398892 - Reloading about:bloat causes negative nsRunnable leaks

Status: RESOLVED WORKSFORME

(Core :: Networking, defect, P5)

Description

[Jesse Ruderman]

Attachment: output from trace-refcnt on shutdown, from two separate runs

Steps to reproduce:
1. Run a debug build with XPCOM_MEM_LEAK_LOG=2
2. Load about:bloat
3. Reload a bunch of times, quickly (with Cmd+R)
4. Quit.

Result: trace-refcnt reports that a negative number of nsRunnables remain at shutdown.  Sometimes, other objects have leaked, too.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

It looks like there's an nsRunnable implementation somewhere that doesn't log its initial AddRef -- probably in increments mRefCnt manually or assigns 1 to it.  I logged all the AddRef/Release stacks for nsRunnable objects, and there were a bunch that got only AddRef to 2, Release to 1, Release to 0, without getting the initial AddRef to 1.  Unfortunately, none of the stacks tell anything about what type of nsRunnable it is, except... that the weird thing is that the pointers of the problematic nsRunnables are all very close together, and are all replayed multiple times for nsRunnable instances.  The other uses of these pointers are all nsTimerEvents.

This could just be something that's not threadsafe about the nsTraceRefcnt logging code, though. 

Comment 2

[Jesse Ruderman]

See also bug 610094.

Comment 3

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 4

[Andrew McCreight [:mccr8]]

I removed about:bloat.