Tracing VirtualAlloc With Xperf

Tracing calls to VirtualAlloc can sometimes help track down address space fragmentation or suspicious memory allocations.

Prerequisites

• Windows. Best results are on Windows 7 and higher.
• Administrator access to machine
• Willingness to share a system-wide log with the bug investigator. Xperf records information about all processes running during the trace. These files can be large (hundreds of MB compressed).

Installing xperf

Xperf is included in the Windows Performance Toolkit from Microsoft.

• Download from http://www.microsoft.com/en-US/download/details.aspx?id=39982
• Run the installer, select only "Windows Performance Toolkit"
• After the installer finishes, xperf.exe will be installed here:
  • On 32-bit Windows: C:\Program Files\Windows Kits\8.1\Windows Performance Toolkit
    
  • On 64-bit Windows: C:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit

Setup for 64-bit Windows

You can skip this on 32-bit Windows. Stack walking on 64-bit Windows requires a registry key. After tracing you can safely leave this key or remove it.

• Open an administrator command prompt
• Run this command:

REG ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" -v DisablePagingExecutive -d 0x1 -t REG_DWORD -f 

• Reboot the machine

Create a tracing script

Save this script as xperf_virtualalloc.cmd in the same directory as xperf.exe:

@echo off
xperf -on PROC_THREAD+LOADER+CSWITCH+VIRT_ALLOC -stackwalk VirtualAlloc+VirtualFree -BufferSize 1024 -MinBuffers 1024 -MaxBuffers 1024 -MaxFile 2048
echo Tracing started. Press a key to stop.
pause >NUL
echo Stopping...
xperf -stop -d trace.etl

Collect a trace

1. Open an administrator command prompt
2. cd into your xperf directory
3. Run xperf_virtualalloc.cmd. It will start tracing.
4. Launch Firefox and use it like normal. Try to reproduce your bug (crash, etc.).
5. To stop tracing, go back to your script window and press any key.
6. You will get a file called trace.etl.
7. Compress (zip) the trace file. This is important because traces can be large.
8. Send the compressed trace to the bug investigator. You may be able to attach small files in Bugzilla. For larger files you may need to use a dropbox or similar service.

Note the privacy message from xperf.exe:
The trace you have just captured "trace.etl" may contain personally identifiable information, including but not necessarily limited to paths to files accessed, paths to registry accessed and process names. Exact information depends on the events that were logged. Please be aware of this when sharing out this trace with other people.

Troubleshooting

Symptom:

xperf: error: NT Kernel Logger: Transferred copy name was not recognized as acceptable by WMI data provider (0x1069).

A likely cause for this failure is running out of space in xperf's tracing buffers. If possible, try to take a shorter trace, or close background programs. Otherwise you can try increasing the buffer sizes, but the trace files will get even more huge.

See also

https://wiki.mozilla.org/Using_XPerf (mostly for SpiderMonkey)