Bug ID: JDK-6971191 Java Plugin memory leak when applet retreives JavaScript objects from browser

Type: Bug
Component: deploy
Sub-Component: plugin
Affected Version: 6u10

Priority: P3
Status: Closed
Resolution: Fixed
OS: windows_xp
CPU: x86

Submitted: 2010-07-22
Updated: 2014-02-14
Resolved: 2011-05-31

JDK 7
7 b138Fixed

FULL PRODUCT VERSION :
Java Plug-in 1.6.0_20
Using JRE version 1.6.0_20-b02 Java HotSpot(TM) Client VM

ADDITIONAL OS VERSION INFORMATION :
Tested on Windows XP and Vista:
Vista: Microsoft Windows [Version 6.0.6002]
XP: Microsoft Windows XP [Version 5.1.2600]

EXTRA RELEVANT SYSTEM CONFIGURATION :
Internet Explorer version: 8.0.6001.18928

A DESCRIPTION OF THE PROBLEM :
When an applet obtains a reference to a JavaScript object (specifically using getMember() on the window object, the Javascript object is leaked ( not garbage collected)

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Compile the applet and open the HTML page included below, and click the 'START' button.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Internet Explorer memory consumption should remain more or less constant
ACTUAL -
Internet Exploerer memory consumption expands by ~2.5 MB/Sec

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
HTML Page:
--------------------------------------
<html>
<body>
<p>In IE8, with Java Plug-in 1.6.0_20 (Using JRE version 1.6.0_20-b02), after clicking start IE memory consumption expands by ~2.5MB/Sec</p>
<button onclick="this.disabled=true;this.innerHTML='RUNNING';start()">START</button>
<div><applet width="1" height="1" id="TestApplet" code="TestApplet"></applet></div>
<script language="javascript">
function start()
{
	setInterval(runOnce, 1000);
}

function runOnce()
{
	var applet = document.applets['TestApplet'];
	window.leakObject = {};
	leakObject.string = generateString();
	applet.test();
	window.leakObject = null;

};
function generateString() // Generates a long string
{
	var s = '';
	while (s.length < 1000000)
	{
		s = s+';'+Math.random()+';'+s;
	}
	return s;
}
</script>
</body></html>
--------------------------------------

Java Applet:
--------------------------------------


import javax.swing.JApplet;

import netscape.javascript.JSObject;

public class TestApplet extends JApplet {

	/**
	 *
	 */
	private static final long serialVersionUID = 1L;
	/**
	 *
	 */
	private JSObject jsWin;
	@Override
	public void init() {
		jsWin = JSObject.getWindow(this);
		System.out.println("Applet initialized");
	}

	
	public void test()
	{
		Object leakObject = jsWin.getMember("leakObject");
	}
}

--------------------------------------

---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
Avoid sending Javascript Objects to the applet context.  If it's a must, explicitly "dispose" these objects by removing all members (the objects will still be leaked, but the leak will be small if there are no referenced objects).