Bug 1195295 - content-sessionStore.js sends a sync message to the parent in SyncHandler.init

Easy peasy. One thing I had to do was add an async message from the bottom of content-sessionStore.js to reset the last message ID in TabState, since the frame script will be reloaded during remoteness flips.

Try push: https://treeherder.mozilla.org/#/jobs?repo=try&revision=22792b42a9e3

Ah, looks like there’s greater simplification I can do. We don’t need IDs at all anymore! Hurray!

Okay, my new patch passes both non-e10s and e10s states. Waiting on review!

Woo! We’re good - just fixed some documentation. Waiting on a try build now:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=ca01730bf69d

Hummm…. some test failures. :/

562 INFO TEST-UNEXPECTED-FAIL | browser/base/content/test/general/browser_tab_detach_restore.js | Should have restore data for the closed window - Got 0, expected 1

Another try push: https://treeherder.mozilla.org/#/jobs?repo=try&revision=d559836d00d0

Huh. Still no good.

AAAAAND another: https://treeherder.mozilla.org/#/jobs?repo=try&revision=d5e1bde735e3

Okay, fixed! Now I just need review on my fixes, I guess.

Test to see if a hung plugin no longer blocks shutdown for jimm. We seem to spin the event loop for like 5s, and then we just shut ‘er down. No hangs.

Crap - this got backed out. 😔 Waiting on ting to fix the memory leak in https://bugzilla.mozilla.org/show_bug.cgi?id=1220517

Hey - I think I’ve figured this out. I think we need to clear out the data map after flushing the message queue.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=1b1377860df8

Hm. Nope. That wasn’t it. Maybe I need to clear the timeout and clear out the data on uninit instead?

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b46be79c6070

New idea - maybe there is data being pushed to the MessageQueue after uninit. Let’s prevent that.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=0b0446d54dc1

DAMN IT. Nope. WTF???

https://treeherder.mozilla.org/#/jobs?repo=try&revision=798022ebbe7b

Hypothesis: https://hg.mozilla.org/try/rev/582c8e1fffe6 creates a cycle. HOW???

I DUNNO. :((( Let’s… try everything.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=f70d1cbcfa95

GARARH! MOTHER FUCKER

Without patch:

Object frequency. Showing no more than 5 classes of objects, with at least 5 objects each.

2853 JS Object (Function)

2845 JS Object (other)

2138 JS Script

235 nsGenericDOMDataNode

142 nsXPCWrappedJS

cc-edges.2548.log:32DED600 [gc] JS Object (Function)

cc-edges.2548.log:1C33D9C0 [gc] JS Object (Function)

cc-edges.2548.log:1B101A60 [gc] JS Object (Function)

cc-edges.2548.log:12B0AD20 [gc] JS Object (Function)

cc-edges.2548.log:12B0AE20 [gc] JS Object (Function)

cc-edges.2548.log:17912A30 [gc] JS Object (Function)

cc-edges.2548.log:27751B50 [gc] JS Object (Function)

cc-edges.2548.log:27751B80 [gc] JS Object (Function)

cc-edges.2548.log:179129D0 [gc] JS Object (Function)

cc-edges.2548.log:2283EFE0 [gc] JS Object (Function)

cc-edges.2548.log:27E449C0 [gc] JS Object (Function)

cc-edges.2548.log:27E449A0 [gc] JS Object (Function)

cc-edges.2548.log:27E44980 [gc] JS Object (Function)

cc-edges.2548.log:27E44960 [gc] JS Object (Function)

cc-edges.2548.log:27E44940 [gc] JS Object (Function)

cc-edges.2548.log:27E44920 [gc] JS Object (Function)

cc-edges.2548.log:333A3DC0 [gc] JS Object (Function)

cc-edges.2548.log:333A3DA0 [gc] JS Object (Function)

cc-edges.2548.log:333A3D80 [gc] JS Object (Function)

cc-edges.2548.log:2AF12820 [gc] JS Object (Function)

cc-edges.2548.log:2AF12800 [gc] JS Object (Function)

cc-edges.2548.log:2AF127E0 [gc] JS Object (Function)

cc-edges.2548.log:31A679E0 [gc] JS Object (Function)

cc-edges.2548.log:31A679C0 [gc] JS Object (Function)

cc-edges.2548.log:31A679A0 [gc] JS Object (Function)

cc-edges.2548.log:2009BA20 [gc] JS Object (Function)

