857653 - Audio channel agents leak the world

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Justin Lebar (not reading bugmail)]

In bug 844323 I'm writing unit tests which exercise the process priority manager.

As part of this effort, I modified the audio channel agent code in nsHTMLMediaElement to be controlled by a pref, instead of #ifdef B2G.  I then flip this pref in my test.

I discovered that flipping this pref and playing an <audio> is enough to leak a page until shutdown.

Looking at the audio code, an AudioChannelAgent holds a strong reference to its <audio> element.  So this means that the window which contains the <audio> can be GC'ed only once the AudioChannelAgent is destroyed.  Leak the AudioChannelAgent and you leak its window.

It's not clear to me exactly how we're leaking the AudioChannelAgent, but it's happening somehow.

I have the testcase, so I'll write a fix.

Comment 1

[Justin Lebar (not reading bugmail)]

Attachment: Patch, v1

Comment 2

[Justin Lebar (not reading bugmail)]

This fixes it for me.  There must have been a cycle somewhere.

Even if there isn't a cycle, holding a weak ref seems sane here; we don't want the AudioChannelAgent to keep the node alive, I think.

Comment 3

[Justin Lebar (not reading bugmail)]

Blocks a blocker.  This is also a pretty bad leak.

Comment 4

[Justin Lebar (not reading bugmail)]

> This fixes it for me.

To be clear, we no longer leak the window or the AudioChannelAgent with this patch.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 732965 [details] [diff] [review]
Patch, v1

The IDL should document that the passed-in object needs to implement nsISupportsWeakReference to actually work.

r=me with that

Comment 6

[Justin Lebar (not reading bugmail)]

And how about we make nsHTMLMediaElement implement nsISupportsWeakReference while we're at it?  Apparently this is not tested so well...

Comment 7

[Boris Zbarsky [:bzbarsky]]

> And how about we make nsHTMLMediaElement implement nsISupportsWeakReference

All elements implement nsISupportsWeakReference, via a tearoff.  See http://hg.mozilla.org/mozilla-central/file/f20b0ce9e528/content/base/src/FragmentOrElement.cpp#l1698

Comment 8

[Justin Lebar (not reading bugmail)]

Ah, perfect.  Thanks.

Comment 9

[Daniel Coloma:dcoloma]

blocks a blocker

Comment 10

[Justin Lebar (not reading bugmail)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0a3ce751dd8f

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/0a3ce751dd8f

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g18/rev/da523063aa7b
https://hg.mozilla.org/releases/mozilla-b2g18_v1_0_1/rev/e43e65ec89d2

Comment 13

[Marco Chen [:mchen]]

Hi Justin,

I found that the code as below will return null for callback pointer. Could you help to take a look? Thanks. And this will cause media element malfunctional on AudioChannelService.

http://mxr.mozilla.org/mozilla-central/source/dom/audiochannel/AudioChannelAgent.cpp#148

Comment 14

[Marco Chen [:mchen]]

Hi Justing,

This is my fault on Bug 859244 - nsIAudioChannelAgentCallback didn't be added into nsHTMLMediaElement::QueryInterface().

Comment 15

[Justin Lebar (not reading bugmail)]

Ah, I have unit tests for this, but I haven't run them on the b2g branch.  Thanks for catching this!