Closed Bug 1397062 Opened 4 years ago Closed 4 years ago

many ghost windows in nightly 57

Categories

(Core :: Networking: HTTP, defect)

defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 1398671

People

(Reporter: bkelly, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: memory-leak, regression, Whiteboard: [MemShrink])

Attachments

(2 files)

Attached file memory-report.json.gz
I noticed I have a ton of ghost windows tonight.  This session is less than 12 hours old.  See attached memory report.  I have CC logs and will analyze them in the morning.
Hi Ben,
Can you please capture a performance profile? You can get more info about how to install and use the Cleopatra add-on (that helps you get the performance profile) by going to:
https://developer.mozilla.org/en-US/docs/Mozilla/Performance/Profiling_with_the_Built-in_Profiler

Thanks!
Flags: needinfo?(bkelly)
I'm not sure a perf profile will help here.  I do have the CC logs, though.  I analyzed two windows and got similar results:

00000264599CD100 [FragmentOrElement (xhtml) script https://www.washingtonpost.com/]
    --[mNodeInfo]--> 000002647091F600 [NodeInfo (xhtml) script]
    --[mOwnerManager]--> 000002643ECA8EB0 [nsNodeInfoManager]
    --[mDocument]--> 0000026455814000 [nsDocument normal (xhtml) https://www.washingtonpost.com/]
    --[mListenerManager]--> 0000026460D29BC0 [EventListenerManager]
    --[mListeners event=onDOMContentLoaded listenerType=4 [i]]--> 000002644FECD190 [CallbackObject]
    --[mIncumbentGlobal]--> 000002641DB5E000 [nsGlobalWindow # 10737419562 inner https://www.washingtonpost.com/]
    --[mTopInnerWindow]--> 0000026454EC8800 [nsGlobalWindow # 10737419542 inner https://www.washingtonpost.com/]
    --[mLocation]--> 00000264435AAB00 [Location]
    --[Preserved wrapper]--> 00000264184555B0 [JS Object (Location)]
    --[group_global]--> 00000264080C41A0 [JS Object (Window)]
    --[Krux]--> 0000026449ABD140 [JS Object (Function - t)]
    --[require]--> 0000026449AC7E00 [JS Object (Function - t.exports)]
    --[fun_environment]--> 0000026449ADEB80 [JS Object (Call)]
    --[n]--> 0000026461AA4500 [JS Object (Function - __webpack_require__)]
    --[c]--> 0000026472DECF60 [JS Object (Object)]
    --[objectElements[60]]--> 0000026449AC45E0 [JS Object (Object)]
    --[unboxed_object]--> 0000026449AD1AC0 [JS Object (Object)]
    --[server]--> 0000026410A5E180 [JS Object (Function - e.server)]
    --[fun_environment]--> 0000026422C59EC0 [JS Object (Call)]
    --[c]--> 000002647AE1E920 [JS Object (Object)]
    --[broker]--> 000002647AE1E880 [JS Object (Object)]
    --[window]--> 0000026422C0F500 [JS Object (Proxy)]
    --[private]--> 000002644C07DF00 [JS Object (Proxy)]
    --[group_global, private]--> 00000264080C4060 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 000002646B79E800 [nsGlobalWindow # 10737419550 inner https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html#!kxcid=IbWIJ0xh&kxt=https%3A%2F%2Fwww.washingtonpost.com&kxcl=cdn&kxp=]

    Root 00000264599CD100 is a ref counted object with 1 unknown edge(s).
    known edges:
       00000264716FB680 [FragmentOrElement (xhtml) body https://www.washingtonpost.com/] --[mAttrsAndChildren[i]]--> 00000264599CD100

And:

