928692 - mozilla::image::RasterImage::GetDrawableImgFrame() (or something under it) retains (or leaks) memory

Status: NEW

(Core :: Graphics, defect)

Description

[Johnny Stenback (:jst)]

From DMD after having browsed in a VNC session for a week or so, with a nightly build from about a week or so:

Unreported: 3 blocks in stack trace record 1 of 7,442
 75,509,760 bytes (75,509,760 requested / 0 slop)
 14.70% of the heap (14.70% cumulative);  35.42% of unreported (35.42% cumulativ
e)
 Allocated at
   replace_realloc (/home/jst/fast/work/tip/mozilla/memory/replace/dmd/DMD.cpp:1
283) 0x7f079c1ebd10
   _cairo_array_grow_by (/home/jst/fast/work/tip/mozilla/gfx/cairo/cairo/src/cai
ro-array.c:162) 0x7f079792ca47
   _cairo_array_allocate (/home/jst/fast/work/tip/mozilla/gfx/cairo/cairo/src/ca
iro-array.c:336) 0x7f079792cb28
   _cairo_array_append_multiple (/home/jst/fast/work/tip/mozilla/gfx/cairo/cairo
/src/cairo-array.c:302) 0x7f079792cb88
   _cairo_user_data_array_set_data (/home/jst/fast/work/tip/mozilla/gfx/cairo/ca
iro/src/cairo-array.c:526) 0x7f079792cd96
   nsRefPtr<gfxImageSurface>::get() const (/home/jst/fast/work/tip/fb-rel/image/
src/../../dist/include/nsAutoPtr.h:1016) 0x7f07969eea94
   mozilla::image::RasterImage::GetDrawableImgFrame(unsigned int) (/home/jst/fas
t/work/tip/mozilla/image/src/RasterImage.cpp:689) 0x7f07969e88a4
   mozilla::image::RasterImage::GetFrame(unsigned int, unsigned int, gfxASurface
**) (/home/jst/fast/work/tip/mozilla/image/src/RasterImage.cpp:912) 0x7f07969e96
6a
   mozilla::image::RasterImage::GetCurrentImage() (/home/jst/fast/work/tip/mozil
la/image/src/RasterImage.cpp:952) 0x7f07969e675b
   mozilla::image::RasterImage::UpdateImageContainer() (/home/jst/fast/work/tip/
mozilla/image/src/RasterImage.cpp:1018) 0x7f07969e6870
   nsRefPtr<imgStatusTracker>::get() const (/home/jst/fast/work/tip/fb-rel/image
/src/../../dist/include/nsAutoPtr.h:1016) 0x7f07969e69cf
   nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyElements<nsISupports*
> >::Length() const (/home/jst/fast/work/tip/fb-rel/layout/base/../../dist/inclu
de/nsTArray.h:371) 0x7f0796a92815
   mozilla::RefreshDriverTimer::Tick() (/home/jst/fast/work/tip/mozilla/layout/b
ase/nsRefreshDriver.cpp:153) 0x7f0796a951ed
   nsTimerImpl::Fire() (/home/jst/fast/work/tip/mozilla/xpcom/threads/nsTimerImp
l.cpp:547) 0x7f079776b321

Comment 1

[Nicholas Nethercote [inactive]]

Who knows about this stuff?

Comment 2

[Andreas Gal :gal]

bholley has groveled around in this part of the code base I believe.

Comment 3

[Milan Sreckovic [:milan] (needinfo for best results)]

What's the question for Jeff?  "Find the leak" or something different?

Comment 4

[Bobby Holley (:bholley)]

(In reply to Milan Sreckovic [:milan] from comment #3)
> What's the question for Jeff?  "Find the leak" or something different?

I forwarded the request from Andreas. I would interpret it as "take a quick look and see if you can find the leak".

Comment 5

[Johnny Stenback (:jst)]

This could be something equally silly as what we ran into in bug 836173, which was that one of the code paths in the gfx code leaked (the non-accelerated one we use when we have no GPU hardware), but didn't leak in the accelerated case.

Comment 6

[Milan Sreckovic [:milan] (needinfo for best results)]

We'll have BenWa take a look when he's back.

Comment 7

[Benoit Girard (:BenWa)]

(In reply to Johnny Stenback (:jst, [e-mail]) from comment #0)
> Unreported: 3 blocks in stack trace record 1 of 7,442
>  75,509,760 bytes (75,509,760 requested / 0 slop)
>  14.70% of the heap (14.70% cumulative);  35.42% of unreported (35.42%

How do you read this? We leak 3 instances out of 7442? Did this signature leak 75 MB over 3 leaks? I believe cairo arrays are only meant to store small lists of data so if I'm reading this right something is very wrong.

Comment 8

[Nicholas Nethercote [inactive]]

(In reply to Benoit Girard (:BenWa) from comment #7)
> (In reply to Johnny Stenback (:jst, [e-mail]) from comment #0)
> > Unreported: 3 blocks in stack trace record 1 of 7,442
> >  75,509,760 bytes (75,509,760 requested / 0 slop)
> >  14.70% of the heap (14.70% cumulative);  35.42% of unreported (35.42%
> 
> How do you read this? We leak 3 instances out of 7442? Did this signature
> leak 75 MB over 3 leaks? I believe cairo arrays are only meant to store
> small lists of data so if I'm reading this right something is very wrong.

When jst took the snapshot, there were three live allocations that shared the allocation point described by the stack trace.  Their combined size was 75 MB.  (We can't tell what their individual sizes were.)  As for whether they are leaks, that's beyond the scope of what DMD can determine. 

The 7,442 isn't really relevant, it just refers to the number of unique stack traces required to describe the allocation point of all the live allocations.