42746 - XBL-related JS leak of nsXULDocuments

Status: VERIFIED DUPLICATE of bug 42530

(Core :: JavaScript Engine, defect, P3)

Description

[Simon Fraser [no longer active]]

The composer window currently leaks the nsXULDocument and associated data, and, 
through some intrepid hacking of gc_dump_thing(), we find that the object that is 
holding a ref to the XUL document is an XPConnect wrapped nsEditorBoxObject. This 
only starts to show up as the window is being destroyed.

The XUL file has an <editor> tag, which is an XBL tag, specified in 
xulBindings.xml. It has the following XBL property:

      <property name="editorShell"
                readonly="true"
                onget="return this.boxObject.QueryInterface
                        (Components.interfaces.nsIEditorBoxObject).editorShell"/>

This property is invoked in JS on the line
  editorShell = editorElement.editorShell;
of editor.js. If this line is changed to 
  editorShell = editorElement.boxObject.QueryInterface
                      (Components.interfaces.nsIEditorBoxObject).editorShell;

then the leak ceases to occur.

So it looks like the temporary JS object that is created for 'this.boxObject' is 
somehow entrained (but only starts to show up in the ownership graph on window 
desctruction, when hyatt is cleaning up XBL stuff).

hyatt said that this bug might be related to, or the same as your bug with JS 
prototypes (?).

To reproduce the bug, uncomment line 165 of editor.js (1.19) and comment line 
166.

Comment 1

[Brendan Eich [:brendan]]

Isn't this a dup of bug 42098?

/be

Comment 2

[Brendan Eich [:brendan]]

This is all one big bug.  I'll update 42530 to be an mlk bug and say so in its
summary.

/be

*** This bug has been marked as a duplicate of 42530 ***

Comment 3

[Scott Brodmerkle]

Verified dupe; although to me it looks more like 42098, all these bugs seem to
be part of one big happy family.