Intermittent TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, js::Nursery::allocateBuffer, js::Nursery::reallocateBuffer in accessible/tests/browser/events/

RESOLVED FIXED in Firefox 68

Status

()

defect
RESOLVED FIXED
3 months ago
3 months ago

People

(Reporter: intermittent-bug-filer, Assigned: eeejay)

Tracking

(Regression, {intermittent-failure, memory-leak, regression})

unspecified
mozilla69
Points:
---

Firefox Tracking Flags

(firefox-esr60 unaffected, firefox67 unaffected, firefox68+ fixed, firefox69+ fixed)

Details

(Whiteboard: [retriggered][stockwell disable-recommended])

Attachments

(1 attachment)

Filed by: ncsoregi [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=246550523&repo=autoland
Full log: https://queue.taskcluster.net/v1/task/Z0TXtEU6SKSjOOYj5tuGbQ/runs/0/artifacts/public/logs/live_backing.log


[task 2019-05-15T09:39:48.044Z] 09:39:48 INFO - TEST-INFO | LeakSanitizer | To show the addresses of leaked objects add report_objects=1 to LSAN_OPTIONS
[task 2019-05-15T09:39:48.044Z] 09:39:48 INFO - TEST-INFO | LeakSanitizer | This can be done in testing/mozbase/mozrunner/mozrunner/utils.py
[task 2019-05-15T09:39:48.044Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, AllocChars, JSRope::flattenInternal
[task 2019-05-15T09:39:48.044Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at createTable, mozilla::detail::HashTable, reserve, reserve
[task 2019-05-15T09:39:48.044Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at createTable, mozilla::detail::HashTable, rehashIfOverloaded, infallibleRehashIfOverloaded
[task 2019-05-15T09:39:48.045Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, js::Nursery::allocateBuffer, js::Nursery::reallocateBuffer
[task 2019-05-15T09:39:48.046Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, js::TenuringTracer::moveSlotsToTenured, movePlainObjectToTenured
[task 2019-05-15T09:39:48.047Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, AllocateObjectBuffer, js::NativeObject::growElements
[task 2019-05-15T09:39:48.048Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, js::TypeNewScript::make, js::ObjectGroup::defaultNewGroup
[task 2019-05-15T09:39:48.048Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, pod_malloc, js::ObjectGroup::newPlainObject
[task 2019-05-15T09:39:48.053Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at EntrySlotOrCreate, EntrySlotOrCreate, mozilla::dom::TelemetryStopwatch_Binding::CreateInterfaceObjects, mozilla::dom::GetPerInterfaceObjectHandle
[task 2019-05-15T09:39:48.053Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at EntrySlotOrCreate, EntrySlotOrCreate, mozilla::dom::EventTarget_Binding::CreateInterfaceObjects, mozilla::dom::GetPerInterfaceObjectHandle
[task 2019-05-15T09:39:48.055Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at EntrySlotOrCreate, EntrySlotOrCreate, mozilla::dom::MatchPatternSet_Binding::CreateInterfaceObjects, mozilla::dom::GetPerInterfaceObjectHandle
[task 2019-05-15T09:39:48.055Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, mozilla::UniquePtr, js::FunctionScope::clone
[task 2019-05-15T09:39:48.056Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, pod_malloc, js::frontend::CreateScriptSourceObject
[task 2019-05-15T09:39:48.057Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at mozilla::dom::Performance::CreateForMainThread, nsPIDOMWindowInner::CreatePerformanceObjectIfNeeded, nsPIDOMWindowInner::GetPerformance, mozilla::dom::Window_Binding::get_performance
[task 2019-05-15T09:39:48.058Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at createTable, mozilla::detail::HashTable, js::Shape::removeChild, SweepThing
[task 2019-05-15T09:39:48.059Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, tryNewTenuredObject, js::AllocateObject
[task 2019-05-15T09:39:48.059Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, pod_malloc, js::ForOfPIC::createForOfPICObject
[task 2019-05-15T09:39:48.060Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_realloc, maybe_pod_realloc, js::Nursery::reallocateBuffer, ReallocateObjectBuffer
[task 2019-05-15T09:39:48.060Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_calloc, maybe_pod_calloc, pod_calloc, js::ShapeIC::init
[task 2019-05-15T09:39:48.061Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, pod_malloc, js::ObjectGroup::allocationSiteGroup
[task 2019-05-15T09:39:48.062Z] 09:39:48 ERROR - TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at Alloc, nsTSubstring, nsTSubstring, nsTSubstring

last test run: accessible/tests/browser/events/browser_test_textcaret.js

Duplicate of this bug: 1532189
Duplicate of this bug: 1553190

[Tracking Requested - why for this release]: extremely frequent large leak regression

Updated the summary so it's shown in treeherder as a suggestion

Priority: -- → P5
Summary: Intermittent LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, AllocChars, JSRope::flattenInternal → Intermittent TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, AllocChars, JSRope::flattenInternal

(In reply to Andreea Pavel [:apavel] from comment #10)

Updated the summary so it's shown in treeherder as a suggestion

Sorry Andrew, seems like bugzilla messed up the tracking flags.

