DMD tells me that PropertyTables are being counted twice. The attached file contains the error message. There's only one place that PropertyTables are counted (the shape->sizeOfPropertyTable() call in XPCJSRuntime.cpp), so the problem doesn't appear to be with the memory reporting code. bhackett said on IRC: "base shapes with property tables are supposed to be 1:1 with the shapes that own them, but if multiple shapes have the same owned base shape then the double counting could happen". So it's probably a problem with the handling of Shapes and BaseShapes.
Created attachment 579762 [details] [diff] [review] improve Shape constructors Improve the types of the shape constructors to require that an unowned base shape be initially supplied. Doing this caught one instance we were passing a possibly owned base shape, in JSObject::addPropertyInternal, though I haven't confirmed this is definitely the cause of this bug.
Comment on attachment 579762 [details] [diff] [review] improve Shape constructors Mmm types.
I just did a couple of DMD runs and I'm not getting the warnings about double-counting any more! Good news. bhackett, could bad things have happened as a result of this bug?
(In reply to Nicholas Nethercote [:njn] from comment #4) > I just did a couple of DMD runs and I'm not getting the warnings about > double-counting any more! Good news. > > bhackett, could bad things have happened as a result of this bug? Sharing an owned base shape between multiple shapes could cause incorrect lookups --- one or the other shape will have an incorrect property table, and when doing a search for a native property of the object a shape might not be found even though it is on the object. I *think* that is the only fallout of this particular problem.