Ben Kelly [:bkelly, not reviewing] Reporter
	Description • 7 years ago

I noticed I have a ton of ghost windows tonight.  This session is less than 12 hours old.  See attached memory report.  I have CC logs and will analyze them in the morning.

	Valentina Claudia Ona
	Comment 1 • 7 years ago

Hi Ben,
Can you please capture a performance profile? You can get more info about how to install and use the Cleopatra add-on (that helps you get the performance profile) by going to:
https://developer.mozilla.org/en-US/docs/Mozilla/Performance/Profiling_with_the_Built-in_Profiler

Thanks!

	Ben Kelly [:bkelly, not reviewing] Reporter
	Comment 2 • 7 years ago

I'm not sure a perf profile will help here.  I do have the CC logs, though.  I analyzed two windows and got similar results:

00000264599CD100 [FragmentOrElement (xhtml) script https://www.washingtonpost.com/]
    --[mNodeInfo]--> 000002647091F600 [NodeInfo (xhtml) script]
    --[mOwnerManager]--> 000002643ECA8EB0 [nsNodeInfoManager]
    --[mDocument]--> 0000026455814000 [nsDocument normal (xhtml) https://www.washingtonpost.com/]
    --[mListenerManager]--> 0000026460D29BC0 [EventListenerManager]
    --[mListeners event=onDOMContentLoaded listenerType=4 [i]]--> 000002644FECD190 [CallbackObject]
    --[mIncumbentGlobal]--> 000002641DB5E000 [nsGlobalWindow # 10737419562 inner https://www.washingtonpost.com/]
    --[mTopInnerWindow]--> 0000026454EC8800 [nsGlobalWindow # 10737419542 inner https://www.washingtonpost.com/]
    --[mLocation]--> 00000264435AAB00 [Location]
    --[Preserved wrapper]--> 00000264184555B0 [JS Object (Location)]
    --[group_global]--> 00000264080C41A0 [JS Object (Window)]
    --[Krux]--> 0000026449ABD140 [JS Object (Function - t)]
    --[require]--> 0000026449AC7E00 [JS Object (Function - t.exports)]
    --[fun_environment]--> 0000026449ADEB80 [JS Object (Call)]
    --[n]--> 0000026461AA4500 [JS Object (Function - __webpack_require__)]
    --[c]--> 0000026472DECF60 [JS Object (Object)]
    --[objectElements[60]]--> 0000026449AC45E0 [JS Object (Object)]
    --[unboxed_object]--> 0000026449AD1AC0 [JS Object (Object)]
    --[server]--> 0000026410A5E180 [JS Object (Function - e.server)]
    --[fun_environment]--> 0000026422C59EC0 [JS Object (Call)]
    --[c]--> 000002647AE1E920 [JS Object (Object)]
    --[broker]--> 000002647AE1E880 [JS Object (Object)]
    --[window]--> 0000026422C0F500 [JS Object (Proxy)]
    --[private]--> 000002644C07DF00 [JS Object (Proxy)]
    --[group_global, private]--> 00000264080C4060 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 000002646B79E800 [nsGlobalWindow # 10737419550 inner https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html#!kxcid=IbWIJ0xh&kxt=https%3A%2F%2Fwww.washingtonpost.com&kxcl=cdn&kxp=]

    Root 00000264599CD100 is a ref counted object with 1 unknown edge(s).
    known edges:
       00000264716FB680 [FragmentOrElement (xhtml) body https://www.washingtonpost.com/] --[mAttrsAndChildren[i]]--> 00000264599CD100

And:

