[Webkit-unassigned] [Bug 136970] New: Leak of mallocs under StructureSet::OutOfLineList::create
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Fri Sep 19 18:46:30 PDT 2014
https://bugs.webkit.org/show_bug.cgi?id=136970
Summary: Leak of mallocs under
StructureSet::OutOfLineList::create
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: joepeck at webkit.org
The leaks bot is seeing a lot of leaks of mallocs under StructureSet::OutOfLineList::create. The leak itself is small (48 bytes), but that is a large number of leaks:
<http://build.webkit.org/builders/Apple%20MountainLion%20%28Leaks%29/builds/11637/steps/layout-test/logs/stdio>
I don't have a test case, but the bots run frequently.
Example back traces show OutOfLineLists created in add, merge, and addOutOfLine:
Call stack: [thread 0x12f65a000]:
| thread_start
| _pthread_start
| WTF::wtfThreadEntryPoint(void*) ThreadingPthreads.cpp:170
| WTF::threadEntryPoint(void*) Threading.cpp:68
| JSC::DFG::Worklist::threadFunction(void*) DFGWorklist.cpp:401
| JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) DFGWorklist.cpp:358
| JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) DFGPlan.cpp:162
| JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) DFGPlan.cpp:347
| JSC::DFG::performCFA(JSC::DFG::Graph&) DFGCFAPhase.cpp:168
| bool JSC::DFG::runPhase<JSC::DFG::CFAPhase>(JSC::DFG::Graph&) DFGPhase.h:87
| bool JSC::DFG::runAndLog<JSC::DFG::CFAPhase>(JSC::DFG::CFAPhase&) DFGPhase.h:77
| JSC::DFG::CFAPhase::run() DFGCFAPhase.cpp:80
| JSC::DFG::CFAPhase::performForwardCFA() DFGCFAPhase.cpp:151
| JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock*) DFGCFAPhase.cpp:125
| JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::execute(unsigned int) DFGAbstractInterpreterInlines.h:1992
| JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects(unsigned int, JSC::DFG::Node*) DFGAbstractInterpreterInlines.h:1655
| JSC::StructureSet::merge(JSC::StructureSet const&) StructureSet.cpp:104
| JSC::StructureSet::OutOfLineList::create(unsigned int) StructureSet.cpp:387
| WTF::fastMalloc(unsigned long) FastMalloc.cpp:282
| malloc
| malloc_zone_malloc
Call stack: [thread 0x11b7a9000]:
| thread_start
| _pthread_start
| WTF::wtfThreadEntryPoint(void*) ThreadingPthreads.cpp:170
| WTF::threadEntryPoint(void*) Threading.cpp:68
| JSC::DFG::Worklist::threadFunction(void*) DFGWorklist.cpp:401
| JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) DFGWorklist.cpp:358
| JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) DFGPlan.cpp:162
| JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) DFGPlan.cpp:260
| JSC::DFG::performCFA(JSC::DFG::Graph&) DFGCFAPhase.cpp:168
| bool JSC::DFG::runPhase<JSC::DFG::CFAPhase>(JSC::DFG::Graph&) DFGPhase.h:87
| bool JSC::DFG::runAndLog<JSC::DFG::CFAPhase>(JSC::DFG::CFAPhase&) DFGPhase.h:77
| JSC::DFG::CFAPhase::run() DFGCFAPhase.cpp:80
| JSC::DFG::CFAPhase::performForwardCFA() DFGCFAPhase.cpp:151
| JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock*) DFGCFAPhase.cpp:125
| JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::execute(unsigned int) DFGAbstractInterpreterInlines.h:1992
| JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects(unsigned int, JSC::DFG::Node*) DFGAbstractInterpreterInlines.h:1489
| JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::observeTransition(unsigned int, JSC::Structure*, JSC::Structure*) DFGAbstractInterpreter.h:2077
| void JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::forAllValues<JSC::DFG::AbstractValue::TransitionObserver>(unsigned int, JSC::DFG::AbstractValue::TransitionObserver&) DFGAbstractInterpreterInlines.h:2059
| JSC::DFG::AbstractValue::TransitionObserver::operator()(JSC::DFG::AbstractValue&) DFGAbstractValue.h:131
| JSC::DFG::AbstractValue::observeTransition(JSC::Structure*, JSC::Structure*) DFGAbstractValue.h:113
| JSC::DFG::StructureAbstractValue::observeTransition(JSC::Structure*, JSC::Structure*) DFGStructureAbstractValue.cpp:95
| JSC::StructureSet::add(JSC::Structure*) StructureSet.cpp:50
| JSC::StructureSet::OutOfLineList::create(unsigned int) StructureSet.cpp:387
| WTF::fastMalloc(unsigned long) FastMalloc.cpp:282
| malloc
| malloc_zone_malloc
Leak: 0x7f912ce560e0 size=64 zone: DefaultMallocZone_0x10b933000
0x00000006 0x00000006 0x1a4937a0 0x00000001 .........7I.....
0x1a492c40 0x00000001 0x1a492460 0x00000001 @,I.....`$I.....
0x1a491b30 0x00000001 0x1a4984a0 0x00000001 0.I.......I.....
0x1a497ef0 0x00000001 0x00000000 0x00040000 .~I.............
Call stack: [thread 0x11fe42000]:
| thread_start
| _pthread_start
| WTF::wtfThreadEntryPoint(void*) ThreadingPthreads.cpp:170
| WTF::threadEntryPoint(void*) Threading.cpp:68
| JSC::DFG::Worklist::threadFunction(void*) DFGWorklist.cpp:401
| JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) DFGWorklist.cpp:358
| JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) DFGPlan.cpp:162
| JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) DFGPlan.cpp:207
| JSC::DFG::parse(JSC::DFG::Graph&) DFGByteCodeParser.cpp:3941
| JSC::DFG::ByteCodeParser::parse() DFGByteCodeParser.cpp:3916
| JSC::DFG::ByteCodeParser::parseCodeBlock() DFGByteCodeParser.cpp:3856
| JSC::DFG::ByteCodeParser::parseBlock(unsigned int) DFGByteCodeParser.cpp:2854
| JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, JSC::CodeOrigin, WTF::StringImpl*) GetByIdStatus.cpp:264
| JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, unsigned int, WTF::StringImpl*) GetByIdStatus.cpp:102
| JSC::GetByIdStatus::computeForStubInfo(JSC::ConcurrentJITLocker const&, JSC::CodeBlock*, JSC::StructureStubInfo*, WTF::StringImpl*, JSC::CallLinkStatus::ExitSiteData) GetByIdStatus.cpp:208
| JSC::GetByIdStatus::appendVariant(JSC::GetByIdVariant const&) GetByIdStatus.cpp:45
| JSC::GetByIdVariant::attemptToMerge(JSC::GetByIdVariant const&) GetByIdVariant.cpp:99
| JSC::StructureSet::merge(JSC::StructureSet const&) StructureSet.cpp:97
| JSC::StructureSet::add(JSC::Structure*) StructureSet.cpp:58
| JSC::StructureSet::addOutOfLine(JSC::Structure*) StructureSet.cpp:355
| JSC::StructureSet::OutOfLineList::create(unsigned int) StructureSet.cpp:387
| WTF::fastMalloc(unsigned long) FastMalloc.cpp:282
| malloc
| malloc_zone_malloc
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list