mirror of
https://github.com/software-mansion/argent.git
synced 2026-09-14 19:27:14 +08:00
a5c6730d05
## What Opt-in `malloc_stack_logging` flag on `native-profiler-start` that makes iOS memory leaks **attributable** — they come back with a real responsible frame + library instead of `<Call stack limit reached>`. ## Why `native-profiler-start` attaches to the already-running app. iOS records malloc allocation backtraces only when `MallocStackLogging` is set **at process launch**, so an attached app has none: Instruments' Leaks scanner finds the leaked blocks but can't attribute them and emits the placeholder `<Call stack limit reached>` (that string is Instruments', not ours). ## How When `malloc_stack_logging: true`, the profiler cold-launches the app **under** xctrace instead of attaching: ``` xctrace record --template <Argent.tracetemplate> --device <udid> \ --env MallocStackLogging=1 --output <…> --no-prompt \ --launch -- <App.app> ``` - `.app` path resolved via `simctl get_app_container`; the running instance is terminated first for a clean cold start. - The existing Leaks export / parser / render path is reused **unchanged** — no parser changes. - Default behaviour is untouched: attach to the running app (no relaunch, no overhead). The flag is opt-in because it restarts the app (loses state) and adds allocator overhead — for leak-attribution passes, not CPU/hang work. - The report relabels unattributable leaks with a hint to re-run with `malloc_stack_logging: true`, instead of surfacing the raw placeholder. ## Evidence (real iPhone 16 sim, same scroll workload) Before (attach) — every leak row: ``` responsible-frame="<Call stack limit reached>" responsible-library="" ``` After (`--env MallocStackLogging=1 --launch`) — same Leaks export: | leaked-object | responsible-frame | library | |---|---|---| | Malloc 1008 B ×3 | `itanium_demangle::OutputBuffer::grow(...)` | libc++abi | | Malloc 48 B ×1 | `hermes::vm::JSTypedArrayBase::createBuffer(...)` | hermes | ## Tests - `test/ios-instruments/malloc-stack-logging.test.ts` — the malloc launch argv (`--env MallocStackLogging=1`, `--launch -- <app>` last, with and without `--notify-tracing-started`, `--no-prompt`) vs default `--attach`; terminate-first / get_app_container ordering; failed-start behavior; per-test `ARGENT_IOS_CAPTURE` scrubbing. - `test/ios-instruments/leak-attribution-render.test.ts` — unattributable vs attributed leak rendering, capture-mode-aware hints. - `test/ios-instruments/load-freshness.test.ts` — per-capture residue clearing on `profiler-load`, live/recovery-pending load refusals. - `test/ios-instruments/stop-recovery.test.ts` — capture-mode pairing at stop (clean and recovery paths). - `test/profiler-combined-leaks.test.ts`, `test/profiler-leak-stacks.test.ts`, `test/ios-leak-pipeline.test.ts` — shared caveat line, evidence-first hints, attribution-normalized grouping. - Full `test/ios-instruments/` suite green (9 files / 70 tests); full tool-server suite green; `tsc --noEmit` + `tsc -p tsconfig.test.json` clean. ## Notes E2E'd live twice during review (real iPhone 16 Pro / iPhone 17 Pro sims on Xcode 26.6): guard refusals fire before the app is touched, the `--device` cold launch's deadlock on degraded Xcode is confirmed (so the guard is warranted), and the malloc argv/terminate/relaunch behavior checked out on-device. Docs updated: `IOS_PROFILER_REFERENCE.md` and the `argent-native-profiler` skill. ## Review follow-ups (post-approval hardening) Later commits address the remaining review threads and several subsequent multi-lens review passes: - **Capture-mode is a real signal, end to end.** The session records the mode of the in-flight recording at start (`recordingMallocStackLogging`), pairs it with `exportedFiles` at stop (`mallocStackLogging`), and freezes it into `parsedData` at analyze/load — so the analyze report, the combined report, and the `leak_stacks` drill-down all name the capture mode of the data they actually render instead of inferring it (or mislabeling it after a newer capture starts). One shared `renderUnattributedLeaksNote()` keeps the wording identical across reports, and attribution evidence outranks the flag: a resolved frame proves the target ran under malloc stack logging however it was launched. - **`profiler-load` restores a clean slate.