131389 - Memory leak of 44 bytes from 1 block allocated in NS_NewTimer

Status: VERIFIED INVALID

(Core :: XPCOM, defect)

Description

[[e-mail] (gone - use [e-mail] instead)]

Latest Windows 2000 trunk pull @ 11:10 PDT, 3-15-2002 with Purify.

I see this leak just running Mozilla with a default http://home.netscape.com 
homepage.

[W] MLK: Memory leak of 44 bytes from 1 block allocated in NS_NewTimer(nsITimer 
* *,(*)(nsITimer *,void *),void *,UINT,UINT,UINT)
        Distribution of leaked blocks
        Allocation location
            new(UINT)      [MSVCRT.DLL]
            NS_NewTimer(nsITimer * *,(*)(nsITimer *,void *),void 
*,UINT,UINT,UINT) [nsTimerImpl.cpp:461]
                NS_NewTimer(nsITimer* *aResult, nsTimerCallbackFunc aCallback, 
void *aClosure,
                            PRUint32 aDelay, PRUint32 aPriority, PRUint32 aType)
                {
             =>     nsTimerImpl* timer = new nsTimerImpl();
                    if (timer == nsnull)
                        return NS_ERROR_OUT_OF_MEMORY;
                    NS_ADDREF(timer);
            nsRecyclingAllocator::Malloc(UINT,int) 
[nsRecyclingAllocator.cpp:240]
                            {
                                (void) NS_NewTimer(&mRecycleTimer, 
nsRecycleTimerCallback, this,
                                                   NS_SEC_TO_MS(mRecycleAfter), 
NS_PRIORITY_LOWEST,
             =>                                    NS_TYPE_REPEATING_SLACK);
                            }
                            return ptr;
                        }
            zlibAlloc      [nsZipArchive.cpp:399]
                    PRUint32 realitems = items;
                    if (size == 4 && items < BY4ALLOC_ITEMS)
                      realitems = BY4ALLOC_ITEMS;
             =>      return zallocator->Calloc(realitems, size);
                  }
                  else
                    return calloc(items, size);
            inflateInit2_  [inflate.c:102]
                  }
                  if (z->zfree == Z_NULL) z->zfree = zcfree;
                  if ((z->state = (struct internal_state FAR *)
             =>        ZALLOC(z,1,sizeof(struct internal_state))) == Z_NULL)
                    return Z_MEM_ERROR;
                  z->state->blocks = Z_NULL;
                
            nsZipArchive::InflateItem(nsZipItem const*,PRFileDesc *,char *) 
[nsZipArchive.cpp:1321]
                  zs.opaque = gZlibAllocator;
                #endif
                
             =>   zerr = inflateInit2( &zs, -MAX_WBITS );
                  if ( zerr != Z_OK )
                  {
                    status = ZIP_ERR_GENERAL;
            nsZipArchive::ReadInit(char const*,nsZipRead *) 
[nsZipArchive.cpp:592]
                  switch(item->compression)
                  {
                    case DEFLATED:
             =>       result = InflateItem(item, 0, buf);
                      break;
                    case STORED:
                      result = CopyItemToBuffer(item, buf);
            nsJARInputStream::Init(nsJAR *,char const*) 
[nsJARInputStream.cpp:107]
                  NS_ADDREF(mJAR);
                
                  PRInt32 result;
             =>   result = Zip()->ReadInit(aFilename, &mReadInfo);
                  if (result != ZIP_OK)
                    return NS_ERROR_FAILURE;
                  return NS_OK;
            ???            [ip=0x09b41b34]
            nsJAR::GetInputStream(char const*,nsIInputStream * *) 
[nsJAR.cpp:345]
                  rv = nsJARInputStream::Create(nsnull, NS_GET_IID
(nsIInputStream), (void**)&jis);
                  if (!jis) return NS_ERROR_FAILURE;
                
             =>   rv = jis->Init(this, aFilename);
                  if (NS_FAILED(rv)) return NS_ERROR_FAILURE;
                
                  *result = (nsIInputStream*)jis;
            nsJARChannel::GetInputStream(nsIInputStream * *) 
[nsJARChannel.cpp:685]
                    }
                #endif
                    NS_ENSURE_TRUE(mJAR, NS_ERROR_NULL_POINTER);
             =>     nsresult rv = mJAR->GetInputStream(mJAREntry.get(), 
aInputStream);
                    if (NS_SUCCEEDED(rv))
                        (*aInputStream)->Available((PRUint32 *) 
&mContentLength);
                    return rv;
            nsFileTransport::Process(nsIProgressEventSink *) 
[nsFileTransport.cpp:667]
                        LOG(("nsFileTransport: START_READ [this=%x %s]\n", 
this, mStreamName.get()));
                
                        nsCOMPtr<nsIInputStream> source;
             =>         mStatus = mStreamIO->GetInputStream(getter_AddRefs
(source));
                        if (NS_FAILED(mStatus)) {
                            LOG(("nsFileTransport: mStreamIO->GetInputStream() 
failed [this=%x rv=%x]\n",
                                this, mStatus));
            nsFileTransport::Run(void) [nsFileTransport.cpp:616]
                        // While processing, we allow Suspend, Resume, and 
Cancel.
                        //
                        PR_Unlock(mLock);
             =>         Process(progressSink);
                        PR_Lock(mLock);
                
                        //
            nsThreadPoolRunnable::Run(void) [nsThread.cpp:904]
                               ("nsIThreadPool thread %p running %p\n",
                                currentThread.get(), request));
                        nsThreadPoolBusyBody bumpBusyCount(mPool);
             =>         rv = request->Run();
                        NS_ASSERTION(NS_SUCCEEDED(rv), "runnable failed");
                
                        // let the pool know that the request has finished 
running.
            nsThread::Main(void *) [nsThread.cpp:120]
                
                    PR_LOG(nsIThreadLog, PR_LOG_DEBUG,
                           ("nsIThread %p start run %p\n", self, self-
>mRunnable.get()));
             =>     rv = self->mRunnable->Run();
                    NS_ASSERTION(NS_SUCCEEDED(rv), "runnable failed");
                
                #ifdef DEBUG
            PR_NativeRunThread [pruthr.c:433]
            TlsSetValue    [KERNEL32.dll]

Comment 1

[Suresh Duddi (gone)]

Does this always happen or only sometimes ?

