Bug 256935 - WebKitTestRunner --world-leaks reports false positives
Summary: WebKitTestRunner --world-leaks reports false positives
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: Tools / Tests (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-05-17 17:44 PDT by Ryan Reno
Modified: 2023-05-18 16:57 PDT (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ryan Reno 2023-05-17 17:44:34 PDT
> run-webkit-tests --world-leaks fast/canvas/webgl/webgl2/bindings.html
> run-webkit-tests --world-leaks fast/canvas/webgl/webgl-reload-crash.html

These canvas tests will report a leaked document but it is not reproducible from MiniBrowser. If you navigate to the test then go to about:blank and issue a low memory warning followed by showAllDocuments, only the about:blank document and page are live.


I tried disabling the BackForwardCache and setting the CacheModel to DocumentBrowser in MiniBrowser to match WKTR but still cannot reproduce the leak. It appears the false positive is indeed due to a leaked document but I think there's something else going on. If you pause the test runner after it gets the list of live documents but before it finishes the test (TestController::didReceiveLiveDocumentsList) then ask for a GC heap dump the leaked document will be collected. Put a breakpoint in Document::~Document and issue the following command:

> notifyutil -p com.apple.WebKit.dumpGCHeap

While the WKTR process is paused the WebContent process will start a GC in response to the notification which will lead to the last JSEventTarget wrapper to be GC'd which will allow the Document to be destroyed. Something specific to WKTR must be keeping documents alive in some layout tests.
Comment 1 Radar WebKit Bug Importer 2023-05-17 17:44:48 PDT
<rdar://problem/109488830>
Comment 2 Alexey Proskuryakov 2023-05-18 15:02:22 PDT
As we use conservative GC, there can never be a guarantee that everything unused is collected.
Comment 3 Ryan Reno 2023-05-18 15:22:39 PDT
Even when doing full, sync GC like we do in this case? (x2)
Comment 4 Alexey Proskuryakov 2023-05-18 16:57:22 PDT
Correct. There can always be some pointer stuck in memory that hasn't been overwritten, or on stack.