cc-edges.2548.log:1D8EB900 [gc] JS Object (Function)

cc-edges.2548.log:1D8EB8E0 [gc] JS Object (Function)

cc-edges.2548.log:198273A0 [gc] JS Object (Function)

cc-edges.2548.log:19827380 [gc] JS Object (Function)

cc-edges.2548.log:19827360 [gc] JS Object (Function)

cc-edges.2548.log:1B110B60 [gc] JS Object (Function)

cc-edges.2548.log:32E814C0 [gc] JS Object (Function)

cc-edges.2548.log:32E814A0 [gc] JS Object (Function)

cc-edges.2548.log:32E81480 [gc] JS Object (Function)

cc-edges.2548.log:20050220 [gc] JS Object (Function)

cc-edges.2548.log:20050200 [gc] JS Object (Function)

cc-edges.2548.log:200501E0 [gc] JS Object (Function)

cc-edges.2548.log:1FE8A0A0 [gc] JS Object (Function)

cc-edges.2548.log:1FE8A080 [gc] JS Object (Function)

cc-edges.2548.log:1FE8A060 [gc] JS Object (Function)

cc-edges.2548.log:310739E0 [gc] JS Object (Function)

cc-edges.2548.log:310739C0 [gc] JS Object (Function)

cc-edges.2548.log:310739A0 [gc] JS Object (Function)

cc-edges.2548.log:31A073A0 [gc] JS Object (Function)

cc-edges.2548.log:31A07380 [gc] JS Object (Function)

cc-edges.2548.log:31A07360 [gc] JS Object (Function)

cc-edges.2548.log:1C34C1C0 [gc] JS Object (Function)

cc-edges.2548.log:1F44D780 [gc] JS Object (Function)

cc-edges.2548.log:1F44D760 [gc] JS Object (Function)

cc-edges.2548.log:19479100 [gc] JS Object (Function)

cc-edges.2548.log:194790E0 [gc] JS Object (Function)

cc-edges.2548.log:194790C0 [gc] JS Object (Function)

cc-edges.2548.log:277518E0 [gc] JS Object (Function)

cc-edges.2548.log:179127F0 [gc] JS Object (Function)

cc-edges.2548.log:133CFCD0 [gc] JS Object (Function)

cc-edges.2548.log:133CFD00 [gc] JS Object (Function)

With patch:

10497 JS Object (Function)

6288 JS Object (other)

4493 JS Script

235 nsGenericDOMDataNode

187 XPCWrappedNative

cc-edges.2168.log:129E6BA0 [gc] JS Object (Function)

cc-edges.2168.log:20A74E90 [gc] JS Object (Function)

cc-edges.2168.log:129E6BC0 [gc] JS Object (Function)

cc-edges.2168.log:1D10F240 [gc] JS Object (Function)

cc-edges.2168.log:1D120800 [gc] JS Object (Function)

cc-edges.2168.log:1D10F260 [gc] JS Object (Function)

cc-edges.2168.log:1D120040 [gc] JS Object (Function)

cc-edges.2168.log:1D11AFE0 [gc] JS Object (Function)

cc-edges.2168.log:1D1200C0 [gc] JS Object (Function)

cc-edges.2168.log:1D120080 [gc] JS Object (Function)

cc-edges.2168.log:1D120140 [gc] JS Object (Function)

cc-edges.2168.log:1D120100 [gc] JS Object (Function)

cc-edges.2168.log:1D120180 [gc] JS Object (Function)

cc-edges.2168.log:1D1201C0 [gc] JS Object (Function)

cc-edges.2168.log:1D120200 [gc] JS Object (Function)

cc-edges.2168.log:129E6C20 [gc] JS Object (Function)

cc-edges.2168.log:20A74EF0 [gc] JS Object (Function)

cc-edges.2168.log:129E6C60 [gc] JS Object (Function)

cc-edges.2168.log:26BA9020 [gc] JS Object (Function)

cc-edges.2168.log:26BB35E0 [gc] JS Object (Function)

cc-edges.2168.log:26BA9040 [gc] JS Object (Function)

cc-edges.2168.log:26BACE00 [gc] JS Object (Function)

cc-edges.2168.log:26BACDC0 [gc] JS Object (Function)

cc-edges.2168.log:26BACE80 [gc] JS Object (Function)

cc-edges.2168.log:26BACE40 [gc] JS Object (Function)

