Closed Bug 8221 Opened 25 years ago Closed 24 years ago

MLK - Mem Leak's found with the scc wonder query - nsCOMPtr = do_QueryInterface..

Categories

(SeaMonkey :: Build Config, defect, P3)

x86
Windows 95
defect

Tracking

(Not tracked)

RESOLVED FIXED

People

(Reporter: chofmann, Assigned: chofmann)

References

()

Details

(Keywords: memory-leak)

We need more search tools like this, hats off to scc;
and we need to fix the set of problems found
and monitor at each milestone - chofmann

scc wrote:
So, as recently pointed out by Chris Waterson in the posting

  <news://news.mozilla.org/3761E9F9.E9813A37@netscape.com>

  see netscape.public.mozilla.xpcom "found evil leaks"

...there is a common mistake that can cause a leak.  When you call a
function that returns an |AddRef|ed pointer as a function result
(already, this goes against the rules of COM), and you immediately
|QueryInterface| that pointer without saving it, you end up with a
result that is |AddRef|ed more times than you will remember to release
it.

Unlikely, you say?  Well, yes, you would hardly write

  (aList->ElementAt(i))->QueryInterface(nsIBar::GetIID(), &barP);

But, if you were in a hurry, you might type this

  nsCOMPtr<nsIBar> barP = do_QueryInterface( aList->ElementAt(i) );

which is exactly the same thing.  |ElementAt| returns an |AddRef|ed
pointer.  |do_QueryInterface| extracts another pointer, also
|AddRef|ed, and then the original pointer returned by |ElementAt| is
summarily forgotten.  No |Release|.

As it happens, running this shows at least 10 leaks of this form in
the current code base at the end of M7.

Lets get these wiped out and continue to monitor at each milestone.



