267607 - memory leaks in nsTableCreator::CreateTableCellFrame()

Status: RESOLVED INCOMPLETE

(Core :: Layout, defect)

Description

[Boying Lu]

One of our customers reported that there are memory leaks in
nsTableCreator::CreateTableCellFrame(). 

The following is the call stack that causes the leak:
    libplds4.so`PL_ArenaAllocate+0x150
         libgklayout.so`unsigned PresShell::AllocateFrame(unsigned,void**)+0x60
         libgklayout.so`void*nsFrame::operator new(unsigned,nsIPresShell*)+0x18
         libgklayout.so`unsigned
NS_NewTableCellFrame(nsIPresShell*,int,nsIFrame**)+0x8c         
libgklayout.so`unsigned
nsTableCreator::CreateTableCellFrame(nsIFrame*,nsIFrame**)+0xa8
         libgklayout.so`unsigned
nsCSSFrameConstructor::ConstructTableCellFrame(nsIPresShell*,nsIPresContext*,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsStyleContext*,nsTableCreator&,int,nsFrameItems&,nsIFrame*&,nsIFrame*&,int&)+0x220
         libgklayout.so`unsigned
nsCSSFrameConstructor::TableProcessChild(nsIPresShell*,nsIPresContext*,nsFrameConstructorState&,nsIContent*,nsIContent*,nsIFrame*,nsIAtom*,nsStyleContext*,nsTableCreator&,nsFrameItems&,nsIFrame*&)+0x31c
         libgklayout.so`unsigned
nsCSSFrameConstructor::TableProcessChildren(nsIPresShell*,nsIPresContext*,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsTableCreator&,nsFrameItems&,nsIFrame*&)+0x4b4
         libgklayout.so`unsigned
nsCSSFrameConstructor::ConstructTableRowFrame(nsIPresShell*,nsIPresContext*,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsStyleContext*,nsTableCreator&,int,nsFrameItems&,nsIFrame*&,int&)+0x2f0
         libgklayout.so`unsigned
nsCSSFrameConstructor::TableProcessChild(nsIPresShell*,nsIPresContext*,nsFrameConstructorState&,nsIContent*,nsIContent*,nsIFrame*,nsIAtom*,nsStyleContext*,nsTableCreator&,nsFrameItems&,nsIFrame*&)+0x274
         libgklayout.so`unsigned
nsCSSFrameConstructor::TableProcessChildren(nsIPresShell*,nsIPresContext*,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsTableCreator&,nsFrameItems&,nsIFrame*&)+0x4b4
         libgklayout.so`unsigned
nsCSSFrameConstructor::ConstructTableRowGroupFrame(nsIPresShell*,nsIPresContext*,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsStyleContext*,nsTableCreator&,int,nsFrameItems&,nsIFrame*&,int&)+0x378

Comment 1

[Bernd]

This bug isn't very specific, isn't it?
1. under which conditions does that leak occure?
2. is it reproducible?
3. can you attach a testcase that triggers the leak?
4. does that leak also occure with a current nightly?

Comment 2

[edburns]

Please consider using some of the information at
http://www.mozilla.org/performance/leak-brownbag.html to help get more
information on this leak.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The code for freeing the arena isn't table-specific at all, so changing component.

Comment 4

[Boying Lu]

Sorry, I can't provide more detailed information. This trace is got from one of
sun's customer and I can't access his machine.

Comment 5

[Wayne Mery (:wsmwk)]

without a testcase and several unanswered questions, it seems likely this bug isn't actionable