[Tracking Requested - why for this release]:

Priority: P5 → --

Thanks for finding the regression range, Bodgan.

John, can you take a look? I can help with some of the basic investigation.

Flags: needinfo?(jdai)

Well, that regression range doesn't really make any sense. Those are some test only changes, and not involving the test that leaked, so I think it only affected chunking.

Flags: needinfo?(jdai)

Here's a tighter regression range: https://treeherder.mozilla.org/#/jobs?repo=autoland&searchStr=linux%2Cx64%2Casan%2Cmochitests%2Ctest-linux64-asan%2Fopt-mochitest-browser-chrome-e10s-&tochange=9c251c872a3370203295a8196c970195abc3bcca&fromchange=1db216f33d399e886e6d2e425a5e5e1019c5c704

Though note that somewhere in there accessible/tests/browser/events/ switched from bc11 (and the end of the range) to bc6.

edit: I updated the link to include all BC, due to the chunk switch in there somewhere.

I added some retriggers to try to figure out what is to blame, but I did notice that bug 1190882 is an a11y change in that range.

Summary: Intermittent TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, AllocChars, JSRope::flattenInternal → Intermittent TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, AllocChars, JSRope::flattenInternal in accessible/tests/browser/events/

Well, coalescing or something is throwing out my attempts to do retriggers, but I think the range is narrow enough to suggest that bug 1190882 is to blame. In addition to changing a11y code, it added a new test to the directory that is leaking.

James, can you take a look? If this can't be fixed quickly, it should be backed out, as it seems to be leaking almost all of the time (or maybe all of the time). Thanks.

Flags: needinfo?(jteh)
Regressed by: 1190882

Eitan graciously offered to look into this for me. Eitan, please bounce NI back to me if you can't get to this.

Flags: needinfo?(jteh) → needinfo?(eitan)
Has Regression Range: --- → yes
Assignee: nobody → eitan

Didn't do a complete deep dive on this, but managed to reproduce and fix locally. Like Jamie and I discussed, this is probably happening because of a strong reference the accessibility service has of an accessible. In this case it is probably a DocAccessible because it looks like its ShutDown method does not release all of its held references. Specifically in this case it is not releasing mAnchorJumpElm from a previous scroll event test.

Explicitly releasing it, (and mInvalidationList for good measure) fixes the issue locally, so I think it is worth pushing that change and seeing if it remedies this.

Assignee: eitan → nobody
Flags: needinfo?(eitan)

Here is a green try build (i know its intermittent, but maybe this is helpful?)

https://treeherder.mozilla.org/#/jobs?repo=try&revision=c162fde8eed2a7d15b2637a24bd7ef9a89e3fa74

Attachment #9066827 - Attachment description: Bug 1551825 - Release mAnchorJumpElm and mAnchorJumpElm in DocAccessible::Shutdown. r?Jamie! → Bug 1551825 - Release mAnchorJumpElm and mInvalidationList in DocAccessible::Shutdown. r?Jamie!
Pushed by eisaacson@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/cd3ba329d43a
Release mAnchorJumpElm and mInvalidationList in DocAccessible::Shutdown. r=Jamie
Summary: Intermittent TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, AllocChars, JSRope::flattenInternal in accessible/tests/browser/events/ → Intermittent TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at js_pod_arena_malloc, maybe_pod_malloc, js::Nursery::allocateBuffer, js::Nursery::reallocateBuffer in accessible/tests/browser/events/
Status: NEW → RESOLVED
Closed: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla69

(In reply to Razvan Maries from comment #28)

New occurrence: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=248403983&repo=mozilla-central&lineNumber=15121

That failure is in web platform tests, in the /mixed-content/worklet-audio-top-level/http-csp/same-host-https/top-level/keep-scheme-redirect/ directory, so it looks like a different leak. Please file a new bug for it.

The original leak looks fixed. Eitan, can you nominate for uplift to beta 68? Thanks.

Flags: needinfo?(eitan)

Comment on attachment 9066827 [details]
Bug 1551825 - Release mAnchorJumpElm and mAnchorJumpElm in DocAccessible::Shutdown. r?Jamie!

Beta/Release Uplift Approval Request

  • User impact if declined: Potential memory leaks
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): We just added an extra cleanup step to DocAccessible::Shutdown.
  • String changes made/needed:
Attachment #9066827 - Attachment description: Bug 1551825 - Release mAnchorJumpElm and mInvalidationList in DocAccessible::Shutdown. r?Jamie! → Bug 1551825 - Release mAnchorJumpElm and mAnchorJumpElm in DocAccessible::Shutdown. r?Jamie!
Flags: needinfo?(eitan)
Attachment #9066827 - Flags: approval-mozilla-beta?

Comment on attachment 9066827 [details]
Bug 1551825 - Release mAnchorJumpElm and mAnchorJumpElm in DocAccessible::Shutdown. r?Jamie!

a11y memleak fix, approved for 68.0b6

Attachment #9066827 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.