1150643 - Changing location via a frame script causes us to leak nsGlobalWindows on shutdown

Status: NEW

(Core :: DOM: Navigation, defect)

Description

[Mike Conley (:mconley) (:⚙️)]

Strangely, I can only reproduce this _without_ e10s.

STR:

1) Apply the patch in this bug
2) Run ./mach mochitest-browser toolkit/content/tests/browser/browser_remote_canGoBack_After_GC.js

ER:

Test should run and pass without leaks.

AR:

22 INFO TEST-UNEXPECTED-FAIL | toolkit/content/tests/browser/browser_remote_canGoBack_After_GC.js | leaked until shutdown [nsGlobalWindow #22 inner about:home about:home] - expected PASS
23 INFO TEST-UNEXPECTED-FAIL | toolkit/content/tests/browser/browser_remote_canGoBack_After_GC.js | leaked until shutdown [nsGlobalWindow #19 outer  about:blank] - expected PASS
24 INFO TEST-UNEXPECTED-FAIL | toolkit/content/tests/browser/browser_remote_canGoBack_After_GC.js | leaked until shutdown [nsGlobalWindow #23 inner about:blank about:blank] - expected PASS

I've eliminated ContentTask and withNewTab as the culprits - it's only when I don't set content.location that I cause these leaks.

mccr8 - I know you were doing docShell leak stuff before... is this in your wheelhouse?

Comment 1

[Mike Conley (:mconley) (:⚙️)]

Attachment: Regression test. r=?

Comment 2

[Mike Conley (:mconley) (:⚙️)]

Or maybe billm? Does this sound familiar to you?

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Sorry, I'm not sure. I suspect ContentTask is somehow at fault, but I don't have time to investigate.

Comment 4

[Andrew McCreight [:mccr8]]

I looked at this locally, using CC logs.  All three windows are being held alive by a DETH, via an IDBFactory.  The DETH is destroyed somewhere in between CCs, near the end.

Two look like this:

0x112ed2540 [DOMEventTargetHelper about:home]
    --[mFactory]--> 0x1128ab180 [IDBFactory]
    --[mWindow]--> 0x12c5e6000 [nsGlobalWindow #22 inner about:home]

    Root 0x112ed2540 is a ref counted object with 1 unknown edge(s).

The third one starts out like that but is held alive on the window through the form controls on the document.  I don't know if this is useful:

0x112ed2540 [DOMEventTargetHelper about:home]
    --[mFactory]--> 0x1128ab180 [IDBFactory]
    --[mWindow]--> 0x12c5e6000 [nsGlobalWindow #22 inner about:home]
    --[mDoc]--> 0x12c5d4000 [nsDocument normal (xhtml) about:home]
    --[mFormControls]--> 0x12dbb72c0 [nsBaseContentList]
    --[mElements[i]]--> 0x12cac6e50 [FragmentOrElement (xhtml) button id='searchIcon' about:home]
    --[GetParent()]--> 0x12db39000 [FragmentOrElement (xhtml) form id='searchForm' about:home]
    --[mAttrsAndChildren[i]]--> 0x1287d5f90 [FragmentOrElement (xhtml) input id='searchText' about:home]
    --[[via hash] mListenerManager]--> 0x12e2143e0 [EventListenerManager]
    --[mListeners event=onblur listenerType=3 [i]]--> 0x110f219a0 [CallbackObject]
    --[mCallback]--> 0x110ee7060 [JS Object (Object)]
    --[group_proto]--> 0x12c0e3740 [JS Object (Object)]
    --[_sendMsg]--> 0x12c2bcf00 [JS Object (Function - SearchSuggestionUIController.prototype._sendMsg)]
    --[script]--> 0x12c2c1f38 [JS Script]
    --[objects[1]]--> 0x12c0e9400 [JS Object (Object)]
    --[group_proto]--> 0x12c0e3100 [JS Object (Object)]
    --[valueOf]--> 0x12c2354c0 [JS Object (Function - valueOf)]
    --[global]--> 0x12c0e2100 [JS Object (Window)]
    --[CLASS_OBJECT(Object)]--> 0x12c0f10a0 [JS Object (Proxy)]
    --[private]--> 0x12c0f1080 [JS Object (Proxy)]
    --[global, private]--> 0x12c0e2060 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 0x1136d2c00 [nsGlobalWindow #23 inner about:blank]