Created attachment 436160 [details] [diff] [review] v1 It holds a document and it can end up in a cycle with the parser and that document. Patch has r=jst. I'll try to write a testcase for this.
I thought we always broke this cycle as needed.... when do we fail to do it?
Still working on the testcase, but note that the nsContentSink already unlinks its document.
Created attachment 436192 [details] Testcase This is the simplest testcase that leaks for me. I'm also seeing two assertions: ###!!! ASSERTION: Non-global object has the wrong flags: '!(jsclazz->flags & JSCLASS_IS_GLOBAL)', file js/src/xpconnect/src/xpcwrappednative.cpp, line 1118 ###!!! ASSERTION: Overwriting an existing document channel!: '(loadFlags & nsIChannel::LOAD_REPLACE) || !(mDocumentRequest.get())', file uriloader/base/nsDocLoader.cpp, line 532 Need to figure out a way to stop the reloads after a while too. Who is supposed to break the cycle without CC? We should be able to check that in this testcase.
Created attachment 436200 [details] Testcase This one reloads the main page twice. When shutting down I get in the leaked urls: file:///Users/peterv/test_bug556241.html file:///Users/peterv/test_bug556241.html file:///Users/peterv/test_bug556241.html?1
> Who is supposed to break the cycle without CC? Used to be that DidBuildModel on the sink would drop refs as needed.... But maybe we changed that.
Ah, but that drops the reference from sink to parser iirc. I think the issue here is that the testcase just calls document.open, so the document holds a reference to the parser, the parser holds a reference to the sink and the sink holds two references to the document (one in nsContentSink and one in HTMLContentSink). CC knows about all of these, except for HTMLContentSink->document.
Ah, I see. OK, thanks!
Comment on attachment 436160 [details] [diff] [review] v1 Approved for 220.127.116.11, a=dveditz for release-drivers
Can we get this fixed on the 1.9.1 branch, by tomorrow if possible?
Comment on attachment 436160 [details] [diff] [review] v1 The patch works as-is on 1.9.1 too.
Comment on attachment 436160 [details] [diff] [review] v1 a=LegNeato for 18.104.22.168