cc-edges.2168.log:26BACF00 [gc] JS Object (Function)

cc-edges.2168.log:26BACEC0 [gc] JS Object (Function)

cc-edges.2168.log:26BACF40 [gc] JS Object (Function)

cc-edges.2168.log:26BACF80 [gc] JS Object (Function)

cc-edges.2168.log:26BACFC0 [gc] JS Object (Function)

cc-edges.2168.log:1E527610 [gc] JS Object (Function)

cc-edges.2168.log:12EEBAF0 [gc] JS Object (Function)

cc-edges.2168.log:1E5275D0 [gc] JS Object (Function)

cc-edges.2168.log:17503980 [gc] JS Object (Function)

cc-edges.2168.log:26CDA4E0 [gc] JS Object (Function)

cc-edges.2168.log:175039A0 [gc] JS Object (Function)

cc-edges.2168.log:27625C80 [gc] JS Object (Function)

cc-edges.2168.log:27625C40 [gc] JS Object (Function)

cc-edges.2168.log:27625D00 [gc] JS Object (Function)

cc-edges.2168.log:27625CC0 [gc] JS Object (Function)

cc-edges.2168.log:27625D80 [gc] JS Object (Function)

cc-edges.2168.log:27625D40 [gc] JS Object (Function)

cc-edges.2168.log:27625DC0 [gc] JS Object (Function)

cc-edges.2168.log:27625E00 [gc] JS Object (Function)

cc-edges.2168.log:27625E40 [gc] JS Object (Function)

cc-edges.2168.log:15449E00 [gc] JS Object (Function)

cc-edges.2168.log:14DF0BC0 [gc] JS Object (Function)

cc-edges.2168.log:15449E40 [gc] JS Object (Function)

cc-edges.2168.log:16784120 [gc] JS Object (Function)

cc-edges.2168.log:2AD44DC0 [gc] JS Object (Function)

cc-edges.2168.log:16784140 [gc] JS Object (Function)

cc-edges.2168.log:2AD44380 [gc] JS Object (Function)

cc-edges.2168.log:2AD44340 [gc] JS Object (Function)

cc-edges.2168.log:2AD44400 [gc] JS Object (Function)

cc-edges.2168.log:2AD443C0 [gc] JS Object (Function)

cc-edges.2168.log:2AD44500 [gc] JS Object (Function)

cc-edges.2168.log:2AD444C0 [gc] JS Object (Function)

cc-edges.2168.log:2AD44560 [gc] JS Object (Function)

cc-edges.2168.log:2AD445E0 [gc] JS Object (Function)

cc-edges.2168.log:2AD44620 [gc] JS Object (Function)

cc-edges.2168.log:133E26F0 [gc] JS Object (Function)

cc-edges.2168.log:129E69B0 [gc] JS Object (Function)

cc-edges.2168.log:133E2750 [gc] JS Object (Function)

cc-edges.2168.log:28D30360 [gc] JS Object (Function)

cc-edges.2168.log:29D5FE40 [gc] JS Object (Function)

cc-edges.2168.log:28D30380 [gc] JS Object (Function)

cc-edges.2168.log:29D5F660 [gc] JS Object (Function)

cc-edges.2168.log:29D5F620 [gc] JS Object (Function)

cc-edges.2168.log:29D5F6E0 [gc] JS Object (Function)

cc-edges.2168.log:29D5F6A0 [gc] JS Object (Function)

cc-edges.2168.log:29D5F760 [gc] JS Object (Function)

cc-edges.2168.log:29D5F720 [gc] JS Object (Function)

cc-edges.2168.log:29D5F7A0 [gc] JS Object (Function)

cc-edges.2168.log:29D5F7E0 [gc] JS Object (Function)

cc-edges.2168.log:29D5F820 [gc] JS Object (Function)

cc-edges.2168.log:21EDC3C0 [gc] JS Object (Function)

cc-edges.2168.log:1D330E00 [gc] JS Object (Function)

cc-edges.2168.log:1B148610 [gc] JS Object (Function)

cc-edges.2168.log:12B0AD20 [gc] JS Object (Function)

cc-edges.2168.log:12B0AE20 [gc] JS Object (Function)

cc-edges.2168.log:154B23D0 [gc] JS Object (Function)

cc-edges.2168.log:154B23A0 [gc] JS Object (Function)