/rdf/content/src/nsRDFElement.cpp, line 2642 --
do_QueryInterface(NS_STATIC_CAST(nsIStyledContent*, this));
/rdf/tests/rdfcat/rdfcat.cpp, line 225 -- do_QueryInterface(new
ConsoleOutputStreamImpl());
/rdf/tests/rdfpoll/rdfpoll.cpp, line 304 -- nsCOMPtr<nsIRDFObserver> observer =
do_QueryInterface(new Observer());
/layout/base/src/nsRangeList.cpp, line 1085 -- content =
do_QueryInterface(FetchStartParent(aRange), &result);
/layout/base/src/nsRangeList.cpp, line 1116 -- content =
do_QueryInterface(FetchEndParent(aRange), &result);
/layout/base/src/nsRange.cpp, line 1180 -- cN =
do_QueryInterface(NS_STATIC_CAST(nsIContent*, deleteList.ElementAt(0)));
/layout/html/forms/src/nsButtonFrameRenderer.cpp, line 344 -- nsCOMPtr<nsIAtom>
atom
(do_QueryInterface(NS_NewAtom(":-moz-outline")));
/layout/html/forms/src/nsButtonFrameRenderer.cpp, line 358 -- atom =
do_QueryInterface(NS_NewAtom(":-moz-focus-inner"));
/layout/html/forms/src/nsButtonFrameRenderer.cpp, line 366 -- atom =
do_QueryInterface(NS_NewAtom(":-moz-focus-outer"));
/layout/xul/base/src/nsDeckFrame.cpp, line 111 -- nsCOMPtr<nsIAtom> show
(do_QueryInterface(NS_NewAtom(":-moz-deck-showing")));
/layout/xul/base/src/nsDeckFrame.cpp, line 112 -- nsCOMPtr<nsIAtom> hide
(do_QueryInterface(NS_NewAtom(":-moz-deck-hidden")));
/layout/xul/base/src/nsDeckFrame.cpp, line 769 -- nsCOMPtr<nsIAtom> hide
(do_QueryInterface(NS_NewAtom(":-moz-deck-hidden")));
/widget/src/mac/nsDragService.cpp, line 208 -- nsCOMPtr<nsITransferable>
currItem (
do_QueryInterface(inArray->ElementAt(itemIndex)) );
/widget/src/mac/nsDragService.cpp, line 436 -- nsCOMPtr<nsITransferable> item (
do_QueryInterface(inDragItems->ElementAt(inItemIndex)) );
/mailnews/base/src/nsMsgFolderDataSource.cpp, line 878 --
nsCOMPtr<nsIRDFLiteral>
literal(do_QueryInterface(arguments->ElementAt(0), &rv));
/mailnews/base/util/nsMsgFolder.cpp, line 307 -- m_server =
do_QueryInterface(servers->ElementAt(0));
/mailnews/compose/src/nsMsgSendLater.cpp, line 345 -- inServer =
do_QueryInterface(retval->ElementAt(0));
/mailnews/compose/src/nsMsgQuote.cpp, line 244 -- nsCOMPtr<FileInputStreamImpl>
in = do_QueryInterface(new
FileInputStreamImpl());
/mailnews/imap/src/nsImapMailFolder.cpp, line 744 -- nsCOMPtr<nsIFolder>
aFolder(do_QueryInterface((nsIMsgFolder*) this,
&rv));
/mailnews/imap/src/nsImapMailFolder.cpp, line 783 -- nsCOMPtr<nsIFolder>
aFolder(do_QueryInterface((nsIMsgFolder*)this, &rv));
/mailnews/imap/src/nsImapMailFolder.cpp, line 956 -- m_pendingUndoTxn =
do_QueryInterface(new nsImapMoveCopyMsgTxn(
/mailnews/mime/tests/mimetest/mimetest.cpp, line 349 --
nsCOMPtr<nsIOutputStream> out = do_QueryInterface(new
ConsoleOutputStreamImpl());
/mailnews/mime/tests/mimetest/mimetest.cpp, line 357 --
nsCOMPtr<FileInputStreamImpl> in = do_QueryInterface(new
FileInputStreamImpl());
/mailnews/addrbook/src/nsCardDataSource.cpp, line 711 -- nsCOMPtr<nsIRDFLiteral>
literal(do_QueryInterface(arguments->ElementAt(0), &rv));
/mailnews/addrbook/src/nsDirectoryDataSource.cpp, line 764 --
nsCOMPtr<nsIRDFLiteral>
literal(do_QueryInterface(arguments->ElementAt(0), &rv));
Blocks: 8222
No longer blocks: 8222
Summary: MLK - Mem Leak's found with the scc wonder query.. → MLK - Mem Leak's found with the scc wonder query - nsCOMPtr = do_QueryInterface..
Target Milestone: M8
i have fixes for the nsDragService, nsButonFrameRenderer, and nsDeckFrame leaks
in my tree. just waiting for the tree to open so i can check in.

adding myself to cc list.
Blocks: 8222
I have fixes for all of the mailnews spots. I'll be checking them in when the
tree opens as well. Also adding myself to the cc list.
Fixes have been checked in for the mailnews problems including:
nsDirectoryDataSource, nsCardDataSource, nsImapMailFolder, nsMsgQuote, and
nsMsgFolderDataSource.
Fixes checked in for nsDragService, nsDeckFrame, and nsButtonFrameRenderer.
so here is where we landed at the end of m7.

/rdf/content/src/nsRDFElement.cpp, line 2655 --
do_QueryInterface(NS_STATIC_CAST(nsIStyledContent*, this));
/rdf/tests/rdfcat/rdfcat.cpp, line 225 -- do_QueryInterface(new
ConsoleOutputStreamImpl());
/rdf/tests/rdfpoll/rdfpoll.cpp, line 304 -- nsCOMPtr<nsIRDFObserver> observer =
do_QueryInterface(new Observer());
/layout/base/src/nsRangeList.cpp, line 1085 -- content =
do_QueryInterface(FetchStartParent(aRange), &result);
/layout/base/src/nsRangeList.cpp, line 1116 -- content =
do_QueryInterface(FetchEndParent(aRange), &result);
/layout/base/src/nsRange.cpp, line 1182 -- cN =
do_QueryInterface(NS_STATIC_CAST(nsIContent*, deleteList.ElementAt(0)));
/mailnews/base/util/nsMsgFolder.cpp, line 334 -- m_server =
do_QueryInterface(servers->ElementAt(0));
/mailnews/compose/src/nsMsgSendLater.cpp, line 345 -- inServer =
do_QueryInterface(retval->ElementAt(0));
/mailnews/imap/src/nsImapMailFolder.cpp, line 792 -- nsCOMPtr<nsIFolder> aFolder
= do_QueryInterface((nsIMsgFolder *) this,
&rv);
/mailnews/imap/src/nsImapMailFolder.cpp, line 965 -- m_pendingUndoTxn =
do_QueryInterface(new nsImapMoveCopyMsgTxn(
/mailnews/imap/src/nsImapMoveCoalescer.cpp, line 107 -- nsCOMPtr <nsISupports>
myISupports =
do_QueryInterface((nsIMsgImapMailFolder *) m_sourceFolder, &rv);
/mailnews/mime/tests/mimetest/mimetest.cpp, line 349 --
nsCOMPtr<nsIOutputStream> out = do_QueryInterface(newConsoleOutputStreamImpl());
/mailnews/mime/tests/mimetest/mimetest.cpp, line 357 --
nsCOMPtr<FileInputStreamImpl> in = do_QueryInterface(newFileInputStreamImpl());
added joe and mike to cc list for nsRange and nsRangeList.  Please fix for M8
and comment here when done.
RDF has been fixed.
list getting smaller here is where we are at the close of M8.

