Describe the bug:
The current implemention for HTMLMediaElement creates cyclic reference dependency between HTMLMediaElement and ipc::TypedRouterHandler so SpiderMonkey is not able to garbage collect HTMLMediaElement due to existed live reference (Trusted<HTMLMediaElement>).
|
let this = trusted_node.clone(); |
Why it happens?
HTMLMediaElement owns servo_media::Player which owns IpcSender<PlayerEvent>
ipc::ROUTER owns Trusted<HTMLMediaElement> (captured inside ipc::TypedRouterHandler) and IpcReceiver<PlayerEvent>
After the latest existed reference in JS will be drop, SM still is able to trace HTMLMediaElement via live reference (Trusted<>) and NOT able drop HTMLMediaElement and reset servo_media::Player which will destroy IpcSender<PlayerEvent>, so later ipc::ROUTER will be notified about it and will release associated ipc::TypedRouterHandler (with Trusted<HTMLMediaElement>).
To Reproduce:
- Run ./mach test-wpt tests/wpt/tests/html/semantics/embedded-content/the-video-element/intrinsic_sizes.htm
- Rerun N (10+) times
- Close window
- Check logging with the following patch (multiple HTMLMediaElement will be dropped at once)
impl Drop for HTMLMediaElement {
fn drop(&mut self) {
println!(
"HTMLMediaElement::drop ({:p}) has_player = {:?} video_renderer.refcount = {:?}",
self,
self.player.borrow().is_some(),
Arc::strong_count(&self.video_renderer),
);
}
}
Platform:
Ubuntu 22.04
Describe the bug:
The current implemention for
HTMLMediaElementcreates cyclic reference dependency betweenHTMLMediaElementandipc::TypedRouterHandlerso SpiderMonkey is not able to garbage collectHTMLMediaElementdue to existed live reference (Trusted<HTMLMediaElement>).servo/components/script/dom/html/htmlmediaelement.rs
Line 1867 in 0140b17
Why it happens?
HTMLMediaElementownsservo_media::Playerwhich ownsIpcSender<PlayerEvent>ipc::ROUTERownsTrusted<HTMLMediaElement>(captured insideipc::TypedRouterHandler) andIpcReceiver<PlayerEvent>After the latest existed reference in JS will be drop, SM still is able to trace
HTMLMediaElementvia live reference (Trusted<>) and NOT able dropHTMLMediaElementand resetservo_media::Playerwhich will destroyIpcSender<PlayerEvent>, so lateripc::ROUTERwill be notified about it and will release associatedipc::TypedRouterHandler(withTrusted<HTMLMediaElement>).To Reproduce:
Platform:
Ubuntu 22.04