cc-edges.2168.log:31CEE760 [gc] JS Object (Function)

cc-edges.2168.log:31CEE730 [gc] JS Object (Function)

cc-edges.2168.log:1D120900 [gc] JS Object (Function)

cc-edges.2168.log:26BB36E0 [gc] JS Object (Function)

cc-edges.2168.log:26CDA5E0 [gc] JS Object (Function)

cc-edges.2168.log:2AD44F20 [gc] JS Object (Function)

cc-edges.2168.log:29D5FF40 [gc] JS Object (Function)

cc-edges.2168.log:12B872A0 [gc] JS Object (Function)

cc-edges.2168.log:27508960 [gc] JS Object (Function)

cc-edges.2168.log:27508940 [gc] JS Object (Function)

cc-edges.2168.log:27508920 [gc] JS Object (Function)

cc-edges.2168.log:27508900 [gc] JS Object (Function)

cc-edges.2168.log:275088E0 [gc] JS Object (Function)

cc-edges.2168.log:275088C0 [gc] JS Object (Function)

cc-edges.2168.log:29EE76A0 [gc] JS Object (Function)

cc-edges.2168.log:29EE7680 [gc] JS Object (Function)

cc-edges.2168.log:29EE7640 [gc] JS Object (Function)

cc-edges.2168.log:175036C0 [gc] JS Object (Function)

cc-edges.2168.log:175036A0 [gc] JS Object (Function)

cc-edges.2168.log:17503680 [gc] JS Object (Function)

cc-edges.2168.log:32312CC0 [gc] JS Object (Function)

cc-edges.2168.log:32312CA0 [gc] JS Object (Function)

cc-edges.2168.log:32312C80 [gc] JS Object (Function)

cc-edges.2168.log:2CB99BA0 [gc] JS Object (Function)

cc-edges.2168.log:2CB99B80 [gc] JS Object (Function)

cc-edges.2168.log:2CB99B60 [gc] JS Object (Function)

cc-edges.2168.log:19913280 [gc] JS Object (Function)

cc-edges.2168.log:19913260 [gc] JS Object (Function)

cc-edges.2168.log:19913240 [gc] JS Object (Function)

cc-edges.2168.log:1D3288C0 [gc] JS Object (Function)

cc-edges.2168.log:1D158480 [gc] JS Object (Function)

cc-edges.2168.log:1D158460 [gc] JS Object (Function)

cc-edges.2168.log:1D158440 [gc] JS Object (Function)

cc-edges.2168.log:26BD3260 [gc] JS Object (Function)

cc-edges.2168.log:26BD3240 [gc] JS Object (Function)

cc-edges.2168.log:26BD3220 [gc] JS Object (Function)

cc-edges.2168.log:1DCD6340 [gc] JS Object (Function)

cc-edges.2168.log:1DCD6320 [gc] JS Object (Function)

cc-edges.2168.log:1DCD6300 [gc] JS Object (Function)

cc-edges.2168.log:300E29C0 [gc] JS Object (Function)

cc-edges.2168.log:300E29A0 [gc] JS Object (Function)

cc-edges.2168.log:300E2980 [gc] JS Object (Function)

cc-edges.2168.log:32F85B20 [gc] JS Object (Function)

cc-edges.2168.log:32F85B00 [gc] JS Object (Function)

cc-edges.2168.log:32F85AE0 [gc] JS Object (Function)

cc-edges.2168.log:2CB4FB00 [gc] JS Object (Function)

cc-edges.2168.log:2CB4FAE0 [gc] JS Object (Function)

cc-edges.2168.log:2CB4FAC0 [gc] JS Object (Function)

cc-edges.2168.log:1955AE40 [gc] JS Object (Function)

cc-edges.2168.log:1955AE20 [gc] JS Object (Function)

cc-edges.2168.log:1955AE00 [gc] JS Object (Function)

cc-edges.2168.log:2AD1DF20 [gc] JS Object (Function)

cc-edges.2168.log:26BFA460 [gc] JS Object (Function)

cc-edges.2168.log:1D132310 [gc] JS Object (Function)

cc-edges.2168.log:2ACBC0E0 [gc] JS Object (Function)

cc-edges.2168.log:2AD1D8C0 [gc] JS Object (Function)

cc-edges.2168.log:26BBD3A0 [gc] JS Object (Function)

cc-edges.2168.log:27752920 [gc] JS Object (Function)

