470159 - Start to bookmark, cancel, retry hangs (or crashes [@ _objc_trap][@ _objc_error][@ objc_msgSend | -[NSControl sendAction:to:] ])

Status: RESOLVED INCOMPLETE

(Camino Graveyard :: Bookmarks, defect)

Description

[Jon]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en; rv:1.8.1.19) Gecko/20081212 Camino/1.6.6 (like Firefox/2.0.0.19)
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en; rv:1.8.1.19) Gecko/20081212 Camino/1.6.6 (like Firefox/2.0.0.19)

If I start to bookmark a page, cancel, try to add a new folder or try to add the bookmark again, I can't.  The controls are grey; entering the control keys does nothing.  The system says Camino not responding.

Reproducible: Didn't try

Steps to Reproduce:
1.Select a page
2.Try to bookmark it
3.Cancel
4.Try to bookmark it again
Actual Results:  
Controls to bookmark greyed.  Control keys didn't have any impact. Option-Command-Escape showed Camino not responding.

Expected Results:  
Successful bookmark in the appropriate folder.

This has worked fine until this new release. Worked in 1.6.5; not now in 1.6.6.

Comment 1

[Chris Lawson (gone)]

Does this happen no matter what page you're trying to bookmark and no matter what other tabs or windows you have open?

How about with a fresh profile?

http://pimpmycamino.com/parts/troubleshoot-camino

will help you test that without messing with your current profile.

Comment 2

[Jon]

Bookmark works fine in a simple test.  I have added the URL where it failed.  It fails consistently with this site.  The site has a movie, and the movie starts upon entering the site.  I accessed this site from clicking on a link in an email.

Comment 3

[Chris Lawson (gone)]

I tried visiting that link in Camino 1.6.6 with a fresh profile on a PowerBook G4/1.5GHz running OS X 10.5.6 and Flash 10. Multiple attempts to bookmark the page followed by an immediate cancellation of the bookmark dialog resulted in no hangs.

I was similarly unable to reproduce the problem in a trunk nightly (2.0b1pre).

This sounds a lot like another manifestation of the various Flash performance issues with 1.x. A few questions we'll need answers to:

1) What version of Flash are you using?
  1a) If you're using Flash 9, does upgrading to Flash 10 change anything?

2) What Mac are you using (CPU speed, RAM, OS version, etc.)? It's possible this can only be triggered on a slow enough machine, or on certain OS versions.

3) As I asked in comment 1, does this happen with a fresh profile?

4) If it still happens with a fresh profile and with Flash 10, please *attach* (using the "Add an attachment" link above) a sample of Camino in its hung state to this bug. Instructions for sampling a hung application are here:

http://caminobrowser.org/documentation/bugzilla/#hang

Thanks.

Comment 4

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to comment #2)
> I accessed this site from clicking on a link in
> an email.

Also, if you visit the site directly (or by following the link in this bug), does it hang then, or does it only hang when opening the page by clicking the link in the email?

One other thing to check, in addition to what Chris asked in comment 1 and comment 3, is if there are any messages from Camino in the Console.log when you experience this hang.

Comment 5

[Jon]

1) I was using Flash 9.  Flash 10 has the same issue.  If I start the bookmark, select a different folder from the default folder, then "cancel", the bookmark options are greyed.
2) My MAC is a Dual 800 MHz PowerPC G4, with 768 MB Ram, running OS 10.4.11.
3) Yes, this happens in a fresh profile.
4) I am still working on this.

To Smokey Ardisson:
It hangs either way.  It seems that starting to bookmark, selecting another folder, then cancelling the operation is the source of the problem.

I don't know where the Console.log is.

Comment 6

[Jon]

Attachment: The Inspect file of Camino, after the bookmark capability is greyed.

Comment 7

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to comment #5)
> I don't know where the Console.log is.

In /Applications/Utilities, open Console.app; by default it displays Console.log.

The sample seems to indicate it's mostly Flash that's hanging.  

I still can't reproduce this on 10.3.9 with Flash 9.0r151 or on 10.5.5 with Flash 10.0r12.