** Loading clears all per-capture residue (capture mode, `cpuFilterPid`, `wallClockStartMs`, `traceFile`) so a loaded trace is never analyzed with a previous live capture's PID filter, freshness anchor, or report path — and refuses to load while a recording is in flight or a crashed capture awaits `native-profiler-stop`'s partial-trace recovery, which the load would otherwise orphan. - **Failed starts are non-destructive.** Per-capture descriptors — and the recovery flags that gate `native-profiler-stop`'s partial-trace export — are stamped/reset only on a successful start, so a failed attempt leaves the previous capture's still-loaded exports fully described and a pending abnormal-end recovery intact. - **Guards keep session state coherent.** `profiler-load`, `native-profiler-analyze`, and `profiler-combined-report` all refuse while a recording is in flight or a crashed capture awaits recovery, via one shared `isCaptureInFlight`/`inFlightGuardMessage` helper whose message distinguishes recording vs 10-min-cap timeout vs unexpected exit (so the stated cause matches what `native-profiler-stop` reports next). Proceeding would otherwise wedge the session (load) or render one capture's frozen data under another's live fields (analyze/combined). - **The combined report anchors on a frozen clock.** The recording's start time is frozen into `parsedData` at analyze, and the iOS combined report anchors its hangs to that frozen value rather than the live session field — so a capture started after analyze can never shift a real hang↔commit correlation into "unmatched". Android keeps its live anchor (it re-derives hangs from the live trace). The combined-report guard's recovery advice routes through `native-profiler-analyze`, the only step that rebuilds `parsedData`. - **Leak grouping is attribution-normalized.** `aggregateLeaks` keys on `(objectType, frame-normalized-the-way-isLeakAttributed-matches)`, so mixed unattributed spellings (`Unknown`, the sentinel, whitespace variants) can't split one group per type. - **The malloc launch target is unambiguous.** Since the cold launch terminates the resolved app, `app_process` resolution prefers an exact `CFBundleExecutable` match and, when builds still tie (dev + prod sharing an executable/display name), refuses and points at the globally-unique `CFBundleIdentifier` — which it also accepts as an `app_process` — instead of killing whichever app the plist enumerates first. - **Report tables escape `|`.** Demangled C++ frames (`operator|` included) are real headline content under malloc mode; every free-form cell across the leak, CPU-hotspot, function caller/callee, and thread-breakdown tables — symbol *and* thread/queue-name columns — is escaped so a stray pipe can't shift the row's columns. - **Android start is non-destructive too.** `startNativeProfilerAndroid` now starts perfetto before mutating session state, mirroring iOS, so a failed start no longer burns a prior capped capture's pending partial-trace recovery.
95 lines
4.2 KiB
TypeScript
95 lines
4.2 KiB
TypeScript
/**
|
|
* Regression: when native-profiler-stop has populated `exportedFiles.cpu` with
|
|
* a path but the file is unreadable (deleted, FS error, /tmp cleanup), the
|
|
* pipeline used to silently swallow the ENOENT inside parseCpuFile and
|
|
* return empty data, and the analyze tool would render an "All clear"
|
|
* report — pretending the trace was successfully analyzed when the data
|
|
* was never read.
|
|
*
|
|
* The analyze tool must distinguish ENOENT/EACCES from "file exists but
|
|
* has no findings" and surface the export failure via `exportErrors`.
|
|
*/
|
|
import { describe, it, expect, vi } from "vitest";
|
|
import { ArtifactStore } from "@argent/registry";
|
|
import { join } from "node:path";
|
|
import { tmpdir } from "node:os";
|
|
import { mkdtemp, rm, writeFile } from "node:fs/promises";
|
|
|
|
// The analyze tool gates the iOS path behind `ensureDeps(["xcrun"])`, but
|
|
// analyzing an already-exported trace is pure XML parsing — it never shells out
|
|
// to xcrun. The real probe makes this test pass only on a host with Xcode
|
|
// installed (dev macOS) and fail on the Linux CI runner with `missing: [xcrun]`.