cc-edges.2168.log:27752580 [gc] JS Object (Function)

cc-edges.2168.log:3178B580 [gc] JS Object (Function)

cc-edges.2168.log:1F2D18A0 [gc] JS Object (Function)

cc-edges.2168.log:1F2D17A0 [gc] JS Object (Function)

cc-edges.2168.log:32F8C430 [gc] JS Object (Function)

cc-edges.2168.log:2BA76300 [gc] JS Object (Function)

cc-edges.2168.log:2BA76200 [gc] JS Object (Function)

cc-edges.2168.log:2BA73AF0 [gc] JS Object (Function)

cc-edges.2168.log:1D1B2620 [gc] JS Object (Function)

cc-edges.2168.log:1D1B20C0 [gc] JS Object (Function)

cc-edges.2168.log:1D11FA30 [gc] JS Object (Function)

cc-edges.2168.log:26BFA400 [gc] JS Object (Function)

cc-edges.2168.log:26BD3E80 [gc] JS Object (Function)

cc-edges.2168.log:26BB0AC0 [gc] JS Object (Function)

cc-edges.2168.log:28905660 [gc] JS Object (Function)

cc-edges.2168.log:28905100 [gc] JS Object (Function)

cc-edges.2168.log:253F1B20 [gc] JS Object (Function)

cc-edges.2168.log:2BAC8F40 [gc] JS Object (Function)

cc-edges.2168.log:2BAC8960 [gc] JS Object (Function)

cc-edges.2168.log:2D6BB910 [gc] JS Object (Function)

cc-edges.2168.log:29D5ECE0 [gc] JS Object (Function)

cc-edges.2168.log:29D5E760 [gc] JS Object (Function)

cc-edges.2168.log:2BA73220 [gc] JS Object (Function)

cc-edges.2168.log:154B2310 [gc] JS Object (Function)

cc-edges.2168.log:31CEE6A0 [gc] JS Object (Function)

cc-edges.2168.log:133CFCD0 [gc] JS Object (Function)

cc-edges.2168.log:133CFD00 [gc] JS Object (Function)

https://treeherder.mozilla.org/#/jobs?repo=try&revision=fa4159003aa8

mccr8 > mconley : then you can try doing another run with your patch with MOZ_CC_ALL_TRACES=1 and MOZ_CC_LOG_ALL=1 set, and look at logs before those shutdown CCs, and see what is holding those object alive earlier.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=052e81420748

Experiments:

Try re-setting up the timer if timerDisabled is then set to false?

https://treeherder.mozilla.org/#/jobs?repo=try&revision=03cc331a02c0

Try adding a sync message

https://treeherder.mozilla.org/#/jobs?repo=try&revision=62b1867968a0

FUCK IT. Let’s break the patch up into chunks and bisect the motherfucker.

DOING SO.

Chunk 1: https://treeherder.mozilla.org/#/jobs?repo=try&revision=bd0c471ec83e

Chunk 2: https://treeherder.mozilla.org/#/jobs?repo=try&revision=e1c170a77644 CULPRIT

Chunk 2 - 1: https://treeherder.mozilla.org/#/jobs?repo=try&revision=908fee87eacf

Chunk 2 - 2: https://treeherder.mozilla.org/#/jobs?repo=try&revision=273b2c2bda56 CULPRIT

Remove _latestMessageID: https://treeherder.mozilla.org/#/jobs?repo=try&revision=61c5c0b25240

Make setSyncHandler a no-op: https://treeherder.mozilla.org/#/jobs?repo=try&revision=1dc6b98cdfd6

Don’t respond to setupSyncHandler message: https://treeherder.mozilla.org/#/jobs?repo=try&revision=ba95840be976

Don’t listen for setupSyncHandler on closed: https://treeherder.mozilla.org/#/jobs?repo=try&revision=67bc80826d4d

Don’t listen for setupSyncHandler at all: https://treeherder.mozilla.org/#/jobs?repo=try&revision=f129ec2ca7f6

Chunk 3: https://treeherder.mozilla.org/#/jobs?repo=try&revision=a0f9c2f1ec43

Chunk 4: https://treeherder.mozilla.org/#/jobs?repo=try&revision=54e9ee9cbf6f

Chunk 5: https://treeherder.mozilla.org/#/jobs?repo=try&revision=54e9ee9cbf6f

Some dump WeakMap: https://treeherder.mozilla.org/#/jobs?repo=try&revision=2f538df7ec1e

Boooo, no better. :/

New tactic: Start eliminating tests to see if we can make this leak go away.