000002E6210A6380 [FragmentOrElement (xhtml) script https://tpc.googlesyndication.com/safeframe/1-0-10/html/container.html]
    --[GetParent()]--> 000002E61D6E5590 [FragmentOrElement (xhtml) head https://tpc.googlesyndication.com/safeframe/1-0-10/html/container.html]
    --[GetParent()]--> 000002E61A681DC0 [FragmentOrElement (xhtml) html https://tpc.googlesyndication.com/safeframe/1-0-10/html/container.html]
    --[[via hash] mListenerManager]--> 000002E61DD03620 [EventListenerManager]
    --[mListeners event=onclick listenerType=4 [i]]--> 000002E629BC9940 [CallbackObject]
    --[mIncumbentGlobal]--> 000002E62A22B800 [nsGlobalWindow # 6442451196 inner https://tpc.googlesyndication.com/safeframe/1-0-10/html/container.html]
    --[mTopInnerWindow]--> 000002E613808800 [nsGlobalWindow # 6442451039 inner https://www.nytimes.com/2017/07/05/nyregion/constitutional-convention-voting-new-york.html?mcubz=1]
    --[mDoc]--> 000002E6064FF000 [nsDocument normal (xhtml) https://www.nytimes.com/2017/07/05/nyregion/constitutional-convention-voting-new-york.html?mcubz=1]
    --[Preserved wrapper]--> 000002E61079F370 [JS Object (HTMLDocument)]
    --[group_global]--> 000002E6107AA060 [JS Object (Window)]
    --[Krux]--> 000002E6372D8C80 [JS Object (Function - t)]
    --[require]--> 000002E6372D9440 [JS Object (Function - t.exports)]
    --[fun_environment]--> 000002E6372F5640 [JS Object (Call)]
    --[n]--> 000002E636FBD500 [JS Object (Function - __webpack_require__)]
    --[c]--> 000002E637139040 [JS Object (Object)]
    --[objectElements[60]]--> 000002E6372C8880 [JS Object (Object)]
    --[unboxed_object]--> 000002E6372E56C0 [JS Object (Object)]
    --[client]--> 000002E637314440 [JS Object (Function - e.client)]
    --[fun_environment]--> 000002E6372ECA60 [JS Object (Call)]
    --[c]--> 000002E6373EC920 [JS Object (Object)]
    --[broker]--> 000002E6373EC880 [JS Object (Object)]
    --[window]--> 000002E6363FAA40 [JS Object (Proxy)]
    --[private]--> 000002E614809300 [JS Object (Proxy)]
    --[group_global, private]--> 000002E637184100 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 000002E6245C4800 [nsGlobalWindow # 6442451097 inner https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html#!kxcid=HrUwtkcl&kxt=https%3A%2F%2Fwww.nytimes.com&kxcl=cdn&kxp=]

    Root 000002E6210A6380 is a ref counted object with 1 unknown edge(s).
    known edges:
       000002E61D6E5590 [FragmentOrElement (xhtml) head https://tpc.googlesyndication.com/safeframe/1-0-10/html/container.html] --[mAttrsAndChildren[i]]--> 000002E6210A6380

Andrew, any ideas?
Flags: needinfo?(bkelly) → needinfo?(continuation)
I did have dom.script_loader.bytecode_cache.enabled flipped to true.  I'll try disabling that.
I only mention the pref in comment 3 since it seems maybe its a script element or something leaking in those windows.  I may not be reading it right, though.
We also leaked the gfxsanity window in the parent process.  This isn't a major problem in itself, but we should fix it anyway.  It was leaked through chrome js:

via ScriptPreloader::CachedScript.mScript :
0000022FD64C28E0 [script chrome://global/content/bindings/remote-bro]
    --[objects[0]]--> 0000022FD64D3900 [Function RemoteController]
    --[group]--> 0000022FD6429E80 [object_group]
    --[group_global]--> 0000022FD0821060 [Window <no private>]
Maybe comment 5 suggests there is an issue with preload as well.
This could be related to Bug 1390863. In this bug I added a way to remove the references from the ScriptLoadRequest, in order to remove the JSScript pointer, which holds a reference to the compartment / global, and likely cause this memory leak.

Is there a better place where we should call this new ScriptLoader::Destroy function from, instead of mDocument::Destroy?
Flags: needinfo?(continuation)
Kris, can you take a look at comment #5? It seems like the preloader is causing a ghost window? We might want to split off a separate bug if that's the case.
Flags: needinfo?(kmaglione+bmo)
Whiteboard: [MemShrink] → [MemShrink:P2]
(In reply to Eric Rahm [:erahm] (please no mozreview requests) from comment #8)
> Kris, can you take a look at comment #5? It seems like the preloader is
> causing a ghost window? We might want to split off a separate bug if that's
> the case.

Almost certainly not the preloader I wrote, though possibly the one that nbp is working on. The XPConnect preloader only deals with subscript loader and module loader scripts that are used during startup.