Comment 8

[Jon]

Attachment: I cleared the console log, then performed the test.

I selected the email, clicked on the link, and Camino brought up the page.  I selected Bookmark Current Page, then selected a different folder, then cancelled.  I checked the Bookmark selections and they were greyed.  I saved the console log and attached it to this report.  Thanks for the help in locating it.

Comment 9

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Comment on attachment 354269 [details]
I cleared the console log, then performed the test.

Hmm, nothing interesting in there, unless Google Desktop is doing something nasty.

Comment 10

[Stuart Morgan]

That message is harmless (and coming from a completely different process)

Comment 11

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

On the forum, 8-bit notes he had this console info when he saw this crash:

Jan 12 05:10:37 /Applications/Camino.app/Contents/MacOS/Camino: objc: FREED(id): message firstResponder sent to freed object=0x8617f20

[2:13pm] ardissone: smorgan: is this significant/useful: http://forums.mozillazine.org/viewtopic.php?p=5461245#p5461245
[2:13pm] smorgan: Maybe key loop somehow?
[2:14pm] smorgan: We got a few "trying to message a dead object" crashes from that
[2:14pm] ardissone: yeah, that's what i was wondering
[2:15pm] • ardissone still can't figure out how to trigger that crash, though :(
[2:16pm] ardissone: i wonder if they have FKA on and have a different loop?
[2:29pm] ardissone: hmm
[2:30pm] ardissone: 8-bit's log has method swizzling in the mix
[2:47pm] smorgan: All event dispatch in Camino now has method swizzling
[2:49pm] ardissone: :(
[2:50pm] ardissone: why did the other logs not show it?
[2:53pm] smorgan: well, all window event dispatch. The other hadn't reached the window yet
[2:53pm] smorgan: Although that seems odd
[2:53pm] ardissone: heh

(For the record, neither he nor Lisa have FKA on.)

Comment 12

[8-bit]

Experienced this crash again today - flash heavy site (jeep.com). Console seeing same message:

/Applications/Camino.app/Contents/MacOS/Camino: objc: FREED(id): message firstResponder sent to freed object=0xbecf550

See crash log attachment above (jeep.com)

Comment 13

[8-bit]

Attachment: Crash Log After Attempting To Bookmark Flash Heavy Site (jeep.com)

See comment 12

Comment 14

[8-bit]

Sorry for the triple...

The crash log attachment has 2 crashes in a row (split seconds apart). Looka like the first crash took down talkback with it - not sure.

Comment 15

[Chris Lawson (gone)]

Ping. Is there anything else we can do here?

Comment 16

[Stuart Morgan]

I tried reproducing this for a while and didn't get anywhere.

What would be great is if someone who could reproduce this easily could try running with NSZombieEnabled=YES so we could try to figure out what's exploding. (Although if it's a focus loop issues that may or may not be enlightening).

Comment 17

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

I think bp-39a9c356-7160-4191-8339-ca50a2090530 ('Had just clicked "keep old values" when logging into account') might also be this.

Comment 18

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

8-bit's crash, and crashes like comment 17, should be bug 496582, which should be fixed in recent nightlies (18 Jun and later).

It's possible the behavior described in this bug is also included in crashes with the "objc_msgSend | -[NSApplication sendEvent:]" signature, though.

Comment 19

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to comment #18)
> It's possible the behavior described in this bug is also included in crashes
> with the "objc_msgSend | -[NSApplication sendEvent:]" signature, though.

I've had this sort of crash twice in the past two days. Both times it was after having the "stuck button" bug; after the sheet in question closed, I tried to do something (in this last case, change tabs) and beachballed at that point, and crashed.

Camino[54145]: Invalid memory access of location 545f5f00 eip=95eef68c

Camino[7024]: Invalid memory access of location 561f60dc eip=95eef699

I tried to reproduce a few times (log in somewhere with an invalid password, wait for the resulting "login failed" page to load, click "Don't Save", then switch tabs), but I've been unsuccessful in getting the stuck button, which seems to be the "trigger".