do_QueryInterface\([^\)]*\(

/layout/base/src/nsRangeList.cpp, line 1188 -- content =
do_QueryInterface(FetchStartParent(aRange), &result);
/layout/base/src/nsRangeList.cpp, line 1219 -- content =
do_QueryInterface(FetchEndParent(aRange), &result);
/layout/base/src/nsRange.cpp, line 1181 -- cN =
do_QueryInterface(NS_STATIC_CAST(nsIContent*, deleteList.ElementAt(0)));
/mailnews/compose/src/nsMsgCopy.cpp, line 237 -- inServer =
do_QueryInterface(retval->ElementAt(0));
/mailnews/imap/src/nsImapMailFolder.cpp, line 795 -- nsCOMPtr<nsIFolder> aFolder
= do_QueryInterface((nsIMsgFolder *) this, &rv);
/mailnews/imap/src/nsImapMailFolder.cpp, line 970 -- m_pendingUndoTxn =
do_QueryInterface(new nsImapMoveCopyMsgTxn(
/mailnews/imap/src/nsImapMoveCoalescer.cpp, line 108 -- nsCOMPtr <nsISupports>
sourceSupports = do_QueryInterface((nsIMsgImapMailFolder *)
m_sourceFolder, &rv);
/mailnews/local/src/nsLocalMailFolder.cpp, line 1361 -- inputStream =
do_QueryInterface(inputFileStream->GetIStream());
/mailnews/mime/tests/mimetest/mimetest.cpp, line 349 --
nsCOMPtr<nsIOutputStream> out = do_QueryInterface(new
ConsoleOutputStreamImpl());
/mailnews/mime/tests/mimetest/mimetest.cpp, line 357 --
nsCOMPtr<FileInputStreamImpl> in = do_QueryInterface(new FileInputStreamImpl());
Target Milestone: M8 → M9
at the start of m9 here is what we look like

/layout/base/src/nsRangeList.cpp, line 1195 -- content =
do_QueryInterface(FetchStartParent(aRange), &result);
/layout/base/src/nsRangeList.cpp, line 1226 -- content =
do_QueryInterface(FetchEndParent(aRange), &result);
/layout/base/src/nsRange.cpp, line 1196 -- cN =
do_QueryInterface(NS_STATIC_CAST(nsIContent*, deleteList.ElementAt(0)));
/mailnews/compose/src/nsMsgCopy.cpp, line 216 -- mCopyListener =
do_QueryInterface(new CopyListener());
/mailnews/compose/src/nsMsgCopy.cpp, line 298 -- inServer =
do_QueryInterface(retval->ElementAt(i));
/mailnews/compose/src/nsMsgSend.cpp, line 1093 -- mCompFields =
do_QueryInterface( new nsMsgCompFields());
/mailnews/compose/src/nsMsgSend.cpp, line 2700 -- mCopyObj = new nsMsgCopy(); //
SHERRY do_QueryInterface(new
nsMsgCopy());
/mailnews/imap/src/nsImapMailFolder.cpp, line 815 -- nsCOMPtr<nsIFolder> aFolder
= do_QueryInterface((nsIMsgFolder *) this,
&rv);
/mailnews/imap/src/nsImapMoveCoalescer.cpp, line 112 -- nsCOMPtr <nsISupports>
sourceSupports =
do_QueryInterface((nsIMsgImapMailFolder *) m_sourceFolder, &rv);
/mailnews/local/src/nsLocalMailFolder.cpp, line 1375 -- inputStream =
do_QueryInterface(inputFileStream->GetIStream());
/mailnews/mime/tests/mimetest/mimetest.cpp, line 418 --
nsCOMPtr<nsIOutputStream> out = do_QueryInterface(new
ConsoleOutputStreamImpl());
/mailnews/mime/tests/mimetest/mimetest.cpp, line 426 --
nsCOMPtr<FileInputStreamImpl> in = do_QueryInterface(new
FileInputStreamImpl());
FYI...
I've cleaned up 6 of the "start of M9" issues, but I think 4 of there weren't
leaking, but still getting flagged by the query.  (i.e. the ones in
mimetest.cpp for example)

