624186 - Arguments.callee.caller leaks a docshell, window, etc when spanning a JSM boundary

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[clever]

User-Agent:       Mozilla/5.0 (X11; Linux i686; rv:2.0b9pre) Gecko/20110108 Firefox/4.0b9pre
Build Identifier: 

using arguments.callee.caller from a JSM can trigger an xpcom leak

nsStringStats
 => mAllocCount:          58343
 => mReallocCount:         2921
 => mFreeCount:           51739  --  LEAKED 6604 !!!
 => mAdoptCount:           1873
 => mAdoptFreeCount:       1871  --  LEAKED 2 !!!


Reproducible: Always

Steps to Reproduce:
1. install the attached .xpi on a debug build of firefox
2. close firefox
3. look at stdout



--enable-application=browser --enable-debug --enable-jemalloc --enable-optimize=-O2
Built from https://hg.mozilla.org/mozilla-central/rev/df3c1150dd7a

Comment 1

[clever]

Attachment: testcase, leaks upon shutdown 100% of the time

Comment 2

[clever]

Attachment: XPCOM_MEM_BLOAT_LOG log file

Comment 3

[Jason Orendorff [:jorendorff]]

Here's what's in the XPI.

modules/debuger.js, in its entirety:
> var EXPORTED_SYMBOLS = [ 'get_debug' ];
>
> function MAIN_debug () {
>         arguments.callee.caller;
> }
> function get_debug() {
>         return function local_debug() {
>                 dump(arguments.callee.caller);
>                 MAIN_debug();
>                 dump('leaking');
>         }
> }

A script in chrome/overlay.xul does this:
>  function crash() {
>    var debuger = Components.utils.import("resource://earthangel/debuger.js");
>    var debug = debuger.get_debug('foo');
>    debug('test');
>  }
>  crash();

(Clever confirmed for me that despite its name, this function doesn't crash; it just leaks.)

Apart from the usual boilerplate, that's it.

Comment 4

[Nicholas Nethercote [inactive]]

jorendorff, should this block (hard, soft, or 2.x)?

Comment 5

[(no longer active)]

(In reply to comment #4)
> jorendorff, should this block (hard, soft, or 2.x)?

Let's ask this question officially!

Comment 6

[Johnathan Nightingale [:johnath]]

njn/jorendorff - drivers need more info to understand blocking here. How frequently would the leak be encountered, how painful, is it a regression?

Comment 7

[Johnny Stenback (:jst)]

Andreas, Blake, should this block?

Comment 8

[Jason Orendorff [:jorendorff]]

I know nothing about this bug. Comment 3 was just me being nice. :) Sorry.

Comment 9

[Nicholas Nethercote [inactive]]

I don't know anything about this code and jorendorff told me he doesn't either, so Andreas or Blake will need to decide.

Comment 10

[Andreas Gal :gal]

Is this a regression?

Comment 11

[Johnathan Nightingale [:johnath]]

Andreas says this is liveable if it's not a regression, but we don't know yet. Who can determine that and re-nom if so?

Comment 12

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I can do that tonight if nobody beats me to it.

Comment 13

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This is a bit odd, overlaying browser.xul is essential to the leak.  I've reduced this to a testcase, looking for a known good build now.

Comment 14

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Attachment: browser-chrome test

Comment 15

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This is a regression from 3.6.  Continuing to bisect.

Comment 16

[clever]

with my past testing, i couldnt get it to leak multiple times, so it wont snowball out of control and use up all ram

Comment 17

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Comment 15 is bogus, this is not a regression from 3.6.  The behavior of the test suite changed such that the test does not leak before http://hg.mozilla.org/mozilla-central/rev/13153bb68e1b, but the extension version leaks on 3.6.

Comment 18

[Mihaela Velimiroviciu (:mihaelav)]

Build identifier: Mozilla/5.0 (X11; Linux i686; rv:25.0) Gecko/20130711 Firefox/25.0

WFM on the above build (latest Nightly) with the steps from bug description. Please reopen if it occurs again.