Comment 20

[Lisa Thompson]

I just tried playing with this again and it seems I can consistently eventually get the stuck button after loading Flash video.

If I launch Camino (I'm using today's 2.0b4) with a fresh profile and go to the Camino home page, I can repeatedly hit Cmd-D (or -K) and alternately click Cancel/Add 30 times and I never see the need-to-click-twice issue. Then I load a new tab with Flash video -- either the IEEE page in this bug or an adobe.com Flash page. It doesn't take but 5 or 6 Cmd-D's before I have to click twice to dismiss the sheet. And it doesn't matter whether I do this on the Flash tab or back on the Camino home page tab.

I also noticed this: after clicking once on Cancel/Add fails to dismiss the sheet, if I click on the pop-up menu to switch folders, the menu does not pop up but the button I just clicked on gets un-highlighted. Then if I click on the popup menu again, it opens but sometimes clicking on a folder requires a second click before the menu gets dismissed and the folder is selected.

Probably expected but I'll mention that the flash video stops playing when I'm in the stuck button state; the sound continues, though. I seem to notice a hiccup in the video *anytime* I click on a sheet button -- just click and hold on one of the buttons and the video will stop. (Right-clicking on flash content does the same thing -- video stops and sound continues, also in Firefox 3.0.)

Throughout all this repeat bookmarking, there were no messages in console or in Terminal when running Zombie-enabled. And no crashes. I've been seeing the stuck button off-and-on but it hasn't triggered a crash in months.

Comment 21

[Lisa Thompson]

I thought I would try to rule out other plug-ins but that didn't quite happen. 

If I load Apple's getamac ad videos in the only tab (clean profile) and do repeated bookmarkings, I eventually get the stuck button but not till after invoking the sheet more than 20 times. Same thing (after relaunch with fresh profile) with this java page: http://www.java.com/en/download/help/testvm.xml.

I repeated the non-plug-in tests, with Camino page, mozilla.org and my own home page in three tabs and tried bookmarking each *fifty* times and never saw the stuck button.

Comment 22

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to comment #20)
> I also noticed this: after clicking once on Cancel/Add fails to dismiss the
> sheet, if I click on the pop-up menu to switch folders, the menu does not pop
> up but the button I just clicked on gets un-highlighted.

More curious behavior: after loading some plugins (Flash, Java) and not quite getting the stuck button, I can click on the popup menu, hit Esc, and the sheet will close, leaving the menu still popped-up and selectable (no crash when selecting a folder after the sheet's closed, though).

I'm pretty sure it's related to this bug, since, like Lisa, in a fresh-profile-run with no plugins viewed, I can't trigger the sheet-closing-menu-staying behavior with repeated efforts.

Comment 23

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

I've been able to reproduce the stuck button with no plugins in a debug build, both alone and under zombies, with enough attempts to cancel adding a bookmark, but I've yet to be able to reproduce the crash. Grr.

Comment 24

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Attachment: Comments associated with recent NSApp sendEvent crashes

Last comment from me tonight: here are recent -[NSApplication sendEvent:] crashes with comments (and other info), with one definitely being this "add bookmark" crash.

Comment 25

[Stuart Morgan]

With no leads yet, there's nothing we can do for 2.0. Hopefully with more users we'll get a lucky break.

Comment 26

[Chris Lawson (gone)]

Is anyone who was seeing this regularly able to repro with 2.0.1?

Comment 27

[philippe (part-time)]

Attachment: crash log, 10.6.2

Crash on 10.6.2 - 2.1a1pre home made build
Short session, not actively watching flash (Flashblock).

Bookmark with Cmd K, click the button, fails, try again with 'enter'. boom.
Nothing logged in Console.

probably irrelevant, the page I tried to bookmark
http://theappleblog.com/2009/09/04/how-to-resurrect-your-appletalk-printer-in-snow-leopard/

Comment 28

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

I've suspected that the -[NSControl sendActionTo:] and the -[NS* sendEvent:] crashes and this crash were related, but philippe's crash is the first hard evidence of that for either of tjem.

