481639 - memory leak when evaluating javascript code in the js shell and using the jsapi

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[karl.strasser]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.17) Gecko/20061201 Firefox/2.0.0.17 (Ubuntu-feisty)
Build Identifier: JavaScript-C 1.8.0 pre-release 1 2007-10-03

Hi,

I'm using SpiderMonkey embedded in a CCXML interpreter.

While stressing the interpreter I noted that memory consumption
grows until it runs out of memory and crashes. I ran
Valgrind/Memcheck and then Valgrind/Massif to see where the leak
is located. The resulting output suggests that the leak is
inside SpiderMonkey. I re-checked my code to see if I was using
the API incorrectly but didn't find anything.

Next I tried to run several scripts (The scripts resemble the
evaluations performed in the areas of the code most likely to
generate a leak according to Massif) inside a while(true) loop
in the js shell. I hoped that some of those scripts would
exhibit behaviour similar to that of the CCXML interpreter. I
tested these scripts with four versions of SpiderMonkey (1.5,
1.6, 1.7 and 1.8 (The 1.8 version was obtained from Mercurial),
and I came up with four suspicious scripts:

* The first one leaks in all four versions:
===========================================

 var x = "khadkjfdgjkfgkdfjklsf";
 for(var i = 0;i < 10;i = i + 1){
  x = x + x;
 }
 var counter = 0;
 while(true){
  var vname = "s_" + counter;
  eval(vname + " = Object(); " + vname + ".test = '" + x + "';   
       delete " + vname + ";"
  );
  counter = counter + 1;
 }

* The second one leaks in 1.7 and 1.8:
======================================

 var x = "khadkjfdgjkfgkdfjklsf";
 for(var i = 0;i < 10;i = i + 1){
  x = x + x;
 }
 while(true){
  eval("'" + x + "'");
 }

* The third one leaks only in 1.7:
==================================

 a = Object();
 a.b = 4;
 a.c = 'asfdf';
 function test(x){
  if(eval('x instanceof Object')){
   for(var name in x){
    test(x[name]);
   }
  }
 }
 while(true){
  test(a);
 }

* Finally, the fourth one leaks in 1.5, 1.6 and 1.7:
====================================================

 a = "sdfgjsdgfkf";
 while(true){
  eval("/sdfsdfsdf/(a)");
 }

When run in the js shell, these scripts consume all of the
system's memory. All of them behave nicely if gc() is called
periodically (For example, adding gc(); to each one of the
while() loops). Also, the first script doesn't leak if I
concatenate a value to the literal being evaluated in line 8
(For example: ...'" + x + "' + 'dsfsdf'...).

So I thought, maybe if I add a call to JS_MaybeGC() once each
1000 or so evaluations as a workaround I can stop the leak, but
it didn't help. I'm guessing that some combination of
evaluations produces a leak not recoverable by calling the
garbage collector manually.

I would like to ask if any of you know anything about this
symptom, or if I'm doing something wrong.

Thank you very much.

Karl Strasser Salinas

Reproducible: Always

Steps to Reproduce:
1. execute the js shell included with spidermonkey
2. execute one of the scripts that leak for your version of js according to the details posted above
Actual Results:  
js eats all the system's memory until it crashes. for my memory configuration, js reaches 1.6 GB of memory consumption in aprox. 1 minute

Expected Results:  
the gc should have been triggered automatically to recycle unreachable temporary variables

adding a manual call to gc() to the loops in the scripts prevents the problem from happening

Comment 1

[Mike Shaver (:shaver emeritus)]

The js shell doesn't run GC on its own unless you use the -b parameter to specify a branch-callback limit.