Bug 1993014 - [devtools] Also debug leaks via the the cycle collector. r=devtools-reviewers,nchevobbe

I'm moving the logic to understand the memory graphs in a dedicated module
in order to keep allocation tracker focused on the recording.

Differential Revision: https://phabricator.services.mozilla.com/D267822

Author: ochameau

devtools/client/framework/test/allocations/head.js

@@ -69,6 +69,12 @@ ChromeUtils.defineLazyGetter(this, "TrackedObjects", () => {
   );
 });
 
+ChromeUtils.defineLazyGetter(this, "TraceObjects", () => {
+  return ChromeUtils.importESModule(
+    "chrome://mochitests/content/browser/devtools/shared/test-helpers/trace-objects.sys.mjs"
+  );
+});
+
 // So that PERFHERDER data can be extracted from the logs.
 SimpleTest.requestCompleteLog();
 
@@ -160,9 +166,9 @@ async function stopRecordingAllocations(
   const parentProcessData =
     await tracker.stopRecordingAllocations(DEBUG_ALLOCATIONS);
 
-  const objectNodeIds = TrackedObjects.getAllNodeIds();
-  if (objectNodeIds.length) {
-    tracker.traceObjects(objectNodeIds);
+  const leakedObjects = TrackedObjects.getStillAllocatedObjects();
+  if (leakedObjects.length) {
+    await TraceObjects.traceObjects(leakedObjects, tracker.getSnapshotFile());
   }
 
   let contentProcessData = null;
@@ -187,12 +193,23 @@ async function stopRecordingAllocations(
   const trackedObjectsInContent = await SpecialPowers.spawn(
     gBrowser.selectedBrowser,
     [],
-    () => {
+    async () => {
       const TrackedObjects = ChromeUtils.importESModule(
         "resource://devtools/shared/test-helpers/tracked-objects.sys.mjs"
       );
-      const objectNodeIds = TrackedObjects.getAllNodeIds();
-      if (objectNodeIds.length) {
+      const leakedObjects = TrackedObjects.getStillAllocatedObjects();
+      if (leakedObjects.length) {
+        const TraceObjects = ChromeUtils.importESModule(
+          "chrome://mochitests/content/browser/devtools/shared/test-helpers/trace-objects.sys.mjs"
+        );
+        // Only pass 'weakRef' as Memory API and 'ubiNodeId' can only be inspected in the parent process
+        await TraceObjects.traceObjects(
+          leakedObjects.map(e => {
+            return {
+              weakRef: e.weakRef,
+            };
+          })
+        );
         const { DevToolsLoader } = ChromeUtils.importESModule(
           "resource://devtools/shared/loader/Loader.sys.mjs"
         );
@@ -202,14 +219,25 @@ async function stopRecordingAllocations(
         // As only the parent process can read the file because
         // of sandbox restrictions made to content processes regarding file I/O.
         const snapshotFile = tracker.getSnapshotFile();
-        return { snapshotFile, objectNodeIds };
+        return {
+          snapshotFile,
+          // Only pass ubi::Node::Id from this content process to the parent process.
+          // `leakedObjects`'s `weakRef` attributes can't be transferred across processes.
+          // TraceObjects.traceObjects in the parent process will only log leaks
+          // via the Memory API (and Node Id's).
+          objectUbiNodeIds: leakedObjects.map(e => {
+            return {
+              ubiNodeId: e.ubiNodeId,
+            };
+          }),
+        };
       }
       return null;
     }
   );
   if (trackedObjectsInContent) {
-    tracker.traceObjects(
-      trackedObjectsInContent.objectNodeIds,
+    TraceObjects.traceObjects(
+      trackedObjectsInContent.objectUbiNodeIds,
       trackedObjectsInContent.snapshotFile
     );
   }

devtools/shared/test-helpers/allocation-tracker.js

@@ -492,200 +492,6 @@ exports.allocationTracker = function ({
       return ChromeUtils.saveHeapSnapshot({ debugger: dbg });
     },
 