It definitely is possible for it to keep a compartment alive the first time a script that isn't already cached is loaded, but that would be, at maximum, one window per script, that window would be a chrome window, and it would only happen in one session.
Flags: needinfo?(kmaglione+bmo)
(In reply to Kris Maglione [:kmag] (long backlog; ping on IRC if you're blocked) from comment #9)
> (In reply to Eric Rahm [:erahm] (please no mozreview requests) from comment
> #8)
> > Kris, can you take a look at comment #5? It seems like the preloader is
> > causing a ghost window? We might want to split off a separate bug if that's
> > the case.

> It definitely is possible for it to keep a compartment alive the first time
> a script that isn't already cached is loaded, but that would be, at maximum,
> one window per script, that window would be a chrome window, and it would
> only happen in one session.

That does sound like what I see here.  The gfxsanity window is a chrome window that runs once on startup after firefox updates.  Its unfortunate if we keep this around for a long time.
(In reply to Ben Kelly [:bkelly] from comment #10)
> That does sound like what I see here.  The gfxsanity window is a chrome
> window that runs once on startup after firefox updates.  Its unfortunate if
> we keep this around for a long time.

Ah, interesting. Apparently this is because remote-browser.xml now uses the subscript loader to load a script into its parent window:

http://searchfox.org/mozilla-central/rev/4d8e389498a08668cce9ebf6232cc96be178c3e4/toolkit/content/widgets/remote-browser.xml#387-389

We could avoid this by always compiling subscript loader scripts in the compilation scope during startup, but when this went through review there was agreement that occasionally leaking a single chrome window compartment during a cold start session probably wasn't worth worrying about.
Component: General → JavaScript Engine
Summary: many ghost windows in nightly 57 → many ghost windows in nightly 57 (triggered by bytecode cache)
[Tracking Requested - why for this release]:
I got this again today and I have dom.script_loader.bytecode_cache.enabled set to false.  So I don't think we can blame the bytecode cache.

Both in comment 0 and today I only got partial cycle collection logs for the processes affected by the leak.
Component: JavaScript Engine → DOM
Keywords: regression
Summary: many ghost windows in nightly 57 (triggered by bytecode cache) → many ghost windows in nightly 57
Whiteboard: [MemShrink:P2] → [MemShrink]
Attached file memory-report.json.gz
Here is the memory report for the leak today.

Here's an example of tracing one of the leaked windows.  Note, it hits some unknown lines in the partial cc log, so who knows if the missing edge is in the missing data or if its really a leaked ref.

bkelly@valen:/mnt/c/devel/tmp/cclogs$ grep nsGlobalWindow * | grep ft.com
cc-edges.10864.1505225676.log:0000026DA0CCE800 [rc=304] nsGlobalWindow # 12884902086 inner https://www.ft.com/
cc-edges.10864.1505225676.log:0000026D9DFE1800 [rc=404] nsGlobalWindow # 12884902129 inner https://www.ft.com/
cc-edges.10864.1505225676.log:0000026F2867A800 [rc=9] nsGlobalWindow # 12884902134 inner https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html#!kxcid=KHUSeE3x&kxt=https%3A%2F%2Fwww.ft.com&kxcl=cdn&kxp=
cc-edges.10864.1505225676.log:0000026F28680000 [rc=27] nsGlobalWindow # 12884902137 inner https://www.ft.com/
cc-edges.10864.1505225676.log:0000026DA635B800 [rc=8] nsGlobalWindow # 12884902098 inner https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html#!kxcid=KHUSeE3x&kxt=https%3A%2F%2Fwww.ft.com&kxcl=cdn&kxp=
cc-edges.10864.1505225676.log:0000026DA4EAF800 [rc=2] nsGlobalWindow # 12884902136 inner https://www.ft.com/
grep: old: Is a directory
bkelly@valen:/mnt/c/devel/tmp/cclogs$ /mnt/c/devel/heapgraph/find_roots.py cc-edges.10864.1505225676.log 0000026DA4EAF800
Parsing cc-edges.10864.1505225676.log. Error: skipping unknown line:)
Error: skipping unknown line:)
Error: skipping unknown line:)
Error: skipping unknown line:)
Error: skipping unknown line:)
Done loading graph.