ALSO - try just eliminating the timer in general: https://treeherder.mozilla.org/#/jobs?repo=try&revision=12b29774ece6

Nope. 😔

Shot-in-the-dark logging: https://treeherder.mozilla.org/#/jobs?repo=try&revision=24e03ba65bb4

Gut sync-ui: https://treeherder.mozilla.org/#/jobs?repo=try&revision=332fc2c4394f

Nope. Though again, it looks like the ones that succeed have all of those errors, and the ones that don’t have no errors...

Disable the sync tests: https://treeherder.mozilla.org/#/jobs?repo=try&revision=868c894fd7a4

Huh… I wonder if these Promise rejections have something to do with it...

mccr8 says:

"I looked at this a little bit. The DETH in comment 36 is whatever is implementing ContentFrameMessageManager. You can tell because an XPCWN (ContentFrameMessageManager) has an mIdentity field that points to it, so that's the underlying native for the XPCWN. I think. I was looking at a different set of objects, JS Functions for SpecialPowersAPI.prototype.* methods, but they were also being held alive by ContentFrameMessageManager, through mAnonymousGlobalScopes. I'm not sure why all of this JS is being entrained there."

Gut a bunch of tests that cause Promise rejections: https://treeherder.mozilla.org/#/jobs?repo=try&revision=1536ac8ea9f4

Force GC / CC between tests: https://treeherder.mozilla.org/#/jobs?repo=try&revision=25f217365060

FUUUUUUUCK FUCK FUCK FUCK FUCK

GAOUJAS:LKJSDL:KJSJKRLS:KDRJ RAGE OUT RAGE

Okay, let’s see if I can reproduce locally. I’ll run browser-syncui.js with a debug build.

Try a bunch of stuff: https://treeherder.mozilla.org/#/jobs?repo=try&revision=88afa06cb4ea

More random stabs: https://treeherder.mozilla.org/#/jobs?repo=try&revision=485d814d33e5

Delete everything: https://treeherder.mozilla.org/#/jobs?repo=try&revision=57e1311374dd

Unload logging: https://treeherder.mozilla.org/#/jobs?repo=try&revision=63b079bc943c

Just break syncui. https://treeherder.mozilla.org/#/jobs?repo=try&revision=ea76ae8944b7

MacBook-Pro-104:leakthing mikeconley$ grep "G mAnonymousGlobal" patch-applied | wc -l

MacBook-Pro-104:leakthing mikeconley$ grep "B mAnonymousGlobal" patch-applied | wc -l

Sum: 131

MacBook-Pro-104:leakthing mikeconley$ grep "G mAnonymousGlobal" patch-not-applied | wc -l

MacBook-Pro-104:leakthing mikeconley$ grep "B mAnonymousGlobal" patch-not-applied | wc -l

Sum: 131

Okay, ting’s last comment is really interesting:

"The ContentFrameMessageManager was marked gray during GC, but without the patch, it will be unmarked to black when FixWeakMappingGrayBitsTracer::trace() is called for the WeakMap |_syncHandlers|:

https://dxr.mozilla.org/mozilla-central/source/xpcom/base/nsCycleCollector.cpp#3791
https://dxr.mozilla.org/mozilla-central/source/xpcom/base/nsCycleCollector.cpp#3478

which winds up calling JS::UnmarkGrayGCThingRecursively() and unmark everything SyncHandler instances reference to:

https://dxr.mozilla.org/mozilla-central/source/xpcom/base/CycleCollectedJSRuntime.cpp#269

This is why there're much less CC participants without the patch. But I don't know should CC check all these things when the patch is applied, it's a lot of them.