000002E6210A6380 [FragmentOrElement (xhtml) script https://tpc.googlesyndication.com/safeframe/1-0-10/html/container.html]
    --[GetParent()]--> 000002E61D6E5590 [FragmentOrElement (xhtml) head https://tpc.googlesyndication.com/safeframe/1-0-10/html/container.html]
    --[GetParent()]--> 000002E61A681DC0 [FragmentOrElement (xhtml) html https://tpc.googlesyndication.com/safeframe/1-0-10/html/container.html]
    --[[via hash] mListenerManager]--> 000002E61DD03620 [EventListenerManager]
    --[mListeners event=onclick listenerType=4 [i]]--> 000002E629BC9940 [CallbackObject]
    --[mIncumbentGlobal]--> 000002E62A22B800 [nsGlobalWindow # 6442451196 inner https://tpc.googlesyndication.com/safeframe/1-0-10/html/container.html]
    --[mTopInnerWindow]--> 000002E613808800 [nsGlobalWindow # 6442451039 inner https://www.nytimes.com/2017/07/05/nyregion/constitutional-convention-voting-new-york.html?mcubz=1]
    --[mDoc]--> 000002E6064FF000 [nsDocument normal (xhtml) https://www.nytimes.com/2017/07/05/nyregion/constitutional-convention-voting-new-york.html?mcubz=1]
    --[Preserved wrapper]--> 000002E61079F370 [JS Object (HTMLDocument)]
    --[group_global]--> 000002E6107AA060 [JS Object (Window)]
    --[Krux]--> 000002E6372D8C80 [JS Object (Function - t)]
    --[require]--> 000002E6372D9440 [JS Object (Function - t.exports)]
    --[fun_environment]--> 000002E6372F5640 [JS Object (Call)]
    --[n]--> 000002E636FBD500 [JS Object (Function - __webpack_require__)]
    --[c]--> 000002E637139040 [JS Object (Object)]
    --[objectElements[60]]--> 000002E6372C8880 [JS Object (Object)]
    --[unboxed_object]--> 000002E6372E56C0 [JS Object (Object)]
    --[client]--> 000002E637314440 [JS Object (Function - e.client)]
    --[fun_environment]--> 000002E6372ECA60 [JS Object (Call)]
    --[c]--> 000002E6373EC920 [JS Object (Object)]
    --[broker]--> 000002E6373EC880 [JS Object (Object)]
    --[window]--> 000002E6363FAA40 [JS Object (Proxy)]
    --[private]--> 000002E614809300 [JS Object (Proxy)]
    --[group_global, private]--> 000002E637184100 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 000002E6245C4800 [nsGlobalWindow # 6442451097 inner https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html#!kxcid=HrUwtkcl&kxt=https%3A%2F%2Fwww.nytimes.com&kxcl=cdn&kxp=]

    Root 000002E6210A6380 is a ref counted object with 1 unknown edge(s).
    known edges:
       000002E61D6E5590 [FragmentOrElement (xhtml) head https://tpc.googlesyndication.com/safeframe/1-0-10/html/container.html] --[mAttrsAndChildren[i]]--> 000002E6210A6380

Andrew, any ideas?

	Ben Kelly [:bkelly, not reviewing] Reporter
	Comment 3 • 7 years ago

I did have dom.script_loader.bytecode_cache.enabled flipped to true.  I'll try disabling that.

	Ben Kelly [:bkelly, not reviewing] Reporter
	Comment 4 • 7 years ago

I only mention the pref in comment 3 since it seems maybe its a script element or something leaking in those windows.  I may not be reading it right, though.

	Ben Kelly [:bkelly, not reviewing] Reporter
	Comment 5 • 7 years ago

We also leaked the gfxsanity window in the parent process.  This isn't a major problem in itself, but we should fix it anyway.  It was leaked through chrome js:

via ScriptPreloader::CachedScript.mScript :
0000022FD64C28E0 [script chrome://global/content/bindings/remote-bro]
    --[objects[0]]--> 0000022FD64D3900 [Function RemoteController]
    --[group]--> 0000022FD6429E80 [object_group]
    --[group_global]--> 0000022FD0821060 [Window <no private>]

	Ben Kelly [:bkelly, not reviewing] Reporter
	Comment 6 • 7 years ago

Maybe comment 5 suggests there is an issue with preload as well.

	Nicolas B. Pierron [:nbp]
	Comment 7 • 7 years ago

This could be related to Bug 1390863. In this bug I added a way to remove the references from the ScriptLoadRequest, in order to remove the JSScript pointer, which holds a reference to the compartment / global, and likely cause this memory leak.

Is there a better place where we should call this new ScriptLoader::Destroy function from, instead of mDocument::Destroy?

	Eric Rahm [:erahm]
	Comment 8 • 7 years ago

Kris, can you take a look at comment #5? It seems like the preloader is causing a ghost window? We might want to split off a separate bug if that's the case.

	Kris Maglione [:kmag]
	Comment 9 • 7 years ago

(In reply to Eric Rahm [:erahm] (please no mozreview requests) from comment #8)
> Kris, can you take a look at comment #5? It seems like the preloader is
> causing a ghost window? We might want to split off a separate bug if that's
> the case.

Almost certainly not the preloader I wrote, though possibly the one that nbp is working on. The XPConnect preloader only deals with subscript loader and module loader scripts that are used during startup.

