I'm working on an embedded product which uses a WebKit-based browser,
and I've been tracking down some memory leaks we're seeing.  After a
long while of digging through the codebase, I've been able to determine
that we're occasionally leaking the WebCore::Document object when
leaving certain websites.  A bit more tracing reveals that the Document
object is being retained because an HTMLImageElement holds a DocPtr
reference on it, and the element isn't going away when the normal
refcount on the Document drops to 0.  This pins the Document object in
memory.&nbsp; <br>
<br>The specific site I&#39;ve been testing with is <a href="http://www.yahoo.com">www.yahoo.com</a>.&nbsp; Examining the source code to that page reveals the following in the page&#39;s beforeUnload event:<br><br>window.onbeforeunload=function(){<br>
<div id=":13j" class="ArwC7c ckChnd">
var img=new Image;<br>now=new Date;<br>t6=now.getTime();<br>img.src=&#39;<a href="http://www.yahoo.com/&#39;+(ylp?ylp:&#39;p.gif?t=0&#39;)+cc+&#39;&amp;tid=&#39;+ver+&#39;&amp;ni=&#39;+document.images.length+&#39;&amp;sss=&#39;+sss+&#39;&amp;t1=&#39;+t1+&#39;&amp;d1=&#39;+(t2-t1)+&#39;&amp;d2=&#39;+(t3-t1)+&#39;&amp;d3=&#39;+(t4-t1)+&#39;&amp;d4=&#39;+(t5-t1)+&#39;&amp;d5=&#39;+(t6-t1)">http://www.yahoo.com/&#39;+(ylp?ylp:&#39;p.gif?t=0&#39;)+cc+&#39;&amp;tid=&#39;+ver+&#39;&amp;ni=&#39;+document.images.length+&#39;&amp;sss=&#39;+sss+&#39;&amp;t1=&#39;+t1+&#39;&amp;d1=&#39;+(t2-t1)+&#39;&amp;d2=&#39;+(t3-t1)+&#39;&amp;d3=&#39;+(t4-t1)+&#39;&amp;d4=&#39;+(t5-t1)+&#39;&amp;d5=&#39;+(t6-t1)</a> +&#39;&amp;d6=&#39;+(t7-t1)+&#39;&amp;d7=&#39;+(t8-t1)+&#39;&amp;d8=&#39;+(t9-t1)+&#39;&amp;d9=&#39;+(t10-t1)+&#39;&amp;d10=&#39;+(t11-t1)+&#39;&amp;d11=&#39;+(t12-t1);<br>

}<br><br>It
appears that this Image object is never being removed--I can repeatedly
navigate to and from this site and watch HTMLImageElements (and their
associated Document objects) pile up.&nbsp; <br><br>I&#39;m still not convinced
this is a WebKit problem specifically (there&#39;s a fair amount of code
surrounding it in our product that could potentially have bugs in it),
but to continue tracing the problem, I need to know what the mechanism
is that *ought* to be freeing this object.&nbsp; I presume this is something
that should be taken care of by the JavaScript garbage collector,
however I can see JavaScriptCore::Collector::collect() calls
running occasionally after this object is created, and it never goes
away.&nbsp; Is there some immediately apparent reason why this wouldn&#39;t be
happening?&nbsp; I.e., is there something else that would be holding a
reference to an object created by this type of script code, or is
something other than the GC responsible for freeing it, etc?<br>
<br>My apologies if this turns out to be a stupid question--I&#39;m just trying to get some context for where I ought to focus next.<br><br>Thanks,<br>Matt</div>