-    /**
-     * Print information about why a list of objects are being held in memory.
-     *
-     * @param Array<NodeId> objects
-     *        List of NodeId's of objects to debug. NodeIds can be retrieved
-     *        via ChromeUtils.getObjectNodeId.
-     * @param String snapshotFile
-     *        Absolute path to a Heap snapshot file retrieved via this.getSnapshotFile.
-     *        This is used to trace content process objects. We have to record the snapshot
-     *        from the content process, but can only read it from the parent process because
-     *        of I/O restrictions in content processes.
-     */
-    traceObjects(objects, snapshotFile) {
-      // There is no API to get the heap snapshot at runtime,
-      // the only way is to save it to disk and then load it from disk
-      if (!snapshotFile) {
-        snapshotFile = this.getSnapshotFile();
-      }
-      const snapshot = ChromeUtils.readHeapSnapshot(snapshotFile);
-
-      function getObjectDescription(id, prefix = 0) {
-        prefix = "  ".repeat(prefix);
-        if (!id) {
-          return prefix + "<null>";
-        }
-        try {
-          let stack = [...snapshot.describeNode({ by: "allocationStack" }, id)];
-          if (stack) {
-            stack = stack.find(([src]) => src != "noStack");
-            if (stack) {
-              const { line, column, source } = stack[0];
-              if (source) {
-                const lines = getFileContent(source);
-                const lineBefore = lines[line - 2];
-                const lineText = lines[line - 1];
-                const lineAfter = lines[line];
-                const filename = source.substr(source.lastIndexOf("/") + 1);
-
-                stack = "allocated at " + source + ":\n";
-                // Print one line before and after for context
-                if (lineBefore.trim().length) {
-                  stack += prefix + `  ${filename} @ ${line - 1}   \u007C`;
-                  stack += "\x1b[2m" + lineBefore + "\n";
-                }
-                stack += prefix + `  ${filename} @ ${line} > \u007C`;
-                // Grey out the beginning of the line, before frame's column,
-                // and display an arrow before displaying the rest of the line.
-                stack +=
-                  "\x1b[2m" +
-                  lineText.substr(0, column - 1) +
-                  "\x1b[0m" +
-                  "\u21A6 " +
-                  lineText.substr(column - 1) +
-                  "\n";
-                if (lineAfter.trim().length) {
-                  stack += prefix + `  ${filename} @ ${line + 1}   \u007C`;
-                  stack += lineAfter;
-                }
-              } else {
-                stack = "(missing source)";
-              }
-            } else {
-              stack = "(without allocation stack)";
-            }
-          } else {
-            stack = "(without description)";
-          }
-          let objectClass = Object.entries(
-            snapshot.describeNode({ by: "objectClass" }, id)
-          )[0][0];
-          if (objectClass == "other") {
-            objectClass = Object.entries(
-              snapshot.describeNode({ by: "internalType" }, id)
-            )[0][0];
-          }
-          const arrow = prefix > 0 ? "\\--> " : "";
-          return prefix + arrow + objectClass + " " + stack;
-        } catch (e) {
-          if (e.name == "NS_ERROR_ILLEGAL_VALUE") {
-            return (
-              prefix + "<not-in-memory-snapshot:is-from-untracked-global?>"
-            );
-          }
-          return prefix + "<invalid:" + id + ":" + e + ">";
-        }
-      }
-
-      const fileContents = new Map();
-
-      function getFileContent(url) {
-        let content = fileContents.get(url);
-        if (content) {
-          return content;
-        }
-        content = readURI(url).split("\n");
-        fileContents.set(url, content);
-        return content;
-      }
-
-      function readURI(uri) {
-        const { NetUtil } = ChromeUtils.importESModule(
-          "resource://gre/modules/NetUtil.sys.mjs",
-          { global: "contextual" }
-        );
-        const stream = NetUtil.newChannel({
-          uri: NetUtil.newURI(uri, "UTF-8"),
-          loadUsingSystemPrincipal: true,
-        }).open();
-        const count = stream.available();
-        const data = NetUtil.readInputStreamToString(stream, count, {
-          charset: "UTF-8",
-        });
-
-        stream.close();
-        return data;
-      }
-
-      function printPath(src, dst) {
-        let paths;
-        try {
-          paths = snapshot.computeShortestPaths(src, [dst], 10);
-        } catch (e) {}
-        if (paths && paths.has(dst)) {
-          let pathLength = Infinity;
-          let n = 0;
-          for (const path of paths.get(dst)) {
-            n++;
-            // Only print the smaller paths.
-            // The longer ones will only repeat the smaller ones, with some extra edges.
-            if (path.length > pathLength + 1) {
-              continue;
-            }
-            pathLength = path.length;
-            logTracker(
-              `Path #${n}:\n` +
-                path
-                  .map(({ predecessor, edge }, i) => {
-                    return (
-                      getObjectDescription(predecessor, i) +
-                      "\n" +
-                      "  ".repeat(i) +
-                      "Holds the following object via '" +
-                      edge +
-                      "' attribute:\n"
-                    );
-                  })
-                  .join("") +
-                getObjectDescription(dst, path.length)
-            );
-          }
-        } else {
-          logTracker("NO-PATH");
-        }
-      }
-
-      const tree = snapshot.computeDominatorTree();
-      for (const objectNodeId of objects) {
-        logTracker(" # Tracing object #" + objectNodeId + "\n");
-
-        // Print the path from the global object down to leaked object.
-        // This print the allocation site of each object which has a reference
-        // to another object, ultimately leading to our leaked object.
-        logTracker("### Path(s) from root:");
-        printPath(tree.root, objectNodeId);
-
-        /**
-         * This happens to be redundant with printPath, but printed the other way around.
-         *
-        // Print the dominators.
-        // i.e. from the leaked object, print all parent objects whichs
-        // keeps a reference to the previous object, up to a global object.
-        logTracker("### Dominators:");
-        let node = objectNodeId,
-        logTracker(" " + getObjectDescription(node));
-        while ((node = tree.getImmediateDominator(node))) {
-          logTracker(" ^-- " + getObjectDescription(node));
-        }
-        */
-
-        /**
-         * In case you are not able to figure out what the object is.
-         * This will print all what it keeps allocated,
-         * kinds of list of attributes
-         *
-        logTracker("### Dominateds:");
-        node = objectNodeId,
-        logTracker(" " + getObjectDescription(node));
-        for (const n of tree.getImmediatelyDominated(objectNodeId)) {
-          logTracker(" --> " + getObjectDescription(n));
-        }
-        */
-      }
-    },
-
     stop() {
       logTracker("Stop logging allocations");
       dbg.onNewGlobalObject = undefined;

