820242 - ~500KB of unreported memory in B2G main process from GetRuleCascade (nsTArray and PLDHash) during XML parsing

Status: RESOLVED WONTFIX

(Core :: CSS Parsing and Computation, defect)

Description

[Justin Lebar (not reading bugmail)]

In the main B2G process with the gallery app open (see attachment 690543 [details]), I see:

> Unreported: ~38 blocks in block group 10 of 533
>  ~155,648 bytes (~155,648 requested / ~0 slop)
>  0.64% of the heap (32.72% cumulative);  1.27% of unreported (64.42% cumulative)
>  Allocated at
>        realloc /Users/jlebar/code/moz/ff-git/src/memory/build/replace_malloc.c:192 (0x4020b1d0 libmozglue.so+0x41d0)
>        moz_xrealloc /Users/jlebar/code/moz/ff-git/src/memory/mozalloc/mozalloc.cpp:87 (0x411103be libxul.so+0xeed3be)
>        nsTArrayInfallibleAllocator::Realloc(void*, unsigned int) /Users/jlebar/code/moz/B2G/objdir-gecko/dist/include/nsTArray.h:65 (0x404d7c4a libxul.so+0x2b4c4a)
>        AppendElements<mozilla::SVGTransformSMILData> /Users/jlebar/code/moz/B2G/objdir-gecko/dist/include/nsTArray.h:879 (0x40625e08 libxul.so+0x402e08)
>        AppendRuleToTagTable /Users/jlebar/code/moz/ff-git/src/layout/style/nsCSSRuleProcessor.cpp:614 (0x406263c0 libxul.so+0x4033c0)
>        nsCOMPtr<nsIAtom>::get() const /Users/jlebar/code/moz/B2G/objdir-gecko/dist/include/nsCOMPtr.h:764 (0x40626694 libxul.so+0x403694)
>        AddRule /Users/jlebar/code/moz/ff-git/src/layout/style/nsCSSRuleProcessor.cpp:2871 (0x40628622 libxul.so+0x405622)
>        nsCSSRuleProcessor::GetRuleCascade(nsPresContext*) /Users/jlebar/code/moz/ff-git/src/layout/style/nsCSSRuleProcessor.cpp:3162 (0x40628740 libxul.so+0x405740)
>        nsCSSRuleProcessor::RulesMatching(AnonBoxRuleProcessorData*) /Users/jlebar/code/moz/ff-git/src/layout/style/nsCSSRuleProcessor.cpp:2347 (0x40628840 libxul.so+0x405840)
>        EnumRulesMatching<AnonBoxRuleProcessorData> /Users/jlebar/code/moz/ff-git/src/layout/style/nsStyleSet.cpp:473 (0x4064cc60 libxul.so+0x429c60)
>        nsRuleWalker::CurrentNode() /Users/jlebar/code/moz/ff-git/src/layout/style/nsRuleWalker.h:20 (0x4064da1a libxul.so+0x42aa1a)
>        nsStyleSet::ResolveAnonymousBoxStyle(nsIAtom*, nsStyleContext*) /Users/jlebar/code/moz/ff-git/src/layout/style/nsStyleSet.cpp:1172 (0x4064e1b8 libxul.so+0x42b1b8)
>        nsCSSFrameConstructor::ConstructRootFrame(nsIFrame**) /Users/jlebar/code/moz/ff-git/src/layout/base/nsCSSFrameConstructor.cpp:2534 (0x40584500 libxul.so+0x361500)
>        nsFrameManagerBase::SetRootFrame(nsIFrame*) /Users/jlebar/code/moz/ff-git/src/layout/base/nsFrameManagerBase.h:53 (0x405b6f44 libxul.so+0x393f44)
>        nsContentSink::StartLayout(bool) /Users/jlebar/code/moz/B2G/objdir-gecko/dist/include/nsError.h:155 (0x4069cb76 libxul.so+0x479b76)
>        nsXMLContentSink::MaybeStartLayout(bool) /Users/jlebar/code/moz/ff-git/src/content/xml/document/src/nsXMLContentSink.cpp:894 (0x4149252a libxul.so+0x56b52a)
>        nsXMLContentSink::HandleStartElement(unsigned short const*, unsigned short const**, unsigned int, int, unsigned int, bool) /Users/jlebar/code/moz/B2G/objdir-gecko/dist/include/nsCOMPtr.h:764 (0x41492814 libxul.so+0x56b814)
>        nsXMLContentSink::HandleStartElement(unsigned short const*, unsigned short const**, unsigned int, int, unsigned int) /Users/jlebar/code/moz/ff-git/src/content/xml/document/src/nsXMLContentSink.cpp:949 (0x4078eb46 libxul.so+0x56bb46)
>        nsExpatDriver::HandleStartElement(unsigned short const*, unsigned short const**) /Users/jlebar/code/moz/ff-git/src/parser/htmlparser/src/nsExpatDriver.cpp:385 (0x4054f962 libxul.so+0x32c962)
>        Driver_HandleStartElement /Users/jlebar/code/moz/ff-git/src/parser/htmlparser/src/nsExpatDriver.cpp:72 (0x4054f978 libxul.so+0x32c978)
>        doContent /Users/jlebar/code/moz/ff-git/src/parser/expat/lib/xmlparse.c:2387 (0x40e7db84 libxul.so+0xc5ab84)
>        contentProcessor /Users/jlebar/code/moz/ff-git/src/parser/expat/lib/xmlparse.c:2045 (0x40e7e142 libxul.so+0xc5b142)
>        doProlog /Users/jlebar/code/moz/ff-git/src/parser/expat/lib/xmlparse.c:4024 (0x40e7e708 libxul.so+0xc5b708)
>        prologProcessor /Users/jlebar/code/moz/ff-git/src/parser/expat/lib/xmlparse.c:3760 (0x40e7f36a libxul.so+0xc5c36a)

