[Webkit-unassigned] [Bug 136970] New: Leak of mallocs under StructureSet::OutOfLineList::create

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Fri Sep 19 18:46:30 PDT 2014


https://bugs.webkit.org/show_bug.cgi?id=136970

           Summary: Leak of mallocs under
                    StructureSet::OutOfLineList::create
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: joepeck at webkit.org


The leaks bot is seeing a lot of leaks of mallocs under StructureSet::OutOfLineList::create. The leak itself is small (48 bytes), but that is a large number of leaks:
<http://build.webkit.org/builders/Apple%20MountainLion%20%28Leaks%29/builds/11637/steps/layout-test/logs/stdio>

I don't have a test case, but the bots run frequently.

Example back traces show OutOfLineLists created in add, merge, and addOutOfLine:

    Call stack: [thread 0x12f65a000]: 
        | thread_start 
        | _pthread_start 
        | WTF::wtfThreadEntryPoint(void*) ThreadingPthreads.cpp:170 
        | WTF::threadEntryPoint(void*) Threading.cpp:68 
        | JSC::DFG::Worklist::threadFunction(void*) DFGWorklist.cpp:401 
        | JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) DFGWorklist.cpp:358 
        | JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) DFGPlan.cpp:162 
        | JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) DFGPlan.cpp:347 
        | JSC::DFG::performCFA(JSC::DFG::Graph&) DFGCFAPhase.cpp:168 
        | bool JSC::DFG::runPhase<JSC::DFG::CFAPhase>(JSC::DFG::Graph&) DFGPhase.h:87 
        | bool JSC::DFG::runAndLog<JSC::DFG::CFAPhase>(JSC::DFG::CFAPhase&) DFGPhase.h:77 
        | JSC::DFG::CFAPhase::run() DFGCFAPhase.cpp:80 
        | JSC::DFG::CFAPhase::performForwardCFA() DFGCFAPhase.cpp:151 
        | JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock*) DFGCFAPhase.cpp:125 
        | JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::execute(unsigned int) DFGAbstractInterpreterInlines.h:1992 
        | JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects(unsigned int, JSC::DFG::Node*) DFGAbstractInterpreterInlines.h:1655 
        | JSC::StructureSet::merge(JSC::StructureSet const&) StructureSet.cpp:104 
        | JSC::StructureSet::OutOfLineList::create(unsigned int) StructureSet.cpp:387 
        | WTF::fastMalloc(unsigned long) FastMalloc.cpp:282 
        | malloc 
        | malloc_zone_malloc 

    Call stack: [thread 0x11b7a9000]: 
        | thread_start 
        | _pthread_start 
        | WTF::wtfThreadEntryPoint(void*) ThreadingPthreads.cpp:170 
        | WTF::threadEntryPoint(void*) Threading.cpp:68 
        | JSC::DFG::Worklist::threadFunction(void*) DFGWorklist.cpp:401 
        | JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) DFGWorklist.cpp:358 
        | JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) DFGPlan.cpp:162 
        | JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) DFGPlan.cpp:260 
        | JSC::DFG::performCFA(JSC::DFG::Graph&) DFGCFAPhase.cpp:168 
        | bool JSC::DFG::runPhase<JSC::DFG::CFAPhase>(JSC::DFG::Graph&) DFGPhase.h:87 
        | bool JSC::DFG::runAndLog<JSC::DFG::CFAPhase>(JSC::DFG::CFAPhase&) DFGPhase.h:77 
        | JSC::DFG::CFAPhase::run() DFGCFAPhase.cpp:80 
        | JSC::DFG::CFAPhase::performForwardCFA() DFGCFAPhase.cpp:151 
        | JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock*) DFGCFAPhase.cpp:125 
        | JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::execute(unsigned int) DFGAbstractInterpreterInlines.h:1992 
        | JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects(unsigned int, JSC::DFG::Node*) DFGAbstractInterpreterInlines.h:1489 
        | JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::observeTransition(unsigned int, JSC::Structure*, JSC::Structure*) DFGAbstractInterpreter.h:2077 
        | void JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::forAllValues<JSC::DFG::AbstractValue::TransitionObserver>(unsigned int, JSC::DFG::AbstractValue::TransitionObserver&) DFGAbstractInterpreterInlines.h:2059 
        | JSC::DFG::AbstractValue::TransitionObserver::operator()(JSC::DFG::AbstractValue&) DFGAbstractValue.h:131 
        | JSC::DFG::AbstractValue::observeTransition(JSC::Structure*, JSC::Structure*) DFGAbstractValue.h:113 
        | JSC::DFG::StructureAbstractValue::observeTransition(JSC::Structure*, JSC::Structure*) DFGStructureAbstractValue.cpp:95 
        | JSC::StructureSet::add(JSC::Structure*) StructureSet.cpp:50 
        | JSC::StructureSet::OutOfLineList::create(unsigned int) StructureSet.cpp:387 
        | WTF::fastMalloc(unsigned long) FastMalloc.cpp:282 
        | malloc 
        | malloc_zone_malloc 