Pav: nsRecyclingAllocator seems to release the timer after cancelling it. Maybe
someone else is holding on to it still like the timer thread.

Comment 2

[[e-mail] (gone - use [e-mail] instead)]

Attachment: Current leaks

Yeah, I see this all the time.	Seems like the http or css code is holding onto
a lot of objects and causing false positives?

Comment 3

[[e-mail] (gone - use [e-mail] instead)]

Punting to Doug..thanks!

Comment 4

[[e-mail] (gone - use [e-mail] instead)]

Dbaron, is this your leak?  Doug says it is.  

Comment 5

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: nsCOMPtr-ization

Comment 6

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I don't see a leak, so I may as well just make this an nsCOMPtr and hope it goes
away.

Comment 7

[[e-mail] (gone - use [e-mail] instead)]

DougT did a lot of work on timers recently, and this might've gone away when
that landed.  Unfortunately, my Purify/build setup isn't optimal, so I can't
check if this still occurs before the patch.

Comment 8

[[e-mail] (gone - use [e-mail] instead)]

Okay, Purify is still showing this with 56 bytes counted now:

[W] MLK: Memory leak of 56 bytes from 1 block allocated in NS_NewTimer(nsITimer
* *,(*)(nsITimer *,void *),void *,UINT,UINT) [xpcom.dll]
        Distribution of leaked blocks
        Allocation location
            new(UINT)      [new.cpp:23]
            NS_NewTimer(nsITimer * *,(*)(nsITimer *,void *),void *,UINT,UINT)
[nsTimerImpl.cpp:602]
                NS_NewTimer(nsITimer* *aResult, nsTimerCallbackFunc aCallback,
void *aClosure,
                            PRUint32 aDelay, PRUint32 aType)
                {
             =>     nsTimerImpl* timer = new nsTimerImpl();
                    if (timer == nsnull)
                        return NS_ERROR_OUT_OF_MEMORY;
                    NS_ADDREF(timer);
            nsRecyclingAllocator::Malloc(UINT,int) [nsRecyclingAllocator.cpp:198]
            nsRecyclingAllocator::Calloc(UINT,UINT) [nsRecyclingAllocator.h:158]
            zlibAlloc      [nsZipArchive.cpp:400]
            inflateInit2_  [inflate.c:102]
            nsZipArchive::InflateItem(nsZipItem const*,PRFileDesc *,char *)
[nsZipArchive.cpp:1329]
            nsZipArchive::ReadInit(char const*,nsZipRead *) [nsZipArchive.cpp:593]
            nsJARInputStream::Init(nsJAR *,char const*) [nsJARInputStream.cpp:107]
            nsJAR::GetInputStream(char const*,nsIInputStream * *) [nsJAR.cpp:345]

Comment 9

[timeless]

Ok, this is easy
http://lxr.mozilla.org/seamonkey/source/modules/libjar/nsZipArchive.cpp#1321
1321     gZlibAllocator = new nsRecyclingAllocator(NBUCKETS,
NS_DEFAULT_RECYCLE_TIMEOUT, "libjar");
I don't see anyone destroying gZlibAllocator
My feeling is that we need to create a shutdown observer for nsZipArchive and
have it kill the allocator then.

Comment 10

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I see someone destroying it:

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/modules/libjar/nsJARFactory.cpp&rev=1.23&mark=68-73,75#68

Comment 11

[timeless]

ok, i must have been really out of it when i looked the last time. stephend, can
you find out if we hit the lines dbaron mentioned (we obviously should, but ...)?

Comment 12

[[e-mail] (gone - use [e-mail] instead)]

Timeless, would something like the following suffice?

Index: nsJARFactory.cpp
===================================================================
RCS file: /cvsroot/mozilla/modules/libjar/nsJARFactory.cpp,v
retrieving revision 1.23
diff -u -r1.23 nsJARFactory.cpp
--- nsJARFactory.cpp    4 Apr 2002 22:28:04 -0000       1.23
+++ nsJARFactory.cpp    14 Oct 2002 01:28:20 -0000
@@ -70,6 +70,7 @@
 {
     // Release cached buffers from zlib allocator
     delete gZlibAllocator;
+    printf("Destructor called");
 }

Comment 13

[[e-mail] (gone - use [e-mail] instead)]

###!!! ASSERTION: Global Thread Manager is null!: 'gManager', file c:/moz_src/mo
zilla/xpcom/threads/nsTimerImpl.cpp, line 422
Destructor called###!!! ASSERTION: Component Manager being held past XPCOM shutd
own.: 'cnt == 0', file c:/moz_src/mozilla/xpcom/build/nsXPComInit.cpp, line 766

there she is - 'Destructor called'.

Comment 14

[[e-mail] (gone - use [e-mail] instead)]

I'm not seeing this anymore with a trunk debug build under Purify using Windows 
2000.

Comment 15

[[e-mail] (gone - use [e-mail] instead)]

verified