- rhp
So here is where we stand at mid-M9.  Just a few files to go!
Rick or Steve, can you or some one on your teams wipe out
/layout/base/src/nsDocument.cpp, line 2954
/layout/base/src/nsRangeList.cpp, line 1569
/layout/base/src/nsRangeList.cpp, line 1600
/layout/base/src/nsRange.cpp, line 1200


do_QueryInterface\([^\)]*\(

/layout/base/src/nsDocument.cpp, line 2954 -- nsCOMPtr<nsIDOMNode> node
(do_QueryInterface((nsIContent *) aContent));
/layout/base/src/nsRangeList.cpp, line 1569 -- content =
do_QueryInterface(FetchStartParent(aRange), &result);
/layout/base/src/nsRangeList.cpp, line 1600 -- content =
do_QueryInterface(FetchEndParent(aRange), &result);
/layout/base/src/nsRange.cpp, line 1200 -- cN =
do_QueryInterface(NS_STATIC_CAST(nsIContent*, deleteList.ElementAt(0)));
/mailnews/imap/src/nsImapMailFolder.cpp, line 796 -- nsCOMPtr<nsIFolder> aFolder
= do_QueryInterface((nsIMsgFolder *) this, &rv);
/mailnews/imap/src/nsImapMailFolder.cpp, line 2285 --
do_QueryInterface(inputFileStream->GetIStream(), &res);
/mailnews/imap/src/nsImapMoveCoalescer.cpp, line 116 -- nsCOMPtr <nsISupports>
sourceSupports = do_QueryInterface((nsIMsgImapMailFolder *)
m_sourceFolder, &rv);
/mailnews/local/src/nsLocalMailFolder.cpp, line 1403 -- inputStream =
do_QueryInterface(inputFileStream->GetIStream());

This page was automatically generated by LXR.

http://cvs-mirror.mozilla.org/webtools/bonsai/cvsblame.cgi?file=mozilla/layout/b
ase/src/nsDocument.cpp#2954
2949 kostello 3.23  {
2950                  nsIContent* result = nsnull;
2951
2952                  // Look at previous sibling
2953
2954                  if (nsnull != aContent)
2955                  {

2956 kipp     3.41      nsIContent* parent;
2957                    aContent->GetParent(parent);
2958 kostello 3.23      if (parent != nsnull && parent != mRootContent)
2959                    {
2960 kipp     3.41        PRInt32  index;
2961                      parent->IndexOf((nsIContent*)aContent, index);
2962 kostello 3.23        if (index > 0)
2963 kipp     3.41          parent->ChildAt(index-1, result);
2964 kostello 3.23        else
2965                        result = GetPrevContent(parent);
2966                    }
2967 rods     3.35      NS_IF_RELEASE(parent);
2968 kostello 3.23    }
2969                  return result;
2970                }
/layout/base/src/nsRange.cpp, line 1200 is not a leak.  What am I supposed to do
here?  Alter the code so that it no longer generates a hit on the search
criterion?