Note that the 155KB are split up between 38 allocations.

Comment 1

[Justin Lebar (not reading bugmail)]

Also this, which appears to be basically the same thing, but for pldhash.

> Unreported: 6 blocks in block group 11 of 533
>  147,456 bytes (147,456 requested / 0 slop)
>  0.61% of the heap (33.33% cumulative);  1.20% of unreported (65.62% cumulative)
>  Allocated at
>        malloc /Users/jlebar/code/moz/ff-git/src/memory/build/replace_malloc.c:152 (0x4020b2ae libmozglue.so+0x42ae)
>        moz_malloc /Users/jlebar/code/moz/ff-git/src/memory/mozalloc/mozalloc.cpp:65 (0x40e5adf2 libxul.so+0xc37df2)
>        PL_DHashAllocTable /Users/jlebar/code/moz/ff-git/src/xpcom/glue/pldhash.cpp:85 (0x40c44af0 libxul.so+0xa21af0)
>        ChangeTable /Users/jlebar/code/moz/ff-git/src/xpcom/glue/pldhash.cpp:527 (0x40c44650 libxul.so+0xa21650)
>        PL_DHashTableOperate /Users/jlebar/code/moz/ff-git/src/xpcom/glue/pldhash.cpp:612 (0x40c449cc libxul.so+0xa219cc)
>        AppendRuleToTagTable /Users/jlebar/code/moz/ff-git/src/layout/style/nsCSSRuleProcessor.cpp:610 (0x406263b6 libxul.so+0x4033b6)
>        nsCOMPtr<nsIAtom>::get() const /Users/jlebar/code/moz/B2G/objdir-gecko/dist/include/nsCOMPtr.h:764 (0x40626694 libxul.so+0x403694)
>        AddRule /Users/jlebar/code/moz/ff-git/src/layout/style/nsCSSRuleProcessor.cpp:2871 (0x40628622 libxul.so+0x405622)
>        nsCSSRuleProcessor::GetRuleCascade(nsPresContext*) /Users/jlebar/code/moz/ff-git/src/layout/style/nsCSSRuleProcessor.cpp:3162 (0x40628740 libxul.so+0x405740)
>        nsCSSRuleProcessor::RulesMatching(AnonBoxRuleProcessorData*) /Users/jlebar/code/moz/ff-git/src/layout/style/nsCSSRuleProcessor.cpp:2347 (0x40628840 libxul.so+0x405840)
>        EnumRulesMatching<AnonBoxRuleProcessorData> /Users/jlebar/code/moz/ff-git/src/layout/style/nsStyleSet.cpp:473 (0x4064cc60 libxul.so+0x429c60)
>        nsRuleWalker::CurrentNode() /Users/jlebar/code/moz/ff-git/src/layout/style/nsRuleWalker.h:20 (0x4064da1a libxul.so+0x42aa1a)
>        nsStyleSet::ResolveAnonymousBoxStyle(nsIAtom*, nsStyleContext*) /Users/jlebar/code/moz/ff-git/src/layout/style/nsStyleSet.cpp:1172 (0x4064e1b8 libxul.so+0x42b1b8)
>        nsCSSFrameConstructor::ConstructRootFrame(nsIFrame**) /Users/jlebar/code/moz/ff-git/src/layout/base/nsCSSFrameConstructor.cpp:2534 (0x40584500 libxul.so+0x361500)
