Bug#772636: rxvt-unicode: memory leak in urxvtd

[Ian Campbell]

Package: rxvt-unicode
Version: 9.20-1+b1
Severity: important

Dear Maintainer,

I use urxvtd via urxvtd -q -o -f and there appears to be a memory
leak of some sort. The process (the child of the two processes which
result from the above) grows without bound until the OOM killer is
invoked and it is killed.

I restarted urxvtd yesterday morning because of this issue and today
it has grown to VIRT=365660K=366M and RES=275676K=269M, compared with
VIRT=99200K=96M and RES=16000K=15M just after I started it.

A urxvtd on another machine which was started on 22 November is
currently VIRT=875M and RES=235M.

I tried running under Valgrind, but urxvtd is sgid so Valgrind is
unable to run (if you know of a workaround for this I'll gladly try
again).

I've attached urxvtd-memory-A.txt and urxvtd-memory-B.txt which
are the output of sudo pmap -x 10599 10600 yesterday (when the
process was fresh) and today. The most striking difference is a bunch
of anon memory mappings in the child process. In particular:
+0222d000  242616  242616  242616 rw---   [ anon ]

The other machine (start 22 Nov) has a similarly large mapping:

01dee000  769092  218800  217920 rw---   [ anon ]

If you've any ideas for other techniques I could try in order to track
down what's going on I can try them.

Thanks,
Ian.


-- System Information:
Debian Release: jessie/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'stable-updates'), (500, 'unstable'), 
(500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.16-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages rxvt-unicode depends on:
ii  base-passwd   3.5.36
ii  libc6 2.19-11
ii  libfontconfig12.11.0-6.1
ii  libfreetype6  2.5.2-2
ii  libgcc1   1:4.9.1-16
ii  libgdk-pixbuf2.0-02.31.1-2+b1
ii  libglib2.0-0  2.42.0-2
ii  libperl5.20   5.20.1-1
ii  libstartup-notification0  0.12-4
ii  libx11-6  2:1.6.2-3
ii  libxft2   2.3.2-1
ii  libxrender1   1:0.9.8-1
ii  ncurses-base  5.9+20140913-1

Versions of packages rxvt-unicode recommends:
ii  fonts-vlgothic [fonts-japanese-gothic]  20140801-1
ii  ttf-dejavu  2.34-1

rxvt-unicode suggests no packages.

-- no debconf information
10599:   urxvtd -q -o -f
Address   Kbytes RSS   Dirty Mode  Mapping
00401240 256   0 r-x-- urxvtd
00735000   8   8   4 r urxvtd
00737000  44  40   8 rw--- urxvtd
00742000  76   4   4 rw---   [ anon ]
021eb000 132  68  68 rw---   [ anon ]
7fb1106b1000  44  44   0 r-x-- libnss_files-2.19.so
7fb1106bc0002044   0   0 - libnss_files-2.19.so
7fb1108bb000   4   4   4 r libnss_files-2.19.so
7fb1108bc000   4   4   4 rw--- libnss_files-2.19.so
7fb1108bd000  40  40   0 r-x-- libnss_nis-2.19.so
7fb1108c70002044   0   0 - libnss_nis-2.19.so
7fb110ac6000   4   4   4 r libnss_nis-2.19.so
7fb110ac7000   4   4   4 rw--- libnss_nis-2.19.so
7fb110ac8000  84  84   0 r-x-- libnsl-2.19.so
7fb110add0002044   0   0 - libnsl-2.19.so
7fb110cdc000   4   4   4 r libnsl-2.19.so
7fb110cdd000   4   4   4 rw--- libnsl-2.19.so
7fb110cde000   8   4   4 rw---   [ anon ]
7fb110ce  28  28   0 r-x-- libnss_compat-2.19.so
7fb110ce70002044   0   0 - libnss_compat-2.19.so
7fb110ee6000   4   4   4 r libnss_compat-2.19.so
7fb110ee7000   4   4   4 rw--- libnss_compat-2.19.so
7fb110ee8000  80  64   0 r-x-- libresolv-2.19.so
7fb110efc0002044   0   0 - libresolv-2.19.so
7fb1110fb000   4   4   4 r libresolv-2.19.so
7fb1110fc000   4   4   4 rw--- libresolv-2.19.so
7fb1110fd000   8   0   0 rw---   [ anon ]
7fb1110ff000 132  68   0 r-x-- libselinux.so.1
7fb22048   0   0 - libselinux.so.1
7fb11132   4   4   4 r libselinux.so.1
7fb111321000   4   4   4 rw--- libselinux.so.1
7fb111322000   8   0   0 rw---   [ anon ]
7fb111324000  20  20   0 r-x-- libXdmcp.so.6.0.0
7fb1113290002044   0   0 - libXdmcp.so.6.0.0
7fb111528000   4   4   4 rw--- libXdmcp.so.6.0.0
7fb111529000  12  12   0 r-x-- libXau.so.6.0.0
7fb11152c0002044   0   0 - libXau.so.6.0.0
7fb11172b000   4   4   4 r libXau.so.6.0.0
7fb11172c000   4   4   4 rw--- 

Bug#772636: rxvt-unicode: memory leak in urxvtd

[Ian Campbell]

On Tue, 2014-12-09 at 12:02 +, Ian Campbell wrote:
 I tried running under Valgrind, but urxvtd is sgid so Valgrind is
 unable to run (if you know of a workaround for this I'll gladly try
 again).