/layout/base/src/nsRange.cpp, line 1200 --
cN = do_QueryInterface(NS_STATIC_CAST(nsIContent*, deleteList.ElementAt(0)));

Neither ElementAt() (of an nsVoidArray) or NS_STATIC_CAST() cause an AddRef,
hence, no leak.
Status: NEW → ASSIGNED
Target Milestone: M9 → M10
Target Milestone: M10 → M11
look good at the end of m10

o_QueryInterface\([^\)]*\(

/layout/base/src/nsDocument.cpp, line 2991 -- nsCOMPtr<nsIDOMNode> node
(do_QueryInterface((nsIContent *) aContent));
/layout/base/src/nsRange.cpp, line 1206 -- cN =
do_QueryInterface(NS_STATIC_CAST(nsIContent*, deleteList.ElementAt(0)));
/layout/base/src/nsRangeList.cpp, line 1671 -- nsCOMPtr<nsIContent> content =
do_QueryInterface(FetchAnchorNode());
/layout/base/src/nsRangeList.cpp, line 1685 -- nsCOMPtr<nsIContent> content =
do_QueryInterface(FetchFocusNode());
/layout/base/src/nsRangeList.cpp, line 1752 -- content =
do_QueryInterface(FetchStartParent(aRange), &result);
/layout/base/src/nsRangeList.cpp, line 1776 -- content =
do_QueryInterface(FetchEndParent(aRange), &result);
/layout/xml/content/src/nsXMLNamedNodeMap.cpp, line 163 -- nsCOMPtr<nsIDOMNode>
node(do_QueryInterface(mArray->ElementAt(i)));
/layout/xml/content/src/nsXMLNamedNodeMap.cpp, line 198 -- nsCOMPtr<nsIDOMNode>
node(do_QueryInterface(mArray->ElementAt(i)));
/layout/xml/content/src/nsXMLNamedNodeMap.cpp, line 243 -- nsCOMPtr<nsIDOMNode>
node(do_QueryInterface(mArray->ElementAt(i)));
/layout/xml/content/src/nsXMLNamedNodeMap.cpp, line 274 -- nsCOMPtr<nsIDOMNode>
domNode(do_QueryInterface(mArray->ElementAt(aIndex)));
/widget/src/mac/nsMenuBar.cpp, line 547 -- nsCOMPtr<nsIMenuListener>
listener(do_QueryInterface((nsIMenu*)mMenuVoidArray[i]));
/mailnews/base/src/nsMsgAccountManager.cpp, line 637 --
do_QueryInterface((nsISupports*)m_incomingServers.Get(&hashKey), &rv);
/mailnews/base/src/nsMsgAccountManager.cpp, line 818 --
do_QueryInterface((nsISupports*)aData, &rv);
/mailnews/imap/src/nsImapMailFolder.cpp, line 857 -- nsCOMPtr<nsIFolder> aFolder
= do_QueryInterface((nsIMsgFolder *) this, &rv);
/mailnews/imap/src/nsImapMoveCoalescer.cpp, line 116 -- nsCOMPtr <nsISupports>
sourceSupports = do_QueryInterface((nsIMsgImapMailFolder *)
m_sourceFolder, &rv);
/mailnews/local/src/nsLocalMailFolder.cpp, line 1458 -- inputStream =
do_QueryInterface(inputFileStream->GetIStream());
Blocks: 14516
Target Milestone: M11 → M12
no matches for this query at the end of m11. yeah baby!
uhh, did the query change?  although it's not a leak, there is a line in
nsRange.cpp that matches the query.  Why didn't it show up?  I'm just asking this
in case the query didn't run properly...
Target Milestone: M12 → M13
still looking clean going into m12 endgame.
Yes, the query doesn't work automatically anymore.  You need to check the

"Regular Expression Search" check box and re-run it when you get there.  There

turn out to be several hits:



do_QueryInterface\([^\)]*\(



/netwerk/protocol/ftp/src/nsFTPChannel.cpp, line 245 -- mThreadRequest =

do_QueryInterface((nsISupports*)(nsIRequest*)mConnThread);

/netwerk/protocol/ftp/src/nsFTPChannel.cpp, line 282 -- mThreadRequest =

do_QueryInterface((nsISupports*)(nsIRequest*)mConnThread);