>        nsFrameManagerBase::SetRootFrame(nsIFrame*) /Users/jlebar/code/moz/ff-git/src/layout/base/nsFrameManagerBase.h:53 (0x405b6f44 libxul.so+0x393f44)
>        nsContentSink::StartLayout(bool) /Users/jlebar/code/moz/B2G/objdir-gecko/dist/include/nsError.h:155 (0x4069cb76 libxul.so+0x479b76)
>        nsXMLContentSink::MaybeStartLayout(bool) /Users/jlebar/code/moz/ff-git/src/content/xml/document/src/nsXMLContentSink.cpp:894 (0x4149252a libxul.so+0x56b52a)
>        nsXMLContentSink::HandleStartElement(unsigned short const*, unsigned short const**, unsigned int, int, unsigned int, bool) /Users/jlebar/code/moz/B2G/objdir-gecko/dist/include/nsCOMPtr.h:764 (0x41492814 libxul.so+0x56b814)
>        nsXMLContentSink::HandleStartElement(unsigned short const*, unsigned short const**, unsigned int, int, unsigned int) /Users/jlebar/code/moz/ff-git/src/content/xml/document/src/nsXMLContentSink.cpp:949 (0x4078eb46 libxul.so+0x56bb46)
>        nsExpatDriver::HandleStartElement(unsigned short const*, unsigned short const**) /Users/jlebar/code/moz/ff-git/src/parser/htmlparser/src/nsExpatDriver.cpp:385 (0x4054f962 libxul.so+0x32c962)
>        Driver_HandleStartElement /Users/jlebar/code/moz/ff-git/src/parser/htmlparser/src/nsExpatDriver.cpp:72 (0x4054f978 libxul.so+0x32c978)
>        doContent /Users/jlebar/code/moz/ff-git/src/parser/expat/lib/xmlparse.c:2387 (0x40e7db84 libxul.so+0xc5ab84)
>        contentProcessor /Users/jlebar/code/moz/ff-git/src/parser/expat/lib/xmlparse.c:2045 (0x40e7e142 libxul.so+0xc5b142)
>        doProlog /Users/jlebar/code/moz/ff-git/src/parser/expat/lib/xmlparse.c:4024 (0x40e7e708 libxul.so+0xc5b708)

Comment 2

[Boris Zbarsky [:bzbarsky]]

Is this XHTML?  Or is this the XML tree-viewer?  Is there any XBL involved?

Comment 3

[Justin Lebar (not reading bugmail)]

In general,

> Reported: ~95 blocks and ~68 block groups in frame group 128 of 2,254
>  ~507,709 bytes (~484,157 requested / ~23,552 slop)
>  2.11% of the heap;  0.01% of reported
>  PC is
>    nsCSSRuleProcessor::GetRuleCascade(nsPresContext*) /Users/jlebar/code/moz/ff-git
> /src/layout/style/nsCSSRuleProcessor.cpp:3162 (0x41329120 libxul.so+0x40e120)

GetRuleCascade, which boils down to this array and hashtable, is responsible for ~500kb of dark matter in the main B2G process.

Comment 4

[Nicholas Nethercote [inactive]]

Closing out some B2G bugs.