[Webkit-unassigned] [Bug 195322] New: REGRESSION(r236862): early frame decoupling leaves JSC ArrayBuffer objects lingering

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Mar 5 01:52:55 PST 2019


https://bugs.webkit.org/show_bug.cgi?id=195322

            Bug ID: 195322
           Summary: REGRESSION(r236862): early frame decoupling leaves JSC
                    ArrayBuffer objects lingering
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: New Bugs
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: zan at falconsigh.net
                CC: cdumez at apple.com, rniwa at webkit.org

With frame detachment changes made in r236862, it seems JSC resources can persist beyond frame destruction.
https://trac.webkit.org/changeset/236862/webkit

The observed case is the one of ArrayBuffer resources that are kept alive during the JetStream benchmark execution. After r236862, at the end of a JetStream run there can be about 25 ArrayBuffer objects still referenced in the JSC heap and thus deferred for allocation through the GCIncomingRefCountedSet mechanism. This totals to over 700MB of extra memory at the end of a JetStream run. Before r236862 these ArrayBuffer objects were properly cleaned up during the run with only one or two objects remaining alive at the end of the run due to being used in the last few test cases, totalling ~150MB in size.

In r236862 specifically, the problem is a side effect of the early decoupling from the Frame object in DOMWindow::willDetachDocumentFromFrame(). This was further reorganized in later changes, but the problem remains present and can be observed on both Mac and Linux ports.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190305/da4da42b/attachment.html>


More information about the webkit-unassigned mailing list