Leak: 0x7f912ce560e0  size=64  zone: DefaultMallocZone_0x10b933000
    0x00000006 0x00000006 0x1a4937a0 0x00000001     .........7I.....
    0x1a492c40 0x00000001 0x1a492460 0x00000001     @,I.....`$I.....
    0x1a491b30 0x00000001 0x1a4984a0 0x00000001     0.I.......I.....
    0x1a497ef0 0x00000001 0x00000000 0x00040000     .~I.............
    Call stack: [thread 0x11fe42000]: 
        | thread_start 
        | _pthread_start 
        | WTF::wtfThreadEntryPoint(void*) ThreadingPthreads.cpp:170 
        | WTF::threadEntryPoint(void*) Threading.cpp:68 
        | JSC::DFG::Worklist::threadFunction(void*) DFGWorklist.cpp:401 
        | JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) DFGWorklist.cpp:358 
        | JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) DFGPlan.cpp:162 
        | JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) DFGPlan.cpp:207 
        | JSC::DFG::parse(JSC::DFG::Graph&) DFGByteCodeParser.cpp:3941 
        | JSC::DFG::ByteCodeParser::parse() DFGByteCodeParser.cpp:3916 
        | JSC::DFG::ByteCodeParser::parseCodeBlock() DFGByteCodeParser.cpp:3856 
        | JSC::DFG::ByteCodeParser::parseBlock(unsigned int) DFGByteCodeParser.cpp:2854 
        | JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, JSC::CodeOrigin, WTF::StringImpl*) GetByIdStatus.cpp:264 
        | JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, unsigned int, WTF::StringImpl*) GetByIdStatus.cpp:102 
        | JSC::GetByIdStatus::computeForStubInfo(JSC::ConcurrentJITLocker const&, JSC::CodeBlock*, JSC::StructureStubInfo*, WTF::StringImpl*, JSC::CallLinkStatus::ExitSiteData) GetByIdStatus.cpp:208 
        | JSC::GetByIdStatus::appendVariant(JSC::GetByIdVariant const&) GetByIdStatus.cpp:45 
        | JSC::GetByIdVariant::attemptToMerge(JSC::GetByIdVariant const&) GetByIdVariant.cpp:99 
        | JSC::StructureSet::merge(JSC::StructureSet const&) StructureSet.cpp:97 
        | JSC::StructureSet::add(JSC::Structure*) StructureSet.cpp:58 
        | JSC::StructureSet::addOutOfLine(JSC::Structure*) StructureSet.cpp:355 
        | JSC::StructureSet::OutOfLineList::create(unsigned int) StructureSet.cpp:387 
        | WTF::fastMalloc(unsigned long) FastMalloc.cpp:282 
        | malloc 
        | malloc_zone_malloc

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list