Closed Bug 1328977 Opened 7 years ago Closed 7 years ago

Promise leaking window in child process

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86_64
Windows 10
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox53 --- affected

People

(Reporter: bugzilla.mozilla.org, Unassigned)

Details

(Whiteboard: [MemShrink:P3]) 

Build ID 	20170103030204

about:memory shows:

20,620.24 MB (100.0%) -- explicit
├──20,182.93 MB (97.88%) ── heap-unclassified
└─────437.31 MB (02.12%) -- (19 tiny)
      ├──195.23 MB (00.95%) ++ heap-overhead
      ├───82.57 MB (00.40%) -- window-objects
      │   ├──20.57 MB (00.10%) -- top(none)/detached
      │   │  ├──20.50 MB (00.10%) ++ window(https://www.youtube.com/watch?v=lZ97s396kb0)
      │   │  └───0.07 MB (00.00%) ++ window(javascript:"")


Dumping verbose CC&GC logs and running them through find_roots shows the following:

    CC log:
     
    0000024201935610 [Promise]
        --[mGlobal]--> 0000024209941800 [nsGlobalWindow # 6442451089 inner https://www.youtube.com/watch?v=lZ97s396kb0]
        --[Preserved wrapper]--> 00000242105296A0 [JS Object (Window)]
        --[m]--> 0000024212D8EA80 [JS Object (Function - window.mb)]
        --[fun_environment]--> 0000024212D48F60 [JS Object (Call)]
        --[h]--> 0000024211233B80 [JS Object (MouseEvent)]
        --[UnwrapDOMObject(obj)]--> 00000242013C77A0 [Event]
        --[mEvent->mTarget, mEvent->mOriginalTarget, mExplicitOriginalTarget]--> 0000024209429D80 [FragmentOrElement (xhtml) div id='watch-header' class='yt-card yt-card-has-padding' https://www.youtube.com/watch?v=lZ97s396kb0]
        --[GetParent()]--> 0000024209428B00 [FragmentOrElement (xhtml) div id='watch7-content' class='watch-main-col ' https://www.youtube.com/watch?v=lZ97s396kb0]
        --[GetParent()]--> 0000024209428800 [FragmentOrElement (xhtml) div id='watch7-main' class='clearfix' https://www.youtube.com/watch?v=lZ97s396kb0]
        --[mAttrsAndChildren[i]]--> 0000024209820F80 [FragmentOrElement (xhtml) div id='watch7-sidebar' class='watch-sidebar' https://www.youtube.com/watch?v=lZ97s396kb0]
        --[mAttrsAndChildren[i]]--> 000002420D7BC280 [FragmentOrElement (xhtml) div id='watch7-sidebar-contents' class='watch-sidebar-gutter   yt-card yt-card-has-padding    yt-uix-expander yt-uix-expander-collapsed' https://www.youtube.com/watch?v=lZ97s396kb0]
        --[mAttrsAndChildren[i]]--> 000002420D7BCC80 [FragmentOrElement (xhtml) div id='watch7-sidebar-modules' https://www.youtube.com/watch?v=lZ97s396kb0]
        --[mAttrsAndChildren[i]]--> 000002420D7C4380 [FragmentOrElement (xhtml) div class='watch-sidebar-section' https://www.youtube.com/watch?v=lZ97s396kb0]
        --[mAttrsAndChildren[i]]--> 000002420D7C4500 [FragmentOrElement (xhtml) div class='watch-sidebar-body' https://www.youtube.com/watch?v=lZ97s396kb0]
        --[mAttrsAndChildren[i]]--> 000002420D7C9110 [FragmentOrElement (xhtml) ul id='watch-related' class='video-list' https://www.youtube.com/watch?v=lZ97s396kb0]
        --[mAttrsAndChildren[i]]--> 000002420D7CA310 [FragmentOrElement (xhtml) li class='video-list-item related-list-item  show-video-time related-list-item-compact-video' https://www.youtube.com/watch?v=lZ97s396kb0]
        --[mAttrsAndChildren[i]]--> 000002420D7FC580 [FragmentOrElement (xhtml) div class='thumb-wrapper' https://www.youtube.com/watch?v=lZ97s396kb0]
        --[mAttrsAndChildren[i]]--> 000002427660C840 [FragmentOrElement (xhtml) a class=' vve-check thumb-link spf-link  yt-uix-sessionlink       spf-link ' https://www.youtube.com/watch?v=lZ97s396kb0]
        --[mAttrsAndChildren[i]]--> 000002420D7FC780 [FragmentOrElement (xhtml) span class='yt-uix-simple-thumb-wrap yt-uix-simple-thumb-related' https://www.youtube.com/watch?v=lZ97s396kb0]
     
    GC log:
     
    Parsing gc-edges.4764.1483641450.log. Done loading graph.0000024201935610 is not in the graph.
Whiteboard: [MemShrink]
Well, it is hard to fix these kinds of issues without steps to reproduce. Something is holding a promise alive.
Under such circumstances it's not possible to derive a STR. The observation that something leaked happens many hours later, with quite a bit of browsing activity in-between. I try to report what I can with the available tools.

