Bug 180319

Summary:	Wasm::ModuleInformation leaks
Product:	WebKit	Reporter:	Alexey Proskuryakov <ap>
Component:	WebAssembly	Assignee:	Nobody <webkit-unassigned>
Status:	NEW
Severity:	Normal	CC:	jfbastien, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	Safari 9
Hardware:	Unspecified
OS:	Unspecified

Alexey Proskuryakov

Reported 2017-12-02 15:36:09 PST

I'm getting a reproducible leak on WebKit regression tests. run-webkit-tests -1 --leaks --no-retry --no-build --no-show --no-sample --debug-rwt-logging http/tests/security/contentSecurityPolicy/WebAssembly-blocked-in-subframe.html --repeat 10 JSC::webAssemblyValidateFunc(JSC::ExecState*) WebAssemblyPrototype.cpp:227 | JSC::Wasm::BBQPlan::BBQPlan(JSC::Wasm::Context*, unsigned char const*, unsigned long, JSC::Wasm::BBQPlan::AsyncWork, WTF::RefPtr<WTF::SharedTask<void (JSC::Wasm::Plan&)> >&&) WasmBBQPlan.cpp:72 | JSC::Wasm::BBQPlan::BBQPlan(JSC::Wasm::Context*, unsigned char const*, unsigned long, JSC::Wasm::BBQPlan::AsyncWork, WTF::RefPtr<WTF::SharedTask<void (JSC::Wasm::Plan&)> >&&) WasmBBQPlan.cpp:68 | JSC::Wasm::Plan::Plan(JSC::Wasm::Context*, unsigned char const*, unsigned long, WTF::RefPtr<WTF::SharedTask<void (JSC::Wasm::Plan&)> >&&) WasmPlan.cpp:68 | JSC::Wasm::ModuleInformation::ModuleInformation(WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&) WasmModuleInformation.cpp:39 | JSC::Wasm::ModuleInformation::ModuleInformation(WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&) WasmModuleInformation.cpp:37 | WTF::ThreadSafeRefCountedBase::operator new(unsigned long) ThreadSafeRefCounted.h:36

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2017-12-02 15:36:29 PST

<rdar://problem/35816264>

JF Bastien

Comment 2 2017-12-04 11:11:39 PST

Interesting, will look into it. I know the GC was retaining WebAssembly modules a bit ago (which themselves retain WasmModuleInformation), I wonder if that's the problem or if we don't ref properly. If it's the former then we have to figure out where we're missing a stack cleanup.

Alexey Proskuryakov

Comment 3 2017-12-18 14:57:20 PST

This is an actual leak (memory without any pointers to it).

Note You need to log in before you can comment on or make changes to this bug.