Shortly after hitting Send I had a small epiphany. I
copied /usr/bin/urxvt (nb not urxvtd) somewhere else, which dropped the
sgid and ran with -ut (which stops it trying to write to utmp, which I
suppose was the reason for the sgid).

The result of:
valgrind --leak-check=full --log-file=tmp/urxvt.valgrind tmp/urxvt -ut
and then immediately pressing Ctrl-D in the resulting window is
attached.

It shows quite a few definitely lost bytes in both libperl and
libfontconfig. I expect those would be accounted to the urxvtd process
if I were using it here and would accumulate with time.

I hope this is helpful. Next time I lose my urxvtd process I'll rerun it
under valgrind using a similar technique in the hopes that something
useful might show up.

Ian.
==30391== Memcheck, a memory error detector
==30391== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==30391== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info
==30391== Command: tmp/urxvt -ut
==30391== Parent PID: 29104
==30391== 
==30391== 
==30391== HEAP SUMMARY:
==30391== in use at exit: 255,466 bytes in 7,491 blocks
==30391==   total heap usage: 71,185 allocs, 63,694 frees, 14,205,218 bytes 
allocated
==30391== 
==30391== 7 bytes in 1 blocks are definitely lost in loss record 8 of 441
==30391==at 0x4C28C20: malloc (vg_replace_malloc.c:296)
==30391==by 0x67B4DF1: Perl_safesysmalloc (in 
/usr/lib/x86_64-linux-gnu/libperl.so.5.20.1)
==30391==by 0x6847A05: Perl_bytes_from_utf8 (in 
/usr/lib/x86_64-linux-gnu/libperl.so.5.20.1)
==30391==by 0x678DE6C: Perl_pad_add_name_pvn (in 
/usr/lib/x86_64-linux-gnu/libperl.so.5.20.1)
==30391==by 0x6743D82: Perl_allocmy (in 
/usr/lib/x86_64-linux-gnu/libperl.so.5.20.1)
==30391==by 0x67756E5: Perl_yylex (in 
/usr/lib/x86_64-linux-gnu/libperl.so.5.20.1)
==30391==by 0x6789BC7: Perl_yyparse (in 
/usr/lib/x86_64-linux-gnu/libperl.so.5.20.1)
==30391==by 0x680C541: ??? (in /usr/lib/x86_64-linux-gnu/libperl.so.5.20.1)
==30391==by 0x6819343: Perl_pp_entereval (in 
/usr/lib/x86_64-linux-gnu/libperl.so.5.20.1)
==30391==by 0x67D2E45: Perl_runops_standard (in 
/usr/lib/x86_64-linux-gnu/libperl.so.5.20.1)
==30391==by 0x675C3E4: Perl_call_sv (in 
/usr/lib/x86_64-linux-gnu/libperl.so.5.20.1)
==30391==by 0x45682C: perl_watcher::invoke(char const*, sv*, int) (in 
/local/scratch/ianc/tmp/urxvt)
==30391== 
==30391== 8 bytes in 1 blocks are possibly lost in loss record 12 of 441
==30391==at 0x4C28C20: malloc (vg_replace_malloc.c:296)
==30391==by 0x4C2AFCF: realloc (vg_replace_malloc.c:692)
==30391==by 0x624488D: g_realloc (in 
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.0)
==30391==by 0x5FCE2A5: type_node_any_new_W (in 
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4200.0)
==30391==by 0x5FD326C: g_type_register_static (in 
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4200.0)
==30391==by 0x5FD7B01: g_type_plugin_get_type (in 
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4200.0)
==30391==by 0x5FAD624: gobject_init_ctor (in 
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4200.0)
==30391==by 0x400E9F9: call_init.part.0 (dl-init.c:78)
==30391==by 0x400EAE2: call_init (dl-init.c:36)
==30391==by 0x400EAE2: _dl_init (dl-init.c:126)
==30391==by 0x40011C9: ??? (in /lib/x86_64-linux-gnu/ld-2.19.so)
==30391==by 0x1: ???
==30391==by 0xFFF000292: ???
==30391== 
==30391== 8 bytes in 1 blocks are possibly lost in loss record 13 of 441
==30391==at 0x4C28C20: malloc (vg_replace_malloc.c:296)
==30391==by 0x4C2AFCF: realloc (vg_replace_malloc.c:692)
==30391==by 0x624488D: g_realloc (in 
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.0)
==30391==by 0x5FCE2A5: type_node_any_new_W (in 
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4200.0)
==30391==by 0x5FD326C: g_type_register_static (in 
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4200.0)
==30391==by 0x5FAF731: g_boxed_type_register_static (in 
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4200.0)
==30391==by 0x5FAF8ED: g_value_array_get_type (in 
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4200.0)
==30391==by 0x5FC05E4: _g_param_spec_types_init (in 
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4200.0)
==30391==by 0x5FAD64A: gobject_init_ctor (in 
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4200.0)
==30391==by 0x400E9F9: call_init.part.0 (dl-init.c:78)
==30391==by 0x400EAE2: call_init (dl-init.c:36)
==30391==by 0x400EAE2: _dl_init (dl-init.c:126)
==30391==by 0x40011C9: ??? (in /lib/x86_64-linux-gnu/ld-2.19.so)
==30391== 
==30391== 8 bytes in 1 blocks are possibly lost in loss record 14 of 441
==30391==at 0x4C28C20: malloc (vg_replace_malloc.c:296)
==30391==by 0x4C2AFCF: realloc (vg_replace_malloc.c:692)
==30391==