963878 - Leak with large text node containing LRO

Status: RESOLVED WORKSFORME

(Core :: Layout: Text and Fonts, defect, P3)

Description

[Jesse Ruderman]

Attachment: testcase

1. Run Firefox with XPCOM_MEM_LEAK_LOG=2
2. Load the testcase
3. Quit Firefox

Result: trace-refcnt reports that Firefox leaked an "nsTArray_base" object.

This is a regression from bug 955957.

Comment 1

[Jonathan Kew [:jfkthame]]

I don't think bug 955957 has actually introduced a new leak, as it didn't change anything about the ownership or lifetime of gfxSkipChars; however, the old implementation was not tracked by the leak-checking code, so we didn't notice. Now that it has an nsTArray member, suddenly it becomes visible.

I believe the object being leaked here is the static const variable emptySkipChars from http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsTextFrame.cpp#2617. As a static, it gets created (including its nsTArray member) the first time we hit this particular codepath (if at all), and then never gets deleted.

It appears that BuildTextRun() is failing to construct the necessary textrun for a frame in this example, but I haven't tracked down why that's happening or whether it will result in other problems (though the "this is bad" comment at http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsTextFrame.cpp#2615 is worrying). The apparent leak is simply a side-effect of this failure.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

No longer reproduces on trunk.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/086fe27b8650
Add crashtest. r=me

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/086fe27b8650