[Webkit-unassigned] [Bug 131544] New: cached scripts leak in non JIT mode
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Fri Apr 11 09:40:26 PDT 2014
https://bugs.webkit.org/show_bug.cgi?id=131544
Summary: cached scripts leak in non JIT mode
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: abaldeva at ea.com
Hi,
If you build JavaScriptCore without JIT support, it leaks cached scripts. This can be verified by continuously reloading the sunspider test suite (any version would do).The C Loop interpreter path memory usage goes up to 200 MB within few minutes. The JIT path does not suffer from this problem.
The reason for the leak is ENABLE(JIT) define around few destroy calls in Executable.h/cpp. For example, when a ProgramExecutable is created, it adds a ref to the JSC::SourceCode::m_provider. However, if you turn off JIT, the allocateCell ends up putting it in heap.allocateWithoutDestructor. Since the destructor/destroy is not called anymore, the ref leaks when JIT is not enabled.
I have verified that removing ENABLE(JIT) from 6 places in the Executable.h/cpp resolves this issue (around the destroy function declaration/implementation).
Executable.h
class ExecutableBase -
static const bool needsDestruction = true;
static const bool hasImmortalStructure = true;
static void destroy(JSCell*); + 1 around the definition
class NativeExecutable -
static void destroy(JSCell*); + 1 around the definition
class ScriptExecutable -
static void destroy(JSCell*); + 1 around the definition
Unfortunately, I am not set up to submit patches as described here(http://www.webkit.org/coding/contributing.html) however hopefully this is enough info to allow somebody else to land the patch.
Appreciate your help.
Thanks
Arpit
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list