Closed Bug 1422912 Opened 3 years ago Closed 3 years ago

ghost windows on with nightly 59.0a1 (2017-12-04) (64-bit)


(Core :: DOM: Core & HTML, defect, P2)






(Reporter: bkelly, Unassigned)


(Blocks 1 open bug)



(1 file)

Attached file memory-report.json.gz
897.93 MB (100.0%) -- explicit
├──470.53 MB (52.40%) -- window-objects
│  ├──461.10 MB (51.35%) -- top(none)/ghost
│  │  ├──301.28 MB (33.55%) ++ window(
│  │  ├──118.52 MB (13.20%) ++ (133 tiny)
│  │  └───41.31 MB (04.60%) ++ window(

CC logs showed:

000002743421DC00 [nsGlobalWindowInner # 6442451535 inner]
    --[Preserved wrapper]--> 0000027417FB3EC0 [JS Object (Window)]
    --[DEBUG]--> 0000027438C22B80 [JS Object (Object)]
    --[registry]--> 000002742EC35C40 [JS Object (Object)]
    --[allInstances]--> 000002742152E360 [JS Object (Object)]
    --[objectElements[1077]]--> 0000027453755940 [JS Object (Object)]
    --[unboxed_object]--> 00000274534D2B00 [JS Object (Object)]
    --[channels]--> 000002742BB314A0 [JS Object (Object)]
    --[937697896811696129-6ce2b12b-65d8-4818-ae54-80b6dfc9a938]--> 0000027454357740 [JS Object (Obje
    --[destroy]--> 0000027453C59200 [JS Object (Function - z2Y5/</f.Rpc/this.destroy)]
    --[fun_environment]--> 000002745B510200 [JS Object (Call)]
    --[o]--> 000002744A962C40 [JS Object (Object)]
    --[down]--> 0000027457EAAD40 [JS Object (Object)]
    --[down]--> 0000027457EAACC0 [JS Object (Object)]
    --[init]--> 0000027453C629C0 [JS Object (Function - init)]
    --[fun_environment]--> 0000027453CBF380 [JS Object (Call)]
    --[r]--> 000002745391A780 [JS Object (Proxy)]
    --[proxy target]--> 000002744B809300 [JS Object (Proxy)]
    --[group_global, proxy target]--> 00000274106E5BA0 [JS Object (Window)]
    --[UnwrapDOMObject(obj)]--> 000002741E198C00 [nsGlobalWindowInner # 6442451659 inner]

    Root 000002743421DC00 is a ref counted object with 1 unknown edge(s)

And then a *very* long list like this:

    known edges:
       000002743DC40430 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       0000027437130490 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274462FDD30 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       000002742D339CA0 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       000002743CCD2430 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       000002742F7A4340 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       0000027437130B80 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371B81C0 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       000002743A4C1A30 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       000002743A3807C0 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371B1A00 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       000002743ECC26D0 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       0000027437141880 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       0000027440232400 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371FEB20 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       000002743744B820 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371EC580 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274382CB3A0 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371B1220 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       000002743744B490 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371EC940 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       0000027435593040 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       0000027420D7CD30 [PerformanceEntry] --[mParent]--> 000002743421DC00
       00000274579F8800 [nsGlobalWindowInner # 6442451665 inner] --[mTopInnerWindow]--> 000002743421DC00
       0000027438310B40 [Crypto] --[mParent]--> 000002743421DC00
       00000274371E03A0 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371B1CA0 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       0000027437141790 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       000002742F72F700 [PerformanceEntry] --[mParent]--> 000002743421DC00
       0000027439E65C40 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       0000027431641220 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       0000027437130A90 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274246051F0 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371BFAF0 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371ECCA0 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371481F0 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371BFD60 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371F2C10 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       0000027439E65520 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       0000027437148BB0 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       00000274371ABD30 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
       000002742E4FCE50 [CallbackObject] --[mIncumbentGlobal]--> 000002743421DC00
The DEBUG thing in the trace suggests maybe flight framework debugging is turned on.
Reproduced the leak.  Going to run with bytecode cache disabled for a bit.

Note, in regards to comment 1, even if they have some DEBUG js running the site should still not be able to leak itself as a ghost window.
I reproduced this leak with the bytecode caching disabled, so I don't think its that.

I'm now running a build with bug 1422983.  Lets see if that helps fix this.
See Also: → 1422983
I just reproduced this twitter leak on buildid 20171205123322, which I believe has bug the 1422983 fix.
See Also: 1422983
I wonder if this reproduces easily enough to run mozregression on it.
I can't reproduce in my other test profile.
Copied my profile off so I can experiment a bit.

I tried purging twitter storage, but that did not fix the issue AFAICT.
See Also: → 1409115
The leak may be gone after a browser restart after purging twitter storage.  I noticed that I could not enable push notifications on twitter and my serviceworkers.txt file was abnormally empty.  I restarted the browser and then I could add twitter push notifications again.  And the leak may be gone.

Its possible the site is doing something with a service worker/push related promise and we are failing to ever resolve it because something breaks in our native code.  This then holds the window alive.
Priority: -- → P2
I'll dupe this over to my Twitter bug. Please undupe if this comes back.
Closed: 3 years ago
Resolution: --- → DUPLICATE
See Also: 1409115
Duplicate of bug: 1409115
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.