It definitely is possible for it to keep a compartment alive the first time a script that isn't already cached is loaded, but that would be, at maximum, one window per script, that window would be a chrome window, and it would only happen in one session.

	Ben Kelly [:bkelly, not reviewing] Reporter
	Comment 10 • 7 years ago

(In reply to Kris Maglione [:kmag] (long backlog; ping on IRC if you're blocked) from comment #9)
> (In reply to Eric Rahm [:erahm] (please no mozreview requests) from comment
> #8)
> > Kris, can you take a look at comment #5? It seems like the preloader is
> > causing a ghost window? We might want to split off a separate bug if that's
> > the case.

> It definitely is possible for it to keep a compartment alive the first time
> a script that isn't already cached is loaded, but that would be, at maximum,
> one window per script, that window would be a chrome window, and it would
> only happen in one session.

That does sound like what I see here.  The gfxsanity window is a chrome window that runs once on startup after firefox updates.  Its unfortunate if we keep this around for a long time.

	Kris Maglione [:kmag]
	Comment 11 • 7 years ago

(In reply to Ben Kelly [:bkelly] from comment #10)
> That does sound like what I see here.  The gfxsanity window is a chrome
> window that runs once on startup after firefox updates.  Its unfortunate if
> we keep this around for a long time.

Ah, interesting. Apparently this is because remote-browser.xml now uses the subscript loader to load a script into its parent window:

http://searchfox.org/mozilla-central/rev/4d8e389498a08668cce9ebf6232cc96be178c3e4/toolkit/content/widgets/remote-browser.xml#387-389

We could avoid this by always compiling subscript loader scripts in the compilation scope during startup, but when this went through review there was agreement that occasionally leaking a single chrome window compartment during a cold start session probably wasn't worth worrying about.

	Ben Kelly [:bkelly, not reviewing] Reporter
	Comment 12 • 7 years ago

[Tracking Requested - why for this release]:
I got this again today and I have dom.script_loader.bytecode_cache.enabled set to false.  So I don't think we can blame the bytecode cache.

Both in comment 0 and today I only got partial cycle collection logs for the processes affected by the leak.

	Ben Kelly [:bkelly, not reviewing] Reporter
	Comment 13 • 7 years ago

Here is the memory report for the leak today.

Here's an example of tracing one of the leaked windows.  Note, it hits some unknown lines in the partial cc log, so who knows if the missing edge is in the missing data or if its really a leaked ref.

bkelly@valen:/mnt/c/devel/tmp/cclogs$ grep nsGlobalWindow * | grep ft.com
cc-edges.10864.1505225676.log:0000026DA0CCE800 [rc=304] nsGlobalWindow # 12884902086 inner https://www.ft.com/
cc-edges.10864.1505225676.log:0000026D9DFE1800 [rc=404] nsGlobalWindow # 12884902129 inner https://www.ft.com/
cc-edges.10864.1505225676.log:0000026F2867A800 [rc=9] nsGlobalWindow # 12884902134 inner https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html#!kxcid=KHUSeE3x&kxt=https%3A%2F%2Fwww.ft.com&kxcl=cdn&kxp=
cc-edges.10864.1505225676.log:0000026F28680000 [rc=27] nsGlobalWindow # 12884902137 inner https://www.ft.com/
cc-edges.10864.1505225676.log:0000026DA635B800 [rc=8] nsGlobalWindow # 12884902098 inner https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html#!kxcid=KHUSeE3x&kxt=https%3A%2F%2Fwww.ft.com&kxcl=cdn&kxp=
cc-edges.10864.1505225676.log:0000026DA4EAF800 [rc=2] nsGlobalWindow # 12884902136 inner https://www.ft.com/
grep: old: Is a directory
bkelly@valen:/mnt/c/devel/tmp/cclogs$ /mnt/c/devel/heapgraph/find_roots.py cc-edges.10864.1505225676.log 0000026DA4EAF800
Parsing cc-edges.10864.1505225676.log. Error: skipping unknown line:)
Error: skipping unknown line:)
Error: skipping unknown line:)
Error: skipping unknown line:)
Error: skipping unknown line:)
Done loading graph.