0000026F2A456900 [FragmentOrElement (xhtml) script https://www.ft.com/]
    --[GetParent()]--> 0000026D9EC712C0 [FragmentOrElement (xhtml) head https://www.ft.com/]
    --[mAttrsAndChildren[i]]--> 0000026F39659700 [FragmentOrElement (xhtml) script https://www.ft.com/]
    --[Preserved wrapper]--> 0000026F3DF21C10 [JS Object (HTMLScriptElement)]
    --[group_global]--> 0000026F3B2721A0 [JS Object (Window)]
    --[CLASS_OBJECT(Object), CLASS_OBJECT(Function), **UNKNOWN SLOT 175**]--> 0000026F3B277180 [JS Object (Proxy)]
    --[private]--> 0000026F46AEA9C0 [JS Object (Proxy)]
    --[group_global, private]--> 0000026F3B272560 [JS Object (Window)]
    --[MoatSuperV24]--> 0000026D96B41900 [JS Object (Object)]
    --[jsonpcache]--> 0000026F473D4F80 [JS Object (Proxy)]
    --[private]--> 0000026DA6F08940 [JS Object (Object)]
    --[group_global]--> 0000026F3B272380 [JS Object (Window)]
    --[CLASS_OBJECT(Array)]--> 0000026F3B2770C0 [JS Object (HTMLDocument)]
    --[Shadowing DOM proxy expando]--> 0000026DA17EA6C0 [JS Object (Object)]
    --[getter]--> 0000026D9F0C3FC0 [JS Object (Proxy)]
    --[private]--> 0000026D9EBD0DC0 [JS Object (Function - get location)]
    --[group_global]--> 0000026F3B272F60 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 0000026DA4EAF800 [nsGlobalWindow # 12884902136 inner https://www.ft.com/]

    Root 0000026F2A456900 is a ref counted object with 1 unknown edge(s).
    known edges:
       0000026D9EC712C0 [FragmentOrElement (xhtml) head https://www.ft.com/] --[mAttrsAndChildren[i]]--> 0000026F2A456900

And here is a trace of one of the adserver1.backbeatmedia.com leaked windows:

bkelly@valen:/mnt/c/devel/tmp/cclogs$ grep nsGlobalWindow * | grep adserver1
cc-edges.10864.1505225676.log:0000026F29199800 [rc=31] nsGlobalWindow # 12884902507 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F44BAA800 [rc=31] nsGlobalWindow # 12884902512 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F29FCE000 [rc=131] nsGlobalWindow # 12884902482 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026D9B74E000 [rc=31] nsGlobalWindow # 12884902605 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F45615000 [rc=31] nsGlobalWindow # 12884902561 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F44C02800 [rc=31] nsGlobalWindow # 12884902543 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026DA42EB800 [rc=31] nsGlobalWindow # 12884902610 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F3E9C4800 [rc=31] nsGlobalWindow # 12884902538 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F39837800 [rc=31] nsGlobalWindow # 12884902525 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026D9B4D4800 [rc=31] nsGlobalWindow # 12884902592 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F327C2000 [rc=31] nsGlobalWindow # 12884902615 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F3E199000 [rc=30] nsGlobalWindow # 12884902503 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F464CA000 [rc=31] nsGlobalWindow # 12884902548 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026D9A6BD800 [rc=25] nsGlobalWindow # 12884902590 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F396E2000 [rc=31] nsGlobalWindow # 12884902497 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F44BC2000 [rc=5] nsGlobalWindow # 12884902620 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F396EC800 [rc=3] nsGlobalWindow # 12884902498 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F294D4000 [rc=2] nsGlobalWindow # 12884902471 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F327AF800 [rc=1] nsGlobalWindow # 12884902495 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
cc-edges.10864.1505225676.log:0000026F297B3000 [rc=1] nsGlobalWindow # 12884902494 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin
grep: old: Is a directory
bkelly@valen:/mnt/c/devel/tmp/cclogs$ /mnt/c/devel/heapgraph/find_roots.py cc-edges.10864.1505225676.log 0000026F297B3000
Parsing cc-edges.10864.1505225676.log. Error: skipping unknown line:)
Error: skipping unknown line:)
Error: skipping unknown line:)
Error: skipping unknown line:)
Error: skipping unknown line:)
Done loading graph.

