1000609 - BlobSet does not free mData when it is destroyed

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Andrew McCreight [:mccr8]]

Attachment: stacks for leaking allocation

Found while running crashtests under LSAN.

Comment 1

[Andrew McCreight [:mccr8]]

This leak is caused by 
  content/base/crashtests/xhr_abortinprogress.html

Comment 2

[Andrew McCreight [:mccr8]]

One way to fix the leak seems to be to add a dtor to BlobSet() that freed mData:
  ~BlobSet()
  {
    if (mData) {
      free(mData);
    }
  }

What the test is doing is an XHR that is failing partway through, and so I guess the BlobSet just floats off into the ether somewhere.  The actual BlobSet is being deleted somehow, but no flush or whatever occurs that frees the data.

Comment 3

[Andrew McCreight [:mccr8]]

The destruction of the BlobSet() is happening in nsXMLHttpRequest::ResetResponse(), which basically just deletes everything, so adding a dtor to BlobSet() seems like a reasonable approach.

Comment 4

[Andrew McCreight [:mccr8]]

Attachment: Free mData in ~BlobSet.

https://tbpl.mozilla.org/?tree=Try&rev=0ccdd76a5338

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e69ec269e265

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/e69ec269e265