So it's not there're more anon global scopes, it's just they are marked gray or black. For example, from the log of comment 36 , without the patch:

cc-edges.2548.log:
18AAA600 [rc=1] DOMEventTargetHelper
> 18083900 mAnonymousGlobalScopes[i]
> 180B4340 mAnonymousGlobalScopes[i]
> 18C0AEA0 mAnonymousGlobalScopes[i]
> 18C2C020 mAnonymousGlobalScopes[i]
> 18C2CE40 mAnonymousGlobalScopes[i]
> 194697E0 mAnonymousGlobalScopes[i]
> 1B153C00 mAnonymousGlobalScopes[i]

gc-edges.2548.log:
18083860 B mAnonymousGlobalScopes[i]
18083900 G mAnonymousGlobalScopes[i]
18083980 B mAnonymousGlobalScopes[i]
18083F00 B mAnonymousGlobalScopes[i]
180B41C0 B mAnonymousGlobalScopes[i]
180B4340 G mAnonymousGlobalScopes[i]
183D7940 B mAnonymousGlobalScopes[i]
18C0A360 B mAnonymousGlobalScopes[i]
18C0AEA0 G mAnonymousGlobalScopes[i]
18C2C020 G mAnonymousGlobalScopes[i]
18C2CE40 G mAnonymousGlobalScopes[i]

194697E0 G mAnonymousGlobalScopes[i]"

https://treeherder.mozilla.org/#/jobs?repo=try&revision=439ef7a7aea4

Logging:

Baseline: https://treeherder.mozilla.org/#/jobs?repo=try&revision=32904b840f39

Patch: https://treeherder.mozilla.org/#/jobs?repo=try&revision=cbadf116d5ec

With bug 1249439 applied...

https://treeherder.mozilla.org/#/jobs?repo=try&revision=455c72d322bc

With smaug stuff:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=73570b27131d

SUCCESS! HOLY CRAP FINALLY

Without smaug stuff (just in case his earlier patches fixed it):

https://treeherder.mozilla.org/#/jobs?repo=try&revision=db90213e0e76

Final try push on inbound:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=abdbe2d31707

5:46 PM < @ khuey|pto > smaug: what did that crazy leak bug of mconley's end up being?

5:47 PM < @ smaug > khuey|pto: so at least there were cases when observer service kept xul:browser elements alive

5:47 PM < @ smaug > those elements registered themselves as strong observers

5:47 PM < @ smaug > and then JS is keeping frameloaders alive too long

5:47 PM < @ smaug > so we have option to fix js and/or frameloader to not keep inprocesstabchildglobal alive so long

5:48 PM < @ smaug > (and then there was, which I think is unrelated, a missing unlink in XBL code)

5:49 PM < @ khuey|pto > smaug: in mconley's patch? or that existed already?

5:49 PM < @ smaug > khuey|pto: oh, I wasn't really even looking at mconley's patch, just whatever I saw in graph

5:50 PM < @ smaug > but I need to check whether this is just about the test doing something unusual, which I do expect

5:50 PM < @ smaug > since tabbrowser code itself does for example call destroy() on xul:browsers which clears the strong observer service ref

5:51 PM → marcosc joined (marcosc@moz-29a.do1.52.113.IP)

5:51 PM < mconley > khuey|pto: I somehow get the impression that smaug has one half of the story, and ting has the other half

5:51 PM < @ smaug > yeah, ting has a patch for the js keeping frameloaders alive too long

5:51 PM < @ smaug > we should probably land that patch or a variant of it to branches too

5:53 PM < @ khuey|pto > ok, so it did turn out to be a preexisting problem

5:53 PM < @ khuey|pto > that mconley was unlucky enough to exacerbate

5:55 PM < mconley > story of my life

5:55 PM ⇐ marcosc quit (marcosc@moz-29a.do1.52.113.IP) Ping timeout: 121 seconds

5:57 PM < @ smaug > oh, and mconley's patch is actually removing one bizarre edge

5:58 PM < @ smaug > from browser element's property 'foo' via WeakMap to some object in inprocess tabchild global

5:59 PM < mccr8 > yeah so maybe he fixed part of the leak, but the part that kept the leak out of the CC graph, or something.

6:00 PM < @ smaug > JS is so good language to leak stuff accidentally

6:01 PM < mccr8 > yeah. :(

6:01 PM < mconley > I won't lie, WeakMap's and WeakSet's make us front-end feel like we can't do wrong.

6:02 PM bholley → bholley_away

6:02 PM < mccr8 > apparently some JS people want real weak refs too

6:02 PM ⇐ jdm quit ↔ @ peterv (opped) nipped out

6:05 PM < @ smaug > I think it was a mistake to call the thing WeakMap, since its behavior is rather surprising

6:06 PM < mccr8 > the other name is "ephemeron table"

6:07 PM < shu > all hail ephemeron

6:07 PM < @ khuey|pto > sounds like "ephemeron" belongs next to cthulu in the pantheon

HOLY CRAP DONE