After some more investigation, it turns out that this is caused by multiple calls to requestAnimationFrame (which is normal), e.g.:

function onAnimationFrame() {
  if display
    display.requestAnimationFrame(onAnimationFrame);
  else
    window.requestAnimationFrame(onAnimationFrame);
}
window.requestAnimationFrame(onAnimationFrame);


It's just that the tests that had multiple calls were also the only ones with cancelAnimationFrame, so it initially looked like that was the cause. Running the same test but using window.requestAnimationFrame for everything but the first call causes the test to pass without leaking.

After even more investigation, this seems to be caused by ending a test (test.done()) while there's still a pending callback registered via display.requestAnimationFrame. I'm not sure if this is reproducible in a normal webpage (not using testharness.js), but it looks to me like VRDisplay isn't properly cleaning up callbacks when destroyed, which I imagine it should.

+jrummell,xhwang who dealt with issues around promises after object destruction. This is a callback, but the issues _might_ be similar.

One solution I've found to this is to add a Vector<int> to VRDisplay, then:

1. Anytime requestAnimationFrame is called, the callback's handle is appended to the Vector.
2. Anytime serviceScriptedAnimations (as far as I can tell, this means anytime the callbacks added via requestAnimationFrame are run), the Vector is cleared.
3. When contextDestroyed is called (VRDisplay's destructor seems to run too late), call cancelAnimationFrame on any handles in the Vector.

I'm not aware of this causing any issues, but if someone sees a problem with this, feel free to object.

Just to update and prioritize this Beta blocker, M-57 gets branched next week and goes to Beta probably 1 or 2 weeks thereafter.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d8028087727891a6575e8209daecf58035a95723

commit d8028087727891a6575e8209daecf58035a95723
Author: bsheedy <bsheedy@chromium.org>
Date: Fri Jan 13 23:03:43 2017

Fix WebVR requestAnimationFrame leaking

Manually clear the Member<ScriptedAnimationController> handle in VRDisplay like Document does in order to prevent leaks when the Document is destroyed and there are still outstanding requestAnimationFrame callbacks.

Re-add the two layout tests that were failing due to detecting the leaks.

BUG= 679401 

Review-Url: https://codereview.chromium.org/2622943002
Cr-Commit-Position: refs/heads/master@{#443711}

[add] https://crrev.com/d8028087727891a6575e8209daecf58035a95723/third_party/WebKit/LayoutTests/vr/requestAnimationFrame_invalidhandle.html
[add] https://crrev.com/d8028087727891a6575e8209daecf58035a95723/third_party/WebKit/LayoutTests/vr/requestAnimationFrame_unregister.html
[modify] https://crrev.com/d8028087727891a6575e8209daecf58035a95723/third_party/WebKit/Source/modules/vr/VRDisplay.cpp

Tests pass with the --enable-leak-detection option that was causing them to fail without the fix, closing.