68469 - Stream Proxy Objects Leak

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[Doug Turner (:dougt)]

Tinderbox reports 80k of leaks after I landed.  I traced this back to cycles in 
the Stream Proxy Objects, however, I could not identify the best place to break 
them.

It looks like the proxy holds on to the pipe which holds on to proxy.  Also, 
there may be another between the file transport and the proxy.


Object 131 held by 0x08565144 is 1 out of balance.

Put into nsCOMPtr at:
nsCOMPtr<nsIInputStreamObserver>::assign_assuming_AddRef(nsIInputStreamObserver 
*)+0x0000002D [/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so +0x001053ED]
nsCOMPtr<nsIInputStreamObserver>::assign_with_AddRef(nsISupports *)+0x00000038 
[/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so +0x00105474]
nsCOMPtr<nsIInputStreamObserver>::operator=(nsIInputStreamObserver *)+0x0000001F 
[/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so +0x00105BAF]
nsPipe::nsPipeInputStream::SetObserver(nsIInputStreamObserver *)+0x00000022 
[/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so +0x000A3B0E]
nsStreamListenerProxy::Init(nsIStreamListener *, nsIEventQueue *, unsigned int, 
unsigned int)+0x00000180 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libnecko.so +0x0008F264]
NS_NewStreamListenerProxy(nsIStreamListener **, nsIStreamListener *, 
nsIEventQueue *, unsigned int, unsigned int)+0x00000116 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libnecko.so +0x00118526]
nsFileTransport::AsyncRead(nsIStreamListener *, nsISupports *, unsigned int, 
unsigned int, unsigned int, nsIRequest **)+0x000000D8 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libnecko.so +0x00089D50]
nsJARChannel::AsyncReadJARElement(void)+0x00000352 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libnecko.so +0x00100B32]
nsJARChannel::OnDownloadComplete(nsIDownloader *, nsISupports *, unsigned int, 
nsIFile *)+0x000000AA 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libnecko.so +0x00101476]
XPTC_InvokeByIndex+0x0000007D [/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so 
+0x000E3275]
nsProxyObject::Post(unsigned int, nsXPTMethodInfo *, nsXPTCMiniVariant *, 
nsIInterfaceInfo *)+0x000003C0 
[/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so +0x000C8E90]
PL_HandleEvent+0x00000056 [/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so 
+0x000C11EE]
PL_ProcessPendingEvents+0x000000D0 
[/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so +0x000C100C]
nsEventQueueImpl::ProcessPendingEvents(void)+0x00000071 
[/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so +0x000C2F39]
nsAppShell::SetDispatchListener(nsDispatchListener *)+0x0000003C 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libwidget_gtk.so +0x0003DAF4]
keysym2ucs+0x0000015F 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libwidget_gtk.so +0x0003D72F]
g_io_add_watch+0x000000AA [/usr/lib/libglib-1.2.so.0 +0x0000EACA]
g_get_current_time+0x00000136 [/usr/lib/libglib-1.2.so.0 +0x00010186]
g_get_current_time+0x00000701 [/usr/lib/libglib-1.2.so.0 +0x00010751]
g_main_run+0x00000081 [/usr/lib/libglib-1.2.so.0 +0x000108F1]
gtk_main+0x000000B9 [/usr/lib/libgtk-1.2.so.0 +0x0008C5B9]
nsAppShell::Run(void)+0x00000052 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libwidget_gtk.so +0x0003E1EA]
nsAppShellService::Run(void)+0x0000003C 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libnsappshell.so +0x00043134]
UNKNOWN 0x8056703
UNKNOWN 0x80573ca
__libc_start_main+0x000000FF [/lib/libc.so.6 +0x000189CB]



Object 131 held by 0x0853D564 is 1 out of balance.

Put into nsCOMPtr at:
nsGetterAddRefs<nsIStreamListener>::~nsGetterAddRefs(void)+0x00000051 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libnecko.so +0x00117C11]
nsFileTransport::AsyncRead(nsIStreamListener *, nsISupports *, unsigned int, 
unsigned int, unsigned int, nsIRequest **)+0x000000EB 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libnecko.so +0x00089D63]
nsJARChannel::AsyncReadJARElement(void)+0x00000352 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libnecko.so +0x00100B32]
nsJARChannel::OnDownloadComplete(nsIDownloader *, nsISupports *, unsigned int, 
nsIFile *)+0x000000AA 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libnecko.so +0x00101476]
XPTC_InvokeByIndex+0x0000007D [/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so 
+0x000E3275]
nsProxyObject::Post(unsigned int, nsXPTMethodInfo *, nsXPTCMiniVariant *, 
nsIInterfaceInfo *)+0x000003C0 
[/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so +0x000C8E90]
PL_HandleEvent+0x00000056 [/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so 
+0x000C11EE]
PL_ProcessPendingEvents+0x000000D0 
[/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so +0x000C100C]
nsEventQueueImpl::ProcessPendingEvents(void)+0x00000071 
[/builds2/dougt/trunk/mozilla/dist/bin/libxpcom.so +0x000C2F39]
nsAppShell::SetDispatchListener(nsDispatchListener *)+0x0000003C 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libwidget_gtk.so +0x0003DAF4]
keysym2ucs+0x0000015F 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libwidget_gtk.so +0x0003D72F]
g_io_add_watch+0x000000AA [/usr/lib/libglib-1.2.so.0 +0x0000EACA]
g_get_current_time+0x00000136 [/usr/lib/libglib-1.2.so.0 +0x00010186]
g_get_current_time+0x00000701 [/usr/lib/libglib-1.2.so.0 +0x00010751]
g_main_run+0x00000081 [/usr/lib/libglib-1.2.so.0 +0x000108F1]
gtk_main+0x000000B9 [/usr/lib/libgtk-1.2.so.0 +0x0008C5B9]
nsAppShell::Run(void)+0x00000052 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libwidget_gtk.so +0x0003E1EA]
nsAppShellService::Run(void)+0x0000003C 
[/builds2/dougt/trunk/mozilla/dist/bin/components/libnsappshell.so +0x00043134]
UNKNOWN 0x8056703
UNKNOWN 0x80573ca
__libc_start_main+0x000000FF [/lib/libc.so.6 +0x000189CB]

Comment 1

[Darin Fisher]

I see what's going on.  The nsStreamListenerProxy implements
nsIInputStreamObserver.  It set's itself as the input stream observer on the
pipe it owns.  This is an easy fix.  We just have to clear the observer on the
pipe before releasing the pipe.

Attaching a patch...

Comment 2

[Doug Turner (:dougt)]

I tried that and it did not complete work.  Make sure that you verify the patch.

Comment 3

[Darin Fisher]

Attachment: Patch that should fix the memory leak

Comment 4

[Darin Fisher]

There are two places where the pipe observer must be cleared.

Comment 5

[Darin Fisher]

I thought about this some more, and we would definitely leak if OnStopRequest
were never fired.  So, a better solution is definitely needed.

Perhaps the observer could be set when OnStartRequest gets fired (instead of
when Init is called).  Since each OnstartRequest _must_ be accompanied by an 
OnStopRequest, this would work.

This bug should not be particular to doug's branch.  We should also be able
to verify it on the trunk.

Comment 6

[Doug Turner (:dougt)]

This bug should be fixed my recently checked in necko changes.