I don't know if the 20GB heap-unclassified and the leaked tab are related, but the former issue is not a singular event. A few days ago I found my FF killed due to system commit being exhausted after returning to my computer a few hours later.
OS: Unspecified → Windows 10
Hardware: Unspecified → x86_64
Today I have some that point at a different root. Maybe it's because I started from a fragment with the previous one?

$ python2 find_roots.py cc-edges.9352.1483692788.log  00000248DF5F5C00
Parsing cc-edges.9352.1483692788.log. Done loading graph. 

00000248B9C79240 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 00000248DF5F5C00 [nsGlobalWindow # 12884902009 inner https://stackoverflow.com/questions/tagged/garbage-collection]

    Root 00000248B9C79240 is a marked GC object.

$ python2 find_roots.py gc-edges.9352.1483692788.log  00000248B9C79240 -bro
Parsing gc-edges.9352.1483692788.log. Done loading graph.

via LiveSavedFrameCache::frames SavedFrame :
00000248A05BAAC0 [SavedFrame 0000000000000000]
    --[group]--> 00000248EE28AEB0 [object_group]
    --[group_global]--> 00000248B9C79240 [Window <no private>]
Things seem to be all over the place. 

----

# about:memory

│   ├──11.99 MB (04.53%) -- top(none)
│   │  ├──11.98 MB (04.53%) -- ghost
│   │  │  ├───6.06 MB (02.29%) ++ window(https://<anonymized-1>)

# CC log entry

000001BC4593F000 [rc=124] nsGlobalWindow # 12884901973 inner https://<anonymized-1>

# find_roots


000001BC45326000 [nsDocument normal (xhtml) https://<anonymized-2>]
    --[Preserved wrapper]--> 000001BC3E78E060 [JS Object (HTMLDocument)]
    --[group_global]--> 000001BC443802E0 [JS Object (Window)]
    --[CLASS_OBJECT(Object), CLASS_OBJECT(Function), **UNKNOWN SLOT 156**]--> 000001BC3E78E040 [JS Object (Proxy)]
    --[private]--> 000001BC3E78E3A0 [JS Object (Proxy)]
    --[group_global, private]--> 000001BC44380060 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 000001BC4593F000 [nsGlobalWindow # 12884901973 inner https://<anonymized-1>]

    Root 000001BC45326000 is a ref counted object with 1 unknown edge(s).
    known edges:
       000001BC484CEF30 [AnimationEffectTimingReadOnly] --[mDocument]--> 000001BC45326000
       000001BC47E67F60 [PendingAnimationTracker] --[mDocument]--> 000001BC45326000
       000001BC484CF890 [AnimationEffectTimingReadOnly] --[mDocument]--> 000001BC45326000
       000001BC48223400 [AnimationEffectReadOnly] --[mDocument]--> 000001BC45326000
       000001BC4721D800 [nsGlobalWindow # 12884901962 inner https://<anonymized-2>] --[mDoc]--> 000001BC45326000
       000001BC463B9C00 [AnimationTimeline] --[mDocument]--> 000001BC45326000
       000001BC484CF020 [AnimationEffectTimingReadOnly] --[mDocument]--> 000001BC45326000
       000001BC45326000 [nsDocument normal (xhtml) https://<anonymized-2>] --[mMaybeEndOutermostXBLUpdateRunner.mObj]--> 000001BC45326000
       000001BC484CFF20 [AnimationEffectTimingReadOnly] --[mDocument]--> 000001BC45326000
       000001BC48223800 [AnimationEffectReadOnly] --[mDocument]--> 000001BC45326000
       000001BC3E78E060 [JS Object (HTMLDocument)] --[UnwrapDOMObject(obj)]--> 000001BC45326000
       000001BC4823E000 [AnimationEffectReadOnly] --[mDocument]--> 000001BC45326000
       000001BC4823EC00 [AnimationEffectReadOnly] --[mDocument]--> 000001BC45326000
       000001BC38DC1510 [nsNodeInfoManager] --[mDocument]--> 000001BC45326000



----

# about:memory

│    │   └───0.08 MB (00.00%) -- top(none)/detached
│    │       ├──0.08 MB (00.00%) ++ window(about:blank)
│    │       └──0.00 MB (00.00%) ── window(https://<anonymized-3>)/dom/other

# cc log entries

0000011DB6A08000 [rc=79] nsGlobalWindow # 8589934733 inner https://<anonymized-3>
0000011DB52ADC00 [rc=9] nsGlobalWindow # 8589934730 outer https://<anonymized-3>

# find_root

0000011DADF4D000 [nsDocument normal (xhtml) https://<anonymized-3>]
    --[mScriptGlobalObject]--> 0000011DB6A08000 [nsGlobalWindow # 8589934733 inner https://<anonymized-3>]