devtools/shared/test-helpers/browser.toml

@@ -1,11 +1,15 @@
 [DEFAULT]
 tags = "devtools"
 subsuite = "devtools"
-support-files = ["allocation-tracker.js"]
+support-files = [
+    "allocation-tracker.js",
+    "cc-analyzer.sys.mjs",
+    "trace-objects.sys.mjs",
+]
 
 ["browser_allocation_tracker.js"]
+run-if = ["os == 'linux' && opt"] # Results should be platform agnostic - only run on linux64-opt
 skip-if = [
-  "os == 'win' && os_version == '11.26100' && processor == 'x86_64' && ccov", # And ccov as this doesn't aim to cover any production code, we are only testing test helpers here.
   "verify", # Bug 1730507 - objects without stacks get allocated during the GC of the first test when running multiple times.
 ]
 

devtools/shared/test-helpers/browser_allocation_tracker.js

@@ -110,17 +110,26 @@ add_task(async function () {
   let transient = {};
   TrackedObjects.track(transient);
 
-  is(TrackedObjects.getAllNodeIds().length, 2, "The two objects are reported");
+  is(
+    TrackedObjects.getStillAllocatedObjects().length,
+    2,
+    "The two objects are reported"
+  );
 
   info("Free the transient object");
   transient = null;
   Cu.forceGC();
 
   is(
-    TrackedObjects.getAllNodeIds().length,
+    TrackedObjects.getStillAllocatedObjects().length,
     1,
     "We now only have the leaked object"
   );
+  is(
+    TrackedObjects.getStillAllocatedObjects()[0].weakRef.get(),
+    leaked,
+    "The still allocated objects is the leaked one"
+  );
   TrackedObjects.clear();
 });