0000026F2A46F9C0 [FragmentOrElement (xhtml) script https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin]
    --[GetParent()]--> 0000026D97CF2590 [FragmentOrElement (xhtml) head https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin]
    --[mAttrsAndChildren[i]]--> 0000026D9C4D84C0 [FragmentOrElement (xhtml) script https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin]
    --[[via hash] mListenerManager]--> 0000026D96D44310 [EventListenerManager]
    --[mListeners event=onload listenerType=2 [i]]--> 0000026D9663C7C0 [JSEventHandler handlerName=onload]
    --[mTypedHandler.Ptr()]--> 0000026D9646A5E0 [CallbackObject]
    --[mIncumbentJSGlobal]--> 0000026F32932060 [JS Object (Window)]
    --[SekindoSPlayer93882]--> 0000026D9D619560 [JS Object (Object)]
    --[iFrameDoc]--> 0000026D9BAF6480 [JS Object (Proxy)]
    --[private]--> 0000026D9BAF6600 [JS Object (HTMLDocument)]
    --[Shadowing DOM proxy expando]--> 0000026DA6FB5840 [JS Object (Object)]
    --[setter]--> 0000026F4531D680 [JS Object (Proxy)]
    --[private]--> 0000026F38EDC800 [JS Object (Function - set location)]
    --[group_global]--> 0000026F38D047E0 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 0000026F297B3000 [nsGlobalWindow # 12884902494 inner https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin]

    Root 0000026F2A46F9C0 is a ref counted object with 1 unknown edge(s).
    known edges:
       0000026D97CF2590 [FragmentOrElement (xhtml) head https://adserver1.backbeatmedia.com/servlet/ajrotator/253/291/viewHTML?dontcount=1&pool=9077&redirect=ajs&type=3158&zone=5000&pos=13&keywords=platwin] --[mAttrsAndChildren[i]]--> 0000026F2A46F9C0
       0000026DA153E5B0 [JS Object (HTMLScriptElement)] --[UnwrapDOMObject(obj)]--> 0000026F2A46F9C0
I think I have steps to reproduce:

1. Open a fresh browser session.
2. Open esquire.com in a tab.  Note the process id for the tab in the tab tooltip.
3. Open additional example.com tabs until you have one in the same process as the esquire.com tab.
4. Close the example.com tabs that are in other child processes, but keep the one in the same process as esquire.com.
5. In the esquire.com tab click on an article and back to the main page.  I did this fairly quickly, so the text appeared, but it was still loading images/etc while I clicked back.
6. Repeat step 5 a couple times.
7. Close the esquire.com tab.
8. Open about:memory in a new tab, minimize, and measure.  You should see a detached or ghost window for esquire.com.
Andrew, can you reproduce using the steps in comment 14?  Do you have any time to investigate?
Flags: needinfo?(continuation)
I analyzed the esquire.com window in the leak produced by comment 14:

000001B5068D2DC0 [FragmentOrElement (xhtml) script http://www.esquire.com/]
    --[mNodeInfo]--> 000001B50B89D100 [NodeInfo (xhtml) script]
    --[mOwnerManager]--> 000001B50EC38F70 [nsNodeInfoManager]
    --[mDocument]--> 000001B5126C2000 [nsDocument normal (xhtml) http://www.esquire.com/]
    --[mDocumentTimeline]--> 000001B50902E5C0 [AnimationTimeline]
    --[mWindow]--> 000001B50C6EF800 [nsGlobalWindow # 2147483721 inner http://www.esquire.com/]

    Root 000001B5068D2DC0 is a ref counted object with 1 unknown edge(s).
    known edges:
       000001B50DF53230 [FragmentOrElement (xhtml) head http://www.esquire.com/] --[mAttrsAndChildren[i]]--> 000001B5068D2DC0

Is it possible we are using some new animation technique in the tab load throbber that could be holding the window alive?  Maybe we don't clean up the animation properly if we close the window before the load completes?  (Or maybe the stop/refresh button animation.)
No longer blocks: js-startup-cache
Thanks for the steps, Ben. I can reproduce in my regular profile. In a debug build with a fresh profile, I get a permahang, which is alarming!
Flags: needinfo?(continuation)
Assignee: nobody → continuation
Now that we have steps in comment 14 we could in theory narrow the regression range.  I'm not sure if the steps are 100%, though, so be careful to try "no leak" cases more than once.
I did a regression range using Ben's steps in comment 14, and it came up with this regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=10d42af6319d08daca29d5d163f301696b5ff1fd&tochange=b37a0bd71bbb1f3e5b4f58f1936d9cc0a38851d2
which blames bug 1358060.
Assignee: continuation → nobody
Blocks: tailing
Component: DOM → Networking: HTTP
Keywords: mlk
Ben points out that this could be a dupe of bug 1398671. I'll see if I can confirm that locally.
I confirmed locally that bug 1398671 fixes this. Yay!
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1398671
You need to log in before you can comment on or make changes to this bug.