0000026F2A456900 [FragmentOrElement (xhtml) script https://www.ft.com/]
    --[GetParent()]--> 0000026D9EC712C0 [FragmentOrElement (xhtml) head https://www.ft.com/]
    --[mAttrsAndChildren[i]]--> 0000026F39659700 [FragmentOrElement (xhtml) script https://www.ft.com/]
    --[Preserved wrapper]--> 0000026F3DF21C10 [JS Object (HTMLScriptElement)]
    --[group_global]--> 0000026F3B2721A0 [JS Object (Window)]
    --[CLASS_OBJECT(Object), CLASS_OBJECT(Function), **UNKNOWN SLOT 175**]--> 0000026F3B277180 [JS Object (Proxy)]
    --[private]--> 0000026F46AEA9C0 [JS Object (Proxy)]
    --[group_global, private]--> 0000026F3B272560 [JS Object (Window)]
    --[MoatSuperV24]--> 0000026D96B41900 [JS Object (Object)]
    --[jsonpcache]--> 0000026F473D4F80 [JS Object (Proxy)]
    --[private]--> 0000026DA6F08940 [JS Object (Object)]
    --[group_global]--> 0000026F3B272380 [JS Object (Window)]
    --[CLASS_OBJECT(Array)]--> 0000026F3B2770C0 [JS Object (HTMLDocument)]
    --[Shadowing DOM proxy expando]--> 0000026DA17EA6C0 [JS Object (Object)]
    --[getter]--> 0000026D9F0C3FC0 [JS Object (Proxy)]
    --[private]--> 0000026D9EBD0DC0 [JS Object (Function - get location)]
    --[group_global]--> 0000026F3B272F60 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 0000026DA4EAF800 [nsGlobalWindow # 12884902136 inner https://www.ft.com/]

    Root 0000026F2A456900 is a ref counted object with 1 unknown edge(s).
    known edges:
       0000026D9EC712C0 [FragmentOrElement (xhtml) head https://www.ft.com/] --[mAttrsAndChildren[i]]--> 0000026F2A456900

And here is a trace of one of the adserver1.backbeatmedia.com leaked windows:

bkelly@valen:/mnt/c/devel/tmp/cclogs$ grep nsGlobalWindow * | grep adserver1
cc-edges.10864.1505225676.log:0000026F29199800 [rc=31] nsGlobalWindow # 12884902507 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F44BAA800 [rc=31] nsGlobalWindow # 12884902512 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F29FCE000 [rc=131] nsGlobalWindow # 12884902482 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026D9B74E000 [rc=31] nsGlobalWindow # 12884902605 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F45615000 [rc=31] nsGlobalWindow # 12884902561 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F44C02800 [rc=31] nsGlobalWindow # 12884902543 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026DA42EB800 [rc=31] nsGlobalWindow # 12884902610 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F3E9C4800 [rc=31] nsGlobalWindow # 12884902538 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F39837800 [rc=31] nsGlobalWindow # 12884902525 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026D9B4D4800 [rc=31] nsGlobalWindow # 12884902592 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F327C2000 [rc=31] nsGlobalWindow # 12884902615 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F3E199000 [rc=30] nsGlobalWindow # 12884902503 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F464CA000 [rc=31] nsGlobalWindow # 12884902548 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026D9A6BD800 [rc=25] nsGlobalWindow # 12884902590 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F396E2000 [rc=31] nsGlobalWindow # 12884902497 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F44BC2000 [rc=5] nsGlobalWindow # 12884902620 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F396EC800 [rc=3] nsGlobalWindow # 12884902498 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F294D4000 [rc=2] nsGlobalWindow # 12884902471 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F327AF800 [rc=1] nsGlobalWindow # 12884902495 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F297B3000 [rc=1] nsGlobalWindow # 12884902494 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
grep: old: Is a directory
bkelly@valen:/mnt/c/devel/tmp/cclogs$ /mnt/c/devel/heapgraph/find_roots.py cc-edges.10864.1505225676.log 0000026F297B3000
Parsing cc-edges.10864.1505225676.log. Error: skipping unknown line:)
Error: skipping unknown line:)
Error: skipping unknown line:)
Error: skipping unknown line:)
Error: skipping unknown line:)
Done loading graph.