While grumbling about Flash on 10.6 crashing Camino when users were performing completely unrelated actions in our Cocoa UI last week some time, I thought I'd found the origin based on crash lines, but now I don't think I was correct:

[6:50pm] sauron: ooh
[6:51pm] sauron: Firefox has a sendEvent: crash, too
[6:52pm] cl: yay?
[6:53pm] sauron: maybe
[6:53pm] sauron: theirs is in -[ToolbarWindow sendEvent:]
[7:05pm] sauron: but ToolbarWindow is just their NSWindow subclass
[7:05pm] sauron: i think
[7:10pm] sauron: both sets point back to bug 395465
[7:10pm] thebot: sauron: Bug https://bugzilla.mozilla.org/show_bug.cgi?id=395465 nor, P1, mozilla1.9beta5, joshmoz, RESO FIXED, showModalDialog is wonky on OS X

That's where Firefox's ToolbarWindow crashes' blame comes from: http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/widget/src/cocoa/nsCocoaWindow.mm&rev=1.153&mark=1828#1828

But our -[NSWindow sendEvent:] and -[NSControl sendAction:to:] crashes and Firefox's -[NSWindow(MethodSwizzling) nsCocoaWindow_NSWindow_sendEvent:] crashes come from http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/widget/src/cocoa/nsCocoaWindow.mm&rev=1.153&mark=2140#2140 instead, which is unrelated to bug 395465.

(Also, our NSApp sendEvent: crashes just have main on the stack, so I'm not sure what's up with them, e.g. http://crash-stats.mozilla.com/report/index/8e750d39-a2b3-46b5-8636-18eca2091214)

Comment 29

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

We should keep our eyes peeled for things like this in 1.9.2-based builds, which is supposed to have focus-related swizzling code removed.

Comment 30

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to comment #29)
> We should keep our eyes peeled for things like this in 1.9.2-based builds,
> which is supposed to have focus-related swizzling code removed.

Have any of you that have seen these crashes "regularly" in 2.0.x seen them in the experimental 1.9.2 builds?

Comment 31

[Lisa Thompson]

Attachment: crash report

Camino 2.1a1pre (1.9.2.5pre 20100520221150), 10.6.3

I was hammering on the bookmark sheet, as in comment 20. I saw the stuck button sporadically several times. Then, I don't remember whether I clicked Cancel or Add but it stuck, I clicked again to dismiss the sheet, hit command-D but the sheet did not reappear, I saw a brief beachball and then it crashed.

I see objc_msgSend(), and it looks like Java was the problem. (That's the extent of my crash-report reading capabilities.)

I was using my regular profile and had these pages open in tabs (as well as a few other non plug-in pages), the flash tab was frontmost when I crashed:
http://tv.adobe.com/watch/max-2009-video-vignettes/smallworldscom-by-smallworlds/
http://www.apple.com/itunes/ads/
http://www.java.com/en/download/help/testvm.xml

Is it right that I got the Apple crash reporter and not Camino's?

Comment 32

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Comment on attachment 447779 [details]
crash report

(In reply to comment #31)
> I see objc_msgSend(), and it looks like Java was the problem. (That's the
> extent of my crash-report reading capabilities.)

Well, most of the time Java is a red herring; it spews nonsense in crash reports if it's been loaded, even if it's not the thing that crashed.

> Is it right that I got the Apple crash reporter and not Camino's?

Yes, since that's not an official build.  In this case, it was to our benefit, since we could see the selector information that shows up in the 10.6 reports, but we still don't really know what's up.

[1:36pm] ardissone: I don't see how contentView could be involved there given that Thread 0, though
[1:38pm] smorgan: It's probably calling -[NSWindow contentView]
[1:39pm] smorgan: My guess would be it was trying to deliver one of the "hammering on the bookmark sheet" events to the now-destroyed sheet
[1:40pm] ardissone: so that's all in the OS?
[1:40pm] smorgan: Maybe? I'm not up on all the details of how the core event loop stuff works
[1:41pm] ardissone: but it's not something we really have control of
[1:41pm] smorgan: Camino? I wouldn't expect so
[1:41pm] ardