New issue
Advanced search Search tips

Issue 590802 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 2
Type: Bug

Blocking:
issue 773605



Sign in to add a comment

ScriptState leaks on ThreadState detach in worker threads

Project Member Reported by yhirano@chromium.org, Feb 29 2016

Issue description

What steps will reproduce the problem?
1. Apply https://codereview.chromium.org/1744383002/ (Compiling it fails on Windows)
2. Run LayoutTests/fast/workers/worker-terminate-leak.html
3. See the standard error.

What is the expected output? What do you see instead?

The number of the ScriptState constructor calls should equal to the number of the ScriptState destructor.
Instead I see the following output.

>>>>
blink::ScriptState::ScriptState(v8::Local<v8::Context>, PassRefPtr<blink::DOMWrapperWorld>) this = 0x604000123b50, isMainThread = 1
blink::ScriptState::ScriptState(v8::Local<v8::Context>, PassRefPtr<blink::DOMWrapperWorld>) this = 0x60400012f1d0, isMainThread = 0
blink::ScriptState::ScriptState(v8::Local<v8::Context>, PassRefPtr<blink::DOMWrapperWorld>) this = 0x604000149ad0, isMainThread = 1
<<<<

 
Summary: ScriptState leaks on ThreadState detach in worker threads (was: ScriptState leaks on ThreadState detach)
I'm talking about the ScriptState in a worker (the second line).
Maybe you need to run gc() multiple times before finishing the test?

I think this is not specific to tests but the context is leaking in the production code.
ScriptState::ref() is called directly in ScriptState::create, but the corresponding deref is not called.
Neither weakCallback nor derefCallback in the file is called in the thread termination sequence.


Cc: nhiroki@chromium.org
https://bugs.chromium.org/p/v8/issues/detail?id=1428

Offline discussion: We don't care about the leak. We should suppress the report.
Status: WontFix (was: Assigned)

Comment 9 by peria@chromium.org, Mar 29 2018

Blocking: 773605
Components: Blink>MemoryAllocator
peria@: It looks odd that the wontfix issue is blocking the other open issue. Is this just for later reference? If not, can you reopen this issue?
Cc: peria@chromium.org
+peria@: See c#10

Comment 12 by peria@chromium.org, Mar 29 2018

Status: Available (was: WontFix)
Thanks. Yes, I reopen it, because this can be an issue again.

Background:

1. ScriptState has a self-retained reference, and it is released when the associated v8::Context is destructed by a callback.
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/platform/bindings/ScriptState.cpp?l=23,40

2. To achieve it, we have to run V8 GC to collect v8::Context, but we don't call it at the moment.

3.  Issue 773605  is to move ScriptState to Oilpan heap, and it means ScriptState will have a self-persistent handle (SelfKeepAlive) as a substitution of self-reference.

4. At the situation, we call ThreadState::RunTerminationGC() before V8 GC, and hits a DCHECK of ThreadState::RunTerminationGC() internally, because of the self-persistent handle of leaked ScriptState.


The main concern is in DCHECK, so we can take either action
1) remove the DCHECK and some other related checks.
2) force V8 GC before ThreadState::RunTerminationGC(). It means we set WorkerBackingThread::should_call_gc_on_shutdown_ true if DHCECK_IS_ON().
3) something else...

Project Member

Comment 13 by bugdroid1@chromium.org, Jun 6 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/02bf53e3fce07e52962351eb3f44dac56bb7dc6d

commit 02bf53e3fce07e52962351eb3f44dac56bb7dc6d
Author: Hitoshi Yoshida <peria@chromium.org>
Date: Wed Jun 06 11:37:26 2018

worker: Remove WorkerBackingThread::CreateForTest()

With works around terminate GC, we no longer need to
run additional GCs at thread termination.
This CL removes such test only behavior and cleans up
code of paths to it.


Bug:  590802 
Change-Id: Icf17118744c785a5a6d0f3e8e6101da1cf9ad3bc
Reviewed-on: https://chromium-review.googlesource.com/1088536
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Hiroki Nakagawa <nhiroki@chromium.org>
Commit-Queue: Hitoshi Yoshida <peria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#564858}
[modify] https://crrev.com/02bf53e3fce07e52962351eb3f44dac56bb7dc6d/third_party/blink/renderer/core/workers/dedicated_worker_test.cc
[modify] https://crrev.com/02bf53e3fce07e52962351eb3f44dac56bb7dc6d/third_party/blink/renderer/core/workers/worker_backing_thread.cc
[modify] https://crrev.com/02bf53e3fce07e52962351eb3f44dac56bb7dc6d/third_party/blink/renderer/core/workers/worker_backing_thread.h
[modify] https://crrev.com/02bf53e3fce07e52962351eb3f44dac56bb7dc6d/third_party/blink/renderer/core/workers/worker_thread_test_helper.h
[modify] https://crrev.com/02bf53e3fce07e52962351eb3f44dac56bb7dc6d/third_party/blink/renderer/core/workers/worklet_thread_holder.h

Owner: peria@chromium.org
Status: Fixed (was: Available)

Sign in to add a comment