There is a memory leak for long live sessions.

The session is holding a attribute with a reference to an instance of BoundObjectTable.Table https://github.com/jenkinsci/stapler/blob/3f3302a7f16fd21bb0c75c6bb7d871581636154b/core/src/main/java/org/kohsuke/stapler/bind/BoundObjectTable.java#L193

This instance stores objects in a field of type Map which is never cleaned up.

The page /manage/configure or simply editing a project can fill up quickly this map with plenty of instances of hudson.widgets.RenderOnDemandClosure.

The method createJavaScriptProxyParameters from Stapler https://github.com/jenkinsci/stapler/blob/3f3302a7f16fd21bb0c75c6bb7d871581636154b/core/src/main/java/org/kohsuke/stapler/RequestImpl.java#L214 create an instance of Bound object which is stored in the Map and hold reference to an instance of hudson.widgets.RenderOnDemandClosure BUT the release method is never called. This method is responsible to clear the entry from the Map and not relying on the session cleanup mechanism which will never happen in the case of very long session.

The issue has been introduced with Jenkins core 2.475 and this commit https://github.com/jenkinsci/jenkins/commit/7006cded64f63f788ae91dd7b7587a4a39e70273

 

The main guilty is renderOnDemand.jelly https://github.com/jenkinsci/jenkins/blob/b8e5141a9e69318d908982eaecdfea798010f954/core/src/main/resources/lib/layout/renderOnDemand.jelly#L39

which is then used in other jelly tags such dropdownListBlock