502055 - XBL leaks

Status: RESOLVED FIXED

(Core :: XBL, defect)

Description

[Peter Van der Beken [:peterv]]

Attachment: v1

If an element with a binding doesn't have a parent, we won't unlink it because we currently rely on a parent to do that by calling Unbind on its children.
If an element with a binding doesn't have an owner document anymore, we won't unlink it because we can't get at the binding from the element.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 386585 [details] [diff] [review]
v1

>diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
>--- a/content/base/src/nsGenericElement.cpp
>+++ b/content/base/src/nsGenericElement.cpp
>@@ -3987,8 +3987,17 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(ns
>         NS_IF_RELEASE(slots->mControllers);
>       slots->mChildrenList = nsnull;
>     }
>   }
>+
>+  {
>+    nsIDocument *doc;
>+    if (!tmp->GetNodeParent() && (doc = tmp->GetOwnerDoc()) &&
>+        tmp->HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
>+      nsAutoScriptBlocker scriptBlocker;
>+      doc->BindingManager()->ChangeDocumentFor(tmp, doc, nsnull);
>+    }
>+  }
> NS_IMPL_CYCLE_COLLECTION_UNLINK_END
Scriptblocker in unlink? Very scary. Does ChangeDocumentFor really need it?

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Perhaps the scriptblocker could be set before calling cycle collector?

Comment 3

[Peter Van der Beken [:peterv]]

Attachment: v1.1

Yeah, I don't think it needs a script blocker.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 386746 [details] [diff] [review]
v1.1

Looks ok.  Does this fix those addBinding leaks we were seeing on mochitest, perchance?

Comment 5

[Peter Van der Beken [:peterv]]

http://hg.mozilla.org/mozilla-central/rev/fe1f520ff772

I'll try to make a testcase, but it could be hard (dependent on order of CC or GC).