Changeset 270496 in webkit

Timestamp:

Dec 7, 2020, 1:19:31 AM (6 years ago)

Author:

commit-queue@webkit.org

Message:

[GLib] Leaked RunLoop objects on worker threads
​https://bugs.webkit.org/show_bug.cgi?id=219232
<rdar://problem/71772277>

Patch by Zan Dobersek <​zdobersek@igalia.com> on 2020-12-07
Reviewed by Geoffrey Garen.

Source/WTF:

During the thread-local RunLoop::Holder destruction, explicitly clear out
the iteration Deque objects on the held RunLoop, destroying any Function
objects that never got to execute on this thread. Generally, this allows
for any RunLoop reference stored in these objects to be released.

Specifically, this would allow for destruction of the RunLoop::Timer
object that's queued up in the JSRunLoopTimer::Manager::PerVMData
destructor but never gets dispatched because the thread (a JS worker) is
shut down before that happens. Destruction of the timer will release the
reference of the RunLoop that's held by the RunLoop::Holder, finally
enabling the RunLoop object itself be destroyed once the RunLoop::Holder
reference is let go.

• wtf/RunLoop.cpp:

(WTF::RunLoop::Holder::~Holder):
(WTF::RunLoop::threadWillExit):

• wtf/RunLoop.h:

Tools:

Add a unit test covering proper RunLoop teardown upon thread destruction
even if RunLoop references are stored in the dispatch queues.

• TestWebKitAPI/Tests/WTF/RunLoop.cpp:

(TestWebKitAPI::TEST):

Location:

trunk

Files:

• Source/WTF/ChangeLog (modified) (1 diff)
• Source/WTF/wtf/RunLoop.cpp (modified) (2 diffs)
• Source/WTF/wtf/RunLoop.h (modified) (1 diff)
• Tools/ChangeLog (modified) (1 diff)
• Tools/TestWebKitAPI/Tests/WTF/RunLoop.cpp (modified) (1 diff)

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2020-12-07  Zan Dobersek  <zdobersek@igalia.com>
+
+        [GLib] Leaked RunLoop objects on worker threads
+        https://bugs.webkit.org/show_bug.cgi?id=219232
+        <rdar://problem/71772277>
+
+        Reviewed by Geoffrey Garen.
+
+        During the thread-local RunLoop::Holder destruction, explicitly clear out
+        the iteration Deque objects on the held RunLoop, destroying any Function
+        objects that never got to execute on this thread. Generally, this allows
+        for any RunLoop reference stored in these objects to be released.
+
+        Specifically, this would allow for destruction of the RunLoop::Timer
+        object that's queued up in the JSRunLoopTimer::Manager::PerVMData
+        destructor but never gets dispatched because the thread (a JS worker) is
+        shut down before that happens. Destruction of the timer will release the
+        reference of the RunLoop that's held by the RunLoop::Holder, finally
+        enabling the RunLoop object itself be destroyed once the RunLoop::Holder
+        reference is let go.
+
+        * wtf/RunLoop.cpp:
+        (WTF::RunLoop::Holder::~Holder):
+        (WTF::RunLoop::threadWillExit):
+        * wtf/RunLoop.h:
+
 2020-12-06  Samuel Thibault  <samuel.thibault@ens-lyon.org>
 

trunk/Source/WTF/wtf/RunLoop.cpp

@@ -45 +45 @@
         : m_runLoop(adoptRef(*new RunLoop))
     {
+    }
+
+    ~Holder()
+    {
+        m_runLoop->threadWillExit();
     }
 
@@ -167 +172 @@
 }
 
+void RunLoop::threadWillExit()
+{
+    m_currentIteration.clear();
+    m_nextIteration.clear();
+}
+
 } // namespace WTF

trunk/Source/WTF/wtf/RunLoop.h

@@ -98 +98 @@
     WTF_EXPORT_PRIVATE CycleResult static cycle(RunLoopMode = DefaultRunLoopMode);
 
+    WTF_EXPORT_PRIVATE void threadWillExit();
+
 #if USE(GLIB_EVENT_LOOP)
     WTF_EXPORT_PRIVATE GMainContext* mainContext() const { return m_mainContext.get(); }

trunk/Tools/ChangeLog

@@ +1 @@
+2020-12-07  Zan Dobersek  <zdobersek@igalia.com>
+
+        [GLib] Leaked RunLoop objects on worker threads
+        https://bugs.webkit.org/show_bug.cgi?id=219232
+        <rdar://problem/71772277>
+
+        Reviewed by Geoffrey Garen.
+
+        Add a unit test covering proper RunLoop teardown upon thread destruction
+        even if RunLoop references are stored in the dispatch queues.
+
+        * TestWebKitAPI/Tests/WTF/RunLoop.cpp:
+        (TestWebKitAPI::TEST):
+
 2020-12-04  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Tools/TestWebKitAPI/Tests/WTF/RunLoop.cpp

@@ -216 +216 @@
 }
 
+TEST(WTF_RunLoop, ThreadTerminationSelfReferenceCleanup)
+{
+    RefPtr<RunLoop> runLoop;
+
+    Thread::create("RunLoopThreadTerminationSelfReferenceCleanup", [&] {
+        runLoop = makeRefPtr(RunLoop::current());
+
+        // This stores a RunLoop reference in the dispatch queue that will not be released
+        // via the usual dispatch, but should still be released upon thread termination.
+        // After that, the observing RefPtr should be the only one holding a reference
+        // to the RunLoop object.
+        runLoop->dispatch([ref = runLoop.copyRef()] { });
+    })->waitForCompletion();
+
+    EXPECT_TRUE(runLoop->hasOneRef());
+}
+
 } // namespace TestWebKitAPI