Open Bug 1313356 Opened 8 years ago Updated 2 years ago

nsDocument leaked with 1 unknown edge on bugzilla attachment pages

Categories

(Core :: DOM: Core & HTML, defect, P3)

defect

Tracking

()

REOPENED
Tracking Status
firefox50 --- affected

People

(Reporter: bkelly, Unassigned)

Details

(Whiteboard: [MemShrink:P3])

Attachments

(1 file)

I noticed today in my FF50 beta that I had some bugzilla ghost windows.

│    ├──7.90 MB (03.71%) -- top(none)
│    │  ├──7.90 MB (03.71%) -- ghost
│    │  │  ├──4.43 MB (02.08%) ++ window(https://bugzilla.mozilla.org/show_bug.cgi?id=1307415)
│    │  │  └──3.47 MB (01.63%) ++ window(https://bugzilla.mozilla.org/page.cgi?id=splinter.html&bug=1307415&attachment=8804699)
│    │  └──0.00 MB (00.00%) ── detached/window(https://bugzilla.mozilla.org/attachment.cgi)/dom/other

In the CC logs I see two nsGlobalWindow inner windows.  They both have an unknown edge.  Here is one of the find_roots output:

$ /c/devel/heapgraph/find_roots.py cc-edges.6524.1477573713.log 000001493345A000
Parsing cc-edges.6524.1477573713.log. Done loading graph.

000001496DD6C000 [nsDocument normal (xhtml) https://bugzilla.mozilla.org/page.cgi?id=splinter.html&b
ug=1307415&attachment=8804699]
    --[Preserved wrapper]--> 000001497DFA5EC0 [JS Object (HTMLDocument)]
    --[global]--> 0000014948492420 [JS Object (Window)]
    --[CLASS_OBJECT(Object), CLASS_OBJECT(Function), **UNKNOWN SLOT 202**]--> 000001497DFA5E80 [JS O
bject (Proxy)]
    --[private]--> 000001497DFA52C0 [JS Object (Proxy)]
    --[global, private]--> 0000014948492060 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 000001493345A000 [nsGlobalWindow # 2147484981 inner https://bugzilla
.mozilla.org/show_bug.cgi?id=1307415]

    Root 000001496DD6C000 is a ref counted object with 1 unknown edge(s).
    known edges:
       000001496DD6C000 [nsDocument normal (xhtml) https://bugzilla.mozilla.org/page.cgi?id=splinter
.html&bug=1307415&attachment=8804699] --[mMaybeEndOutermostXBLUpdateRunner.mObj]--> 000001496DD6C000

       00000149200BEC10 [FontFaceSet https://bugzilla.mozilla.org/page.cgi?id=splinter.html&bug=1307
415&attachment=8804699] --[mDocument]--> 000001496DD6C000
       0000014921C25700 [AnimationTimeline] --[mDocument]--> 000001496DD6C000
       000001495096C800 [nsGlobalWindow # 2147484980 inner https://bugzilla.mozilla.org/page.cgi?id=
splinter.html&bug=1307415&attachment=8804699] --[mDoc]--> 000001496DD6C000
       000001497DFA5EC0 [JS Object (HTMLDocument)] --[UnwrapDOMObject(obj)]--> 000001496DD6C000
       000001491EE4B920 [PendingAnimationTracker] --[mDocument]--> 000001496DD6C000
       000001493FDF1E20 [nsNodeInfoManager] --[mDocument]--> 000001496DD6C000

Note, the "detached/window(https://bugzilla.mozilla.org/attachment.cgi /dom/other" seems to be because there are still a couple compartments alive for that window:

gc-edges.6524.1477573713.log:# compartment https://bugzilla.mozilla.org/attachment.cgi [in zone 0000
014922E10800]
gc-edges.6524.1477573713.log:# compartment [Expanded Principal [https://bugzilla.mozilla.org/attachm
ent.cgi]] [in zone 0000014922E10800]

But I don't see any window objects still alive.
To clarify, that was 50b9.
Unfortunately I can't reproduce by just reopening these pages.  So there must be something else that happened to trigger the leak.
Attached file memory-report.json.gz
Here is the memory report.  I closed all tabs except an example.com to keep the process alive.  I also have the cc logs if anyone is interested in looking at them.
Oh, that attachment.cgi compartment is probably alive because the show_bug.cgi page is using it:

│    │  │  ├──4.43 MB (02.08%) -- window(https://bugzilla.mozilla.org/show_bug.cgi?id=1307415)
│    │  │  │  ├──1.86 MB (00.87%) ++ js-compartment(https://bugzilla.mozilla.org/attachment.cgi)

That seems weird to me.
mccr8 said he could look with an STR. Does comment 2 still apply, Ben?
Flags: needinfo?(bkelly)
Priority: -- → P3
I haven't seen it trigger again, no.
Flags: needinfo?(bkelly)
OK let's re-open if/when we do see it.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → INVALID
Uh, its been less than 24 hours.  Seems a bit quick to close it.
Status: RESOLVED → REOPENED
Resolution: INVALID → ---
P3 for now until we get solid STR.
Whiteboard: [MemShrink] → [MemShrink:P3]
Component: DOM → DOM: Core & HTML
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: