2031458 - Disk cache file accesses are causing background CPU usage in Windows Defender while running Speedometer 3

Status: NEW

(Core :: Networking: Cache, task, P2)

Description

[Markus Stange [:mstange]]

Profile: https://share.firefox.dev/424Ybas

On some of our Windows perf machines in CI we can see that Windows Defender is using CPU in the background during an sp3 run, to scan files such as this one:
\Device\HarddiskVolume3\Users\task_177576942453562\AppData\Local\Temp\rust_mozprofileGC97Ut\cache2\entries\C29AB3AE0D6130114272543B8C6D086E005A5235

This profile was recorded with xperf and converted with samply. The Defender markers (StreamScanRequestTask/win) are from the Microsoft-Antimalware-Engine provider.

xperf -start "NT Kernel Logger" -on PROC_THREAD+LOADER+PROFILE+CSWITCH -stackwalk PROFILE+CSWITCH -BufferSize 1024 -start usersession -on Microsoft-Windows-Kernel-Power+Microsoft-Windows-Kernel-Processor-Power+Microsoft-Antimalware-Engine -BufferSize 1024
xperf -stop "NT Kernel Logger" -stop usersession -d xperf-speedometer3.etl
samply import --unknown-event-markers xperf-speedometer3.etl

---

One could argue that we should change the settings on our performance testing machines so that Windows Defender doesn't use CPU. But on the other hand, it's not an unrealistic testing environment - many of our users will have Defender enabled.

I have not checked how Defender's CPU usage compares when running sp3 in other browsers.