563826 - Don't entrain numeric properties of windows

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

Currently, in order to resolve window[0], we define a JSVAL_VOID property and fill in the value in the getter. Unfortunately, we don't define the numeric properties with JSPROP_SHARED, which means that the resolved value gets stuck on the window object (or the XPCNativeWrapper around the window object).

peterv has been investigating a leak on gmail and seems to have found that we are entraining an iframe in an XPCNativeWrapper's "0" property. Because the only reference to this iframe appears to be from the XPCNativeWrapper and the wrapper probably lives in sessionstore, this seems like a good candidate for the leak.

The fix, whether or not it fixes the gmail leak, is a good one, and we should take it anyway. If it does fix the leak, then we'll probably want to backport it to older branches.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

awesome!

Comment 3

[Boris Zbarsky [:bzbarsky]]

Are there any other cases in classinfo that define non-shared props?  Other than window.document there shouldn't be any, I'd think....

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 443490 [details] [diff] [review]
Proposed fix

r=jst, and yeah, we should audit for other code like this as well...

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

I started looking through nsDOMClassInfo.cpp and didn't finish. I'll look now. There are a couple of cases like the fast expando code where lack of JSPROP_SHARED is actually correct.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/78d48a1a8239