592180 - Sandboxes created early in application lifecycle aren't gc'd if they access some XPCOM functionality

Status: RESOLVED INACTIVE

(Core :: XPConnect, defect)

Description

[Atul Varma [:atul]]

This is a bizarre bug, but I think I've reduced it down to a test case that's completely independent of Jetpack.

Comment 1

[Atul Varma [:atul]]

Attachment: example bootstrap.js for an extension

Comment 2

[Atul Varma [:atul]]

Comment on attachment 470699 [details]
example bootstrap.js for an extension

Here's a sample bootstrap.js for a trivial extension that reliably reproduces the bug on my system.

When the addon with this bootstrap.js is loaded at Firefox startup, the following is produced to the dump() console:

  testLeak(false) = null testLeak(true) = [object Sandbox]

When it's loaded in the middle of a normal Firefox session, this is produced:

  testLeak(false) = null testLeak(true) = null

The same text is output to an alert dialog if you copy the contents of bootstrap.js and paste it into the Firefox Error Console's "Code" field and click "Evaluate" while running Firefox.

Both testLeak(false) and testLeak(true) create a Cu.Sandbox with system principal that accesses the most recent browser window's content, but testLeak(true) goes further and QI's nsIInterfaceRequestor on it. This causes a leak when the call is made shortly after Firefox startup (after sessionstore-windows-restored), which is not cleaned up when Firefox is quit--as shown by the display of the following text when Firefox shuts down:

  LEAK DETECTED: A WEAKREF LIVES!

This has befuddled me for a long time.

Comment 3

[Atul Varma [:atul]]

Forgot to mention that the return value of testLeak() is the result of weakref.get() on a weak reference of the sandbox performed immediately after cyclic GC.

Comment 4

[Atul Varma [:atul]]

Note that the leaks occurring in bug 592176, bug 566351, and bug 574389 may be caused by whatever's causing this.

Comment 5

[Atul Varma [:atul]]

Attachment: Trivial extension containing bootstrap.js

Here's a trivial extension containing the aforeuploaded bootstrap.js, for testing purposes.

Comment 6

[Alexandre Poirot [:ochameau] [PTO back August 21]]

A quick note to highlight bug 646343, that will help you running firefox in debug mode!

Comment 7

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.