New issue
Advanced search Search tips

Issue 781339 link

Starred by 3 users

Issue metadata

Status: Closed
Owner:
Closed: Dec 11
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 3
Type: Bug



Sign in to add a comment

Potential memory leak in ProcessTabRestoreServiceNotification

Project Member Reported by etienneb@chromium.org, Nov 3 2017

Issue description

We are running a chrome webbrowser for multiple days with an extension that keeps opening/closing tabs. The browser is instrumented with MEMLOG (out-of-process heap profiling) which is collecting metrics on memory allocations.

By looking to remaining allocated objects, we can see that there is potentially a memory leak in:

  JumpList::ProcessTabRestoreServiceNotification()

The attached image show some of the top stackframes and the allocations stackframes.
 
bug.png
275 KB View Download
The screenshots show that there are ~479k live ShellLinkItems. Just the 3 visible stacks show that they're responsible for >100MB of memory. That seems really concerning.
Owner: brucedaw...@chromium.org
Status: Assigned (was: Untriaged)
+brucedawson, who did some fixes in jump list code not too long ago.
Cc: chengx@chromium.org
+chengx, who recently changed this class quite a bit.
Owner: chengx@chromium.org
I'll take a look. Thanks.
The three reports we received from our test lab shows malloc with > 1.2G of private memory. This is really frightening.

Also note, this is part of M63. We may think back-porting the patch.
I agree that this is indeed frightening. 

Although I have rewritten almost the whole jumplist code to fix a bunch of severe bugs in it, I don't think I have touched the code inside JumpList::ProcessTabRestoreServiceNotification. I renamed the method though. Besides, I have landed 60+ patches to the jumplist class in the past few months, so the back-porting idea may not work. Anyway, I will take a look shortly for sure.

Was this issue there before M63? 
We do not have enough users running HP-OOP yet, so I can't easily tell when this bug make it's way into the code.

Also note, they were ASAN build (can't tell if this useful).

The load doesn't represent a normal user. The extension installed keep opening tabs to google.com and close it quickly. Which may help figuring out what is happening.

I know that some changes occurred recently on the way we detect a process shutdown. Is that something that may cause trouble here?

I'm gonna keep eyes on our dashboard and bringing back information on this bug.
  1) What is the oldest version with that bug
  2) Is that bug still in M64.

Cc: brucedaw...@chromium.org
Components: Internals
Labels: OS-Windows
Owner: davidbienvenu@chromium.org
etienneb@: Is there any update on this one? Thanks!
If the bug is too old, let close it.
The current memlog pipeline will catch it again.

I do not recall seeing these stackframes on the dashboard.
Status: Closed (was: Assigned)
Thx, Etienne, closing - I figured the memlog pipeline would tell us if this were still happening.

Sign in to add a comment