0000026F2A46F9C0 [FragmentOrElement (xhtml) script https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin]
    --[GetParent()]--> 0000026D97CF2590 [FragmentOrElement (xhtml) head https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin]
    --[mAttrsAndChildren[i]]--> 0000026D9C4D84C0 [FragmentOrElement (xhtml) script https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin]
    --[[via hash] mListenerManager]--> 0000026D96D44310 [EventListenerManager]
    --[mListeners event=onload listenerType=2 [i]]--> 0000026D9663C7C0 [JSEventHandler handlerName=onload]
    --[mTypedHandler.Ptr()]--> 0000026D9646A5E0 [CallbackObject]
    --[mIncumbentJSGlobal]--> 0000026F32932060 [JS Object (Window)]
    --[SekindoSPlayer93882]--> 0000026D9D619560 [JS Object (Object)]
    --[iFrameDoc]--> 0000026D9BAF6480 [JS Object (Proxy)]
    --[private]--> 0000026D9BAF6600 [JS Object (HTMLDocument)]
    --[Shadowing DOM proxy expando]--> 0000026DA6FB5840 [JS Object (Object)]
    --[setter]--> 0000026F4531D680 [JS Object (Proxy)]
    --[private]--> 0000026F38EDC800 [JS Object (Function - set location)]
    --[group_global]--> 0000026F38D047E0 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 0000026F297B3000 [nsGlobalWindow # 12884902494 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin]

    Root 0000026F2A46F9C0 is a ref counted object with 1 unknown edge(s).
    known edges:
       0000026D97CF2590 [FragmentOrElement (xhtml) head https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin] --[mAttrsAndChildren[i]]--> 0000026F2A46F9C0
       0000026DA153E5B0 [JS Object (HTMLScriptElement)] --[UnwrapDOMObject(obj)]--> 0000026F2A46F9C0

	Ben Kelly [:bkelly, not reviewing] Reporter
	Comment 14 • 7 years ago

I think I have steps to reproduce:

1. Open a fresh browser session.
2. Open esquire.com in a tab.  Note the process id for the tab in the tab tooltip.
3. Open additional example.com tabs until you have one in the same process as the esquire.com tab.
4. Close the example.com tabs that are in other child processes, but keep the one in the same process as esquire.com.
5. In the esquire.com tab click on an article and back to the main page.  I did this fairly quickly, so the text appeared, but it was still loading images/etc while I clicked back.
6. Repeat step 5 a couple times.
7. Close the esquire.com tab.
8. Open about:memory in a new tab, minimize, and measure.  You should see a detached or ghost window for esquire.com.

	Ben Kelly [:bkelly, not reviewing] Reporter
	Comment 15 • 7 years ago

Andrew, can you reproduce using the steps in comment 14?  Do you have any time to investigate?

	Ben Kelly [:bkelly, not reviewing] Reporter
	Comment 16 • 7 years ago

I analyzed the esquire.com window in the leak produced by comment 14:

000001B5068D2DC0 [FragmentOrElement (xhtml) script http://www.esquire.com/]
    --[mNodeInfo]--> 000001B50B89D100 [NodeInfo (xhtml) script]
    --[mOwnerManager]--> 000001B50EC38F70 [nsNodeInfoManager]
    --[mDocument]--> 000001B5126C2000 [nsDocument normal (xhtml) http://www.esquire.com/]
    --[mDocumentTimeline]--> 000001B50902E5C0 [AnimationTimeline]
    --[mWindow]--> 000001B50C6EF800 [nsGlobalWindow # 2147483721 inner http://www.esquire.com/]

    Root 000001B5068D2DC0 is a ref counted object with 1 unknown edge(s).
    known edges:
       000001B50DF53230 [FragmentOrElement (xhtml) head http://www.esquire.com/] --[mAttrsAndChildren[i]]--> 000001B5068D2DC0

Is it possible we are using some new animation technique in the tab load throbber that could be holding the window alive?  Maybe we don't clean up the animation properly if we close the window before the load completes?  (Or maybe the stop/refresh button animation.)

	Andrew McCreight [:mccr8]
	Comment 17 • 7 years ago

Thanks for the steps, Ben. I can reproduce in my regular profile. In a debug build with a fresh profile, I get a permahang, which is alarming!

	Ben Kelly [:bkelly, not reviewing] Reporter
	Comment 18 • 7 years ago

Now that we have steps in comment 14 we could in theory narrow the regression range.  I'm not sure if the steps are 100%, though, so be careful to try "no leak" cases more than once.

	Andrew McCreight [:mccr8]
	Comment 19 • 7 years ago

I did a regression range using Ben's steps in comment 14, and it came up with this regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=10d42af6319d08daca29d5d163f301696b5ff1fd&tochange=b37a0bd71bbb1f3e5b4f58f1936d9cc0a38851d2
which blames bug 1358060.

	Andrew McCreight [:mccr8]
	Comment 20 • 7 years ago

Ben points out that this could be a dupe of bug 1398671. I'll see if I can confirm that locally.

	Andrew McCreight [:mccr8]
	Comment 21 • 7 years ago

I confirmed locally that bug 1398671 fixes this. Yay!