New issue
Advanced search Search tips

Issue 732875 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 1
Type: Bug



Sign in to add a comment

Potential memory leak in ExtensionWebRequestTimeTracker::LogRequestStartTime.

Project Member Reported by erikc...@chromium.org, Jun 13 2017

Issue description

I've been looking at sources of browser memory bloat by using native heap profiling on my own browser. Full details:
https://docs.google.com/document/d/1fN5balfyrd7sRpd6DRaUI1TwoOwYjLyRSd7mwZT5US8/edit#

Over the course of 1 week, the browser process created ~28k objects in ExtensionWebRequestTimeTracker::LogRequestStartTime() that it did not destroy. This is suggestive of a large leak.

Each screenshot shows:
  1) # of objects created [that have not been destroyed]
  2) The stack trace of the code that created the object.

rdevlin: Can you take a look?

I took a quick look at the code, and I think there's at least 1 leak.
"""
  while (request_ids_.size() > kMaxRequestsLogged) {
    int64_t to_remove = request_ids_.front();
    request_ids_.pop();
    std::map<int64_t, RequestTimeLog>::iterator iter =
        request_time_logs_.find(to_remove);
    if (iter != request_time_logs_.end() && iter->second.completed) {
      request_time_logs_.erase(iter);
      moderate_delays_.erase(to_remove);
      excessive_delays_.erase(to_remove);
    }
  }
"""
When we clear out requests, we don't clear out request_time_logs_ if the request hasn't completed. But when the request finally completes, we still don't clear it out. I don't know if this is the only leak or if there's more.
 
Screen Shot 2017-06-13 at 10.53.10 AM.png
408 KB View Download
Screen Shot 2017-06-13 at 10.53.02 AM.png
381 KB View Download
Leaks of different objects, but might be caused by the same root cause?
Screen Shot 2017-06-13 at 4.14.10 PM.png
369 KB View Download
Screen Shot 2017-06-13 at 4.14.04 PM.png
383 KB View Download
Cc: rdevlin....@chromium.org
Owner: karandeepb@chromium.org
triage -> karandeepb@, mind taking a look?
Status: Started (was: Assigned)
For the case Eric mentioned, along with the request logs, when the request actually completes, it may insert the id into the |excessive_delays_| and |moderate_delays_| which would then leak as well. (which should explain c#1).

Devlin: ExtensionWebRequestTimeTracker has a lot of book-keeping to support ExtensionWebRequestTimeTrackerDelegate, but it isn't being used currently. The DefaultDelegate's implementation was commented out in https://codereview.chromium.org/8292006. Do we plan to support this? If not, we can simplify ExtensionWebRequestTimeTracker. 

Aside: The logic for invoking NotifyExcessiveDelays/NotifyModerateDelays also doesn't seem correct (as per its documentation). While request_ids_ does store the last seen requests, this is not true for |excessive_delays_| and |moderate_delays_| as per the current implementation, but this is probably just a bug.
Ping Devlin. 
Cc: battre@chromium.org
+cc battre, author of https://codereview.chromium.org/8292006.

My instinct is that, if this hasn't been used in 5 years, it's probably due for cleanup.  I'm fine with removing this logic and simplifying the code, and if we want it back, it will live on in git history.

Note: we *should* make sure to keep UMA metrics.

Comment 7 by etienneb@google.com, Jun 22 2017

This stackframe still shows up in recent traces.

It's leaking about 1.5M in ~6700 objects
bug1.png
93.1 KB View Download

Comment 8 by battre@chromium.org, Jun 23 2017

I agree. I have created a quick CL that strips a lot of unnecessary code: https://chromium-review.googlesource.com/c/544951/
Status: Fixed (was: Started)
Labels: Performance-Memory

Sign in to add a comment