31371 - Memory leak: Circular reference nsHTTPChannel->mRequest->mTransport->mProxyChannel

Status: VERIFIED DUPLICATE of bug 30385

(Core :: Networking, defect, P3)

Description

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Symptoms: left Mozilla running for a while with a looping animated GIF. It 
asserted. Investigation shows, among other things, an nsCachedNetData with a 
refcount of more than 500. Suspected memory leak as a new nsHTTPChannel is 
created for every loop of the animation. Indeed, at this point in the code a 
cycle of references is created:

http://lxr.mozilla.org/seamonkey/source/gfx/src/nsImageNetContextAsync.cpp#732

After this function call, httpChannel->mRequest->mTransport->mProxyChannel == 
httpChannel. I don't see this cycle ever broken; eventually httpChannel's 
refCount reaches 1, which implies that it would be released if this cycle were 
broken.

FYI, httpChannel->mRequest->mTransport is an nsCacheEntryChannel, and
httpChannel->mRequest->mTransport->mChannel is an nsMemCacheChannel.

Question: why doesn't nsHTTPCacheListener::OnStopRequest do a ReleaseTransport 
like nsHTTPServerListener::OnStopRequest does? I will try a patch. It's going to 
be a little tricky because httpChannel->mRequest->mTransport is not itself equal 
to aChannel, as expected by ReleaseTransport --- instead it's a proxy wrapper 
around aChannel.

Comment 1

[Gagan]

known issue. see the dup.

*** This bug has been marked as a duplicate of 30385 ***

Comment 2

[Tom Everingham]

verified dupe