/netwerk/protocol/ftp/src/nsFTPChannel.cpp, line 347 -- mThreadRequest =

do_QueryInterface((nsISupports*)(nsIRequest*)mConnThread);

/rdf/content/src/nsXULElement.cpp, line 416 --

do_QueryInterface(NS_REINTERPRET_CAST(nsIStyledContent*, element));

/rdf/content/src/nsXULElement.cpp, line 474 --

do_QueryInterface(NS_REINTERPRET_CAST(nsIStyledContent*, element));

/rdf/util/src/nsRDFResource.cpp, line 234 -- entry->mDelegate =

do_QueryInterface(*NS_REINTERPRET_CAST(nsISupports**,

aResult));

/layout/base/src/nsDocument.cpp, line 3073 -- nsCOMPtr<nsIDOMNode> node

(do_QueryInterface((nsIContent *) aContent));

/layout/base/src/nsRange.cpp, line 1210 -- cN =

do_QueryInterface(NS_STATIC_CAST(nsIContent*, deleteList.ElementAt(0)));

/layout/base/src/nsRangeList.cpp, line 2127 -- nsCOMPtr<nsIContent> content =

do_QueryInterface(FetchAnchorNode());

/layout/base/src/nsRangeList.cpp, line 2141 -- nsCOMPtr<nsIContent> content =

do_QueryInterface(FetchFocusNode());

/layout/base/src/nsRangeList.cpp, line 2212 -- content =

do_QueryInterface(FetchStartParent(aRange), &result);

/layout/base/src/nsRangeList.cpp, line 2236 -- content =

do_QueryInterface(FetchEndParent(aRange), &result);

/layout/xml/content/src/nsXMLNamedNodeMap.cpp, line 166 -- nsCOMPtr<nsIDOMNode>

node(do_QueryInterface(mArray->ElementAt(i)));

/layout/xml/content/src/nsXMLNamedNodeMap.cpp, line 201 -- nsCOMPtr<nsIDOMNode>

node(do_QueryInterface(mArray->ElementAt(i)));

/layout/xml/content/src/nsXMLNamedNodeMap.cpp, line 246 -- nsCOMPtr<nsIDOMNode>

node(do_QueryInterface(mArray->ElementAt(i)));

/layout/xml/content/src/nsXMLNamedNodeMap.cpp, line 277 -- nsCOMPtr<nsIDOMNode>

domNode(do_QueryInterface(mArray->ElementAt(aIndex)));

/widget/src/mac/nsMenuBar.cpp, line 551 -- nsCOMPtr<nsIMenuListener>

listener(do_QueryInterface((nsIMenu*)mMenuVoidArray[i]));

/widget/src/windows/nsWindow.cpp, line 621 -- kungFuDeathGrip =

do_QueryInterface((nsBaseWidget*)someWindow);

/xpfe/appshell/src/nsAppShellService.cpp, line 970 -- nsCOMPtr<nsIObserver>

weObserve(do_QueryInterface(NS_STATIC_CAST(nsIObserver *, this)));

/mailnews/base/src/nsMsgAccountManager.cpp, line 560 --

do_QueryInterface((nsISupports*)m_incomingServers.Get(&hashKey),

&rv);

/mailnews/base/src/nsMsgAccountManager.cpp, line 707 --

do_QueryInterface((nsISupports*)aData, &rv);

/mailnews/imap/src/nsImapMoveCoalescer.cpp, line 120 -- nsCOMPtr <nsISupports>

sourceSupports =

do_QueryInterface((nsIMsgImapMailFolder *) m_sourceFolder, &rv);

/mailnews/local/src/nsLocalMailFolder.cpp, line 1401 -- inputStream =

do_QueryInterface(inputFileStream->GetIStream());



This page was automatically generated by LXR.
Target Milestone: M13 → M14
Keywords: mlk
Target Milestone: M14 → M16
mass re-assign of all bugs where i was listed as the qa contact
QA Contact: cyeh → chofmann
Old bug, is this still an open leak issue?
M16 has been out for a while now, these bugs target milestones need to be 
updated.
Target Milestone: M16 → M18
closing this bug. we can open new ones if we find 'em.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
Product: Browser → Seamonkey
I wonder if a simple query like this could still turn up leaks.
You need to log in before you can comment on or make changes to this bug.