heap(1) General Commands Manual heap(1)
NAME
heap – List all the malloc-allocated buffers in the process's heap
SYNOPSIS
heap [-s | -sortBySize] [-z | -zones] [-guessNonObjects]
[-sumObjectFields] [-showSizes] [-addresses all | <classes-pattern>]
[-noContent] pid | partial-executable-name | memory-graph-file
DESCRIPTION
heap lists the objects currently allocated on the heap of the specified
process, as well as summary data. Objects are categorized by class name,
type (Objective-C, C++, or CFType), and binary image. C++ objects are
identified by the vtable referenced from the start of the object, so with
multiple inheritance this may not give the precise class of the object.
If the target process is running with MallocStackLogging, then heap
attempts to identify the types of "non-object" allocations, using the
form "<allocation-call> in <caller>". The <caller> is determined by
walking up the allocation stack backtrace (if available) to find the
symbol name of the function that called an "allocation function", such as
malloc, calloc, realloc, C++ "operator new", strndup, various internal
functions of libc++.1.dylib, etc. If <caller> is a C++ function, the type
name is created by simplifying the demangled symbol name by removing the
return type, the "__1::" substrings from use of llvm's libc++abi.dylib,
and standard arguments such as "std::__1::allocator<T>"."
For example, this type information:
malloc in std::basic_string<char>::basic_string<std::nullptr_t>(char const*) C++ Metal
is determined from the backtrace:
_malloc_zone_malloc (in libsystem_malloc.dylib)
operator new(unsigned long) (in libc++abi.dylib)
std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char>
>::basic_string<std::nullptr_t>(char const*) (in Metal)
...
The binary image identified for a class is the image which implements the
class. For types derived from allocation backtraces, the binary image is
that of <caller>.
OPTIONS
heap requires one argument -- either the process ID or the full or
partial executable name of the process to examine, or the pathname of a
memory graph file generated by leaks or the Xcode Memory Graph Debugger.
The following options are available:
-s | -sortBySize
Sort output by total size of class instances, rather than by
count.
-z | -zones
Show the output separated out into the different malloc zones,
instead of an aggregated summary of all zones.
-H | -humanReadable
"Human-readable" output. Use unit suffixes: K, M, G, and T in
order to reduce the number of digits to three or less using base
2 for sizes.
-guessNonObjects
Look through the memory contents of each Objective-C object to
find pointers to malloc'ed blocks (non-objects), such as the
variable array hanging from an NSArray. These referenced blocks
of memory are identified as their offset from the start of the
object (say "__NSCFArray[12]"). The count, number of bytes, and
average size of memory blocks referenced from each different
object offset location are listed in the output.
-sumObjectFields
Do the same analysis as with the -guessNonObjects option, but add
the sizes of those referenced non-object fields into the entries
for the corresponding objects.
-showSizes
Show the distribution of each malloc size for each object,
instead of summing and averaging the sizes in a single entry.
-diffFrom=<memgraph>
Show only the new objects since the specified memgraph.
-addresses all | <classes-pattern>
Print the addresses of all malloc blocks found on the heap in
ascending address order, or the addresses of those objects whose
full class name is matched by the regular expression <classes-
pattern>. The string "all" indicates that the addresses of all
blocks should be printed.
The <classes-pattern> regular expression is interpreted as an
extended (modern) regular expression as described by the
re_format(7) manual page. "malloc" or "non-object" can be used
to refer to blocks that are not of any specific type. Examples
of valid classes-patterns include:
__NSCFString
'NS.*'
'__NSCFString|__NSCFArray'
'.*(String|Array)'
malloc
non-object
malloc|.*String
The <classes-pattern> pattern can be followed by an optional
allocation size specifier, which can be one of the following
forms. The square brackets are required. The size can include a
'k' suffix for kilobytes, or an 'm' suffix for megabytes:
[size]
[lowerBound-upperBound]
[lowerBound+]
[-upperBound]
Examples of <classes-pattern> with size specifications include:
malloc[2048] // all malloc blocks of size 2048
malloc[1k-8k] // all malloc blocks between 1k and 8k
CFData[50k+] // all CFData objects 50k or larger
[-1024] // all allocations 1024 bytes or less
-noContent
Do not show object content in -addresses mode.
SEE ALSO
malloc(3), leaks(1), malloc_history(1), stringdups(1), vmmap(1),
DevToolsSecurity(1)
The Xcode developer tools also include Instruments, a graphical
application that can give information similar to that provided by heap.
The Allocations instrument graphically displays dynamic, real-time
information about the object and memory use in an application, including
backtraces of where the allocations occurred. The Leaks instrument
performs memory leak analysis.
CAVEATS
All memory sizes are given in binary-prefixed units. For example, "1K"
refers to 1024 bytes.
macOS 15.2 Feb. 8, 2022 macOS 15.2