New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 626266 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 3
Type: Bug



Sign in to add a comment

blink::createClosure (and therefore ScriptFunction) leaks memory

Project Member Reported by jochen@chromium.org, Jul 7 2016

Issue description

v8::Function::New creates a FunctionTemplate that cannot be reclaimed ever.

If a function for the same callback has to be created multiple times, we should create a dedicated FunctionTemplate and reuse that.
 
Cc: yukishiino@chromium.org
blink::createClosure() is used only in ScriptFunction and two tests.

The use cases in the two tests are simply wrong, and we should remove it.

ScriptFunction needs to create a different instance of function object for each C++ instance, so we shouldn't use v8::FunctionTemplate.

I think we should remove the use cases in the two tests, and also remove createClosure() and inline it in ScriptFunction::bindToV8Function().
Project Member

Comment 3 by bugdroid1@chromium.org, Jul 25 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/19832e78567e1a69a9d1f99761494b54b9aa67fa

commit 19832e78567e1a69a9d1f99761494b54b9aa67fa
Author: yukishiino <yukishiino@chromium.org>
Date: Mon Jul 25 11:52:09 2016

binding: Removes createClosure().

createClosure is used only at ScriptFunction::bindToV8Function,
and it shouldn't be used widely because it doesn't create
a v8::FunctionTemplate or reuse it.  Thus, this CL removes it.

BUG=626266

Review-Url: https://codereview.chromium.org/2173843002
Cr-Commit-Position: refs/heads/master@{#407451}

[modify] https://crrev.com/19832e78567e1a69a9d1f99761494b54b9aa67fa/third_party/WebKit/Source/bindings/core/v8/ScriptFunction.cpp
[modify] https://crrev.com/19832e78567e1a69a9d1f99761494b54b9aa67fa/third_party/WebKit/Source/bindings/core/v8/ScriptFunction.h
[modify] https://crrev.com/19832e78567e1a69a9d1f99761494b54b9aa67fa/third_party/WebKit/Source/bindings/core/v8/V8Binding.h

Owner: yukishiino@chromium.org
Status: Fixed (was: Untriaged)
Status: Assigned (was: Fixed)
I was misunderstanding the issue and I was totally missing Jochen's point.  I reopen the issue.
Cc: mtrofin@chromium.org
Hi Jochen and Toon,

It seems like that V8 is now able to collect unused FunctionTemplates.  Maybe something changed in V8?  As I tested, FunctionTemplates seem collectable as same as any other objects, not limited to v8::Function::New case, but also weak v8::Persistent<v8::FunctionTemplate> is collected.

Am I understanding the situation correctly?
They are reclaimed when unused, but not when the function is still live (obviously).

From the description of the issue it sounds like we create multiple similar closures using createClosure (e.g., same underlying callback). If that's the case, we should create a single FunctionTemplate for that callback first, and then create the closures from that. That way we can share the FunctionTemplate and SharedFunctionInfo on the V8 side, and only need to allocate a much thinner JSFunction.

I suppose leak is the wrong word. Rather bloats.
That makes sense.

In case of ScriptFunction, v8::Function::New is expected to be called only once.

https://cs.chromium.org/chromium/src/third_party/WebKit/Source/bindings/core/v8/ScriptFunction.h?rcl=a1356693554cd0bdb5b1cc4bc406896346fa3159&l=73

So it shouldn't be a big problem so far.

Thanks a lot.  The explanation lets me get the correct understanding.

Sign in to add a comment