: CoreIPC::Connection::dispatchMessage(CoreIPC::Connection::Message<CoreIPC::ArgumentDecoder>&) (Connection.cpp:689)

1. Problem is regression from r103760, which removes setting of m_layerTreeTileClient in WebGraphicsLayer and this way m_layerTreeTileClient->didDeleteLayer(id()) is never called in ~WebGraphicsLayer() .
2. UpdateTileMessageData structure is never destructed after processing in LayerTreeHostProxy::syncRemoteContent(). If I add ~UpdateTileMessageData() it never gets called from LayerTreeHostProxy::syncRemoteContent().

[Viatcheslav Ostapenko]

Created attachment 121505 [details]
Patch

[Noam Rosenthal]

Comment on attachment 121505 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=121505&action=review

> Source/WebKit2/ChangeLog:8
> +        Revert r103760 because it causes leak of GraphicsLayerTextureMapper 
> +        objects on UI side and reset WebGraphicsLayer::m_layerTreeTileClient 
> +        of all dependent layers from ~LayerTreeHostQt().

This is more than a revert :)
Changelog should explain that it fixes the original bug from 103760 in a way that doesn't create leaks.

> Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.cpp:621
> +    if (m_layerTreeTileClient != client) {
> +        for (size_t i = 0; i < children().size(); ++i) {

Early return

[Viatcheslav Ostapenko]

Created attachment 121513 [details]
Updated patch.

[WebKit Review Bot]

Comment on attachment 121513 [details]
Updated patch.

Clearing flags on attachment: 121513

Committed r104370: <http://trac.webkit.org/changeset/104370>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.