689011 - Leak with frames, adoptNode, carefully timed cycle collection

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Prep:
1. Install https://www.squarefree.com/extensions/domFuzzLite2.xpi
2. Save a local copy of the testcase as "b.html"
3. Build a debug build of Firefox.

Repro:
4. XPCOM_MEM_LEAK_LOG=2 firefox b.html
5. Quit Firefox

Result: about half the time, Firefox leaks an nsDocument.

Comment 1

[Andrew McCreight [:mccr8]]

I can take a look at what the cycle collector logs look like for this.

Comment 2

[Andrew McCreight [:mccr8]]

For my convenience, this is the heart of the test case:

>function b1()
>{
>  var f = document.getElementById("f");
>  var g = f.contentDocument.documentElement;
>  document.body.removeChild(f);
>  document.adoptNode(g);
>  fuzzPriv.CC();
>  setTimeout(function() { fuzzPriv.CC(); }, 0);
>  //setTimeout(function() { fuzzPriv.quitApplication() }, 200);
>}
>
>// Fragile timing!
>setTimeout(b1, 50);

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

What all do we leak? Document, but what else? DocShell?

Comment 4

[Jesse Ruderman]

Attachment: log

No docshells or windows, just a document.

Comment 5

[Jesse Ruderman]

I only see the bug on Windows, but that might have more to do with fragile timing than real OS differences.

Comment 6

[Andrew McCreight [:mccr8]]

Hmm.  Okay. I'll see if I can get some kind of timing to work on OSX.

Comment 7

[Jesse Ruderman]

Attachment: testcase 2

Less fragile timing, but stranger ingredients. You might have to set dom.disable_window_status_change to false.

Comment 8

[Jesse Ruderman]

And yet I still can't reproduce on Mac.

Comment 9

[Nicholas Nethercote [inactive]]

mccr8, any progress here?

Comment 10

[Andrew McCreight [:mccr8]]

No, I guess I should break out my Windows machine and run this with a custom build.

Comment 11

[Andrew McCreight [:mccr8]]

I don't have a Windows dev machine set up, so I don't think I'll look at this any time soon.

Comment 12

[Jesse Ruderman]

Bug 764111 is reproducible on Mac, and the testcase has some similarities. Let's see if it helps here.

Comment 13

[Jesse Ruderman]

Bug 764111 is WFM.  So is this.

I'll instruct my DOM fuzzer to look for leaks involving frames again.  Let's see what happens :)