    Root 0000011DADF4D000 is a ref counted object with 51 unknown edge(s).
    known edges:
       0000011DB279F280 [nsTextServicesDocument] --[mDOMDocument]--> 0000011DADF4D000
       0000011DB03F34E0 [nsRange] --[mOwner]--> 0000011DADF4D000
       0000011DB2821E80 [nsTextServicesDocument] --[mDOMDocument]--> 0000011DADF4D000
       0000011DB6A08000 [nsGlobalWindow # 8589934733 inner https://<anonymized-3>] --[mDoc]--> 0000011DADF4D000
       0000011DA3553100 [nsNodeInfoManager] --[mDocument]--> 0000011DADF4D000
       0000011DB627F040 [nsBaseContentList] --[mRoot]--> 0000011DADF4D000
       0000011DB66B22E0 [PendingAnimationTracker] --[mDocument]--> 0000011DADF4D000
       0000011DB586DE80 [AnimationTimeline] --[mDocument]--> 0000011DADF4D000
       0000011DB5D029B0 [nsRange] --[mOwner, mRoot]--> 0000011DADF4D000
       0000011DAF098280 [TimeRanges] --[mParent]--> 0000011DADF4D000
       0000011DB631D740 [nsRange] --[mOwner]--> 0000011DADF4D000
       0000011DB66B17F0 [nsRange] --[mOwner]--> 0000011DADF4D000
       0000011DB66F5A00 [nsBaseContentList] --[mRoot]--> 0000011DADF4D000
       0000011DB634E270 [nsRange] --[mOwner, mRoot]--> 0000011DADF4D000
       0000011DB66B25F0 [nsRange] --[mOwner, mRoot]--> 0000011DADF4D000
       0000011DB631C940 [nsRange] --[mOwner]--> 0000011DADF4D000
       0000011DAE17CA00 [nsTextServicesDocument] --[mDOMDocument]--> 0000011DADF4D000
       0000011DAC4FAB60 [JS Object (HTMLDocument)] --[UnwrapDOMObject(obj)]--> 0000011DADF4D000
       0000011DB631C630 [nsRange] --[mOwner]--> 0000011DADF4D000
       0000011DB634E900 [nsRange] --[mOwner]--> 0000011DADF4D000
       0000011DAFFD8400 [nsTextServicesDocument] --[mDOMDocument]--> 0000011DADF4D000
       0000011DADF4D000 [nsDocument normal (xhtml) https://<anonymized-3>] --[mMaybeEndOutermostXBLUpdateRunner.mObj]--> 0000011DADF4D000
       0000011DB5123EB0 [nsRange] --[mOwner, mRoot]--> 0000011DADF4D000
       0000011DB514B980 [nsTextServicesDocument] --[mDOMDocument]--> 0000011DADF4D000
       0000011DB6721740 [nsRange] --[mOwner]--> 0000011DADF4D000
       0000011DB52ADC00 [nsGlobalWindow # 8589934730 outer https://<anonymized-3>] --[mDoc]--> 0000011DADF4D000
       0000011DB61F5710 [nsRange] --[mOwner, mRoot]--> 0000011DADF4D000
       0000011DB6C29D60 [nsRange] --[mOwner]--> 0000011DADF4D000
       0000011DB7038BA0 [nsRange] --[mOwner]--> 0000011DADF4D000
       0000011DB513A2B0 [nsRange] --[mOwner, mRoot]--> 0000011DADF4D000
       0000011DB5123E40 [nsRange] --[mOwner]--> 0000011DADF4D000
       0000011DC5E75780 [FontFaceSet https://<anonymized-3>] --[mDocument]--> 0000011DADF4D000


0000011DB52ADC00 [nsGlobalWindow # 8589934730 outer https://<anonymized-3>]

    Root 0000011DB52ADC00 is a ref counted object with 1 unknown edge(s).
    known edges:
       0000011DAF170F80 [AudioChannelAgent] --[mWindow]--> 0000011DB52ADC00
       0000011DB6A08000 [nsGlobalWindow # 8589934733 inner https://<anonymized-3>] --[mOuterWindow]--> 0000011DB52ADC00
       0000011DCDB4D520 [Event] --[mView]--> 0000011DB52ADC00
       0000011DC61A2A20 [Event] --[mView]--> 0000011DB52ADC00
       0000011DA3549900 [nsJSContext] --[mGlobalObjectRef]--> 0000011DB52ADC00
       0000011DA3552F80 [nsWindowRoot] --[mWindow]--> 0000011DB52ADC00
       0000011DC8DDFEC0 [Event] --[mView]--> 0000011DB52ADC00
       0000011DB1F80BA0 [Event] --[mView]--> 0000011DB52ADC00
Without STR unfortunately there's not much we can do.
Whiteboard: [MemShrink] → [MemShrink:P3]
Closing since I'm not seeing any ghost windows in current builds.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WORKSFORME
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.