|
|
// Stub the gate to a no-op so the test exercises the report logic it's about,
|
|
// not the host's toolchain. Keep the rest of the module (DependencyMissingError,
|
|
// the cache reset helper) intact via importOriginal.
|
|
vi.mock("../src/utils/check-deps", async (importOriginal) => {
|
|
const actual = await importOriginal<typeof import("../src/utils/check-deps")>();
|
|
return {
|
|
...actual,
|
|
ensureDeps: vi.fn(async () => {}),
|
|
ensureDep: vi.fn(async () => {}),
|
|
};
|
|
});
|
|
|
|
import { nativeProfilerAnalyzeTool } from "../src/tools/profiler/native-profiler/native-profiler-analyze";
|
|
import type { NativeProfilerSessionApi } from "../src/blueprints/native-profiler-session";
|
|
|
|
describe("native-profiler-analyze: missing trace file", () => {
|
|
it("surfaces an export warning that names the missing CPU file when its path is set but the file is absent", async () => {
|
|
let dir: string | null = null;
|
|
try {
|
|
dir = await mkdtemp(join(tmpdir(), "native-profiler-missing-"));
|
|
const cpuPath = join(dir, "missing_cpu.xml"); // never written
|
|
// Provide real (empty-but-readable) hangs/leaks files so the only
|
|
// possible warning is about the missing CPU file. This isolates the
|
|
// bug from the existing null-path warnings.
|
|
const hangsPath = join(dir, "hangs.xml");
|
|
const leaksPath = join(dir, "leaks.xml");
|
|
await writeFile(hangsPath, "<root></root>", "utf8");
|
|
await writeFile(leaksPath, "<root></root>", "utf8");
|
|
const traceFile = join(dir, "fake.trace");
|
|
|
|
// Simulate what native-profiler-stop hands to native-profiler-analyze:
|
|
// exportedFiles has a non-null CPU path, but the file does not exist.
|
|
const session: NativeProfilerSessionApi = {
|
|
deviceId: "TEST-DEVICE",
|
|
platform: "ios",
|
|
appProcess: null,
|
|
capturePid: null,
|
|
captureProcess: null,
|
|
traceFile,
|
|
exportedFiles: { cpu: cpuPath, hangs: hangsPath, leaks: leaksPath },
|
|
profilingActive: false,
|
|
wallClockStartMs: null,
|
|
parsedData: null,
|
|
cpuFilterPid: null,
|
|
recordingMallocStackLogging: null,
|
|
mallocStackLogging: null,
|
|
recordingTimeout: null,
|
|
recordingTimedOut: false,
|
|
recordingExitedUnexpectedly: false,
|
|
lastExitInfo: null,
|
|
androidOnDeviceTracePath: null,
|
|
};
|
|
|
|
const result = await nativeProfilerAnalyzeTool.execute(
|
|
{ session },
|
|
{ device_id: "TEST-DEVICE" },
|
|
{ artifacts: new ArtifactStore() }
|
|
);
|
|
|
|
// Bug: previously this rendered "All clear" with no warning because
|
|
// parseCpuFile silently swallowed the ENOENT. Fix: a missing-file path
|
|
// must produce an Export warning whose CPU entry names the bad path.
|
|
expect(result.report).toContain("Export warnings");
|
|
// The warning should mention the CPU category and reference the file.
|
|
expect(result.report).toMatch(/-\s*\*\*cpu\*\*:[^\n]*missing_cpu\.xml/i);
|
|
// Word it so the user understands the file is missing/unreadable, not
|
|
// that the export was simply empty.
|
|
expect(result.report).toMatch(/missing|not found|unreadable/i);
|
|
} finally {
|
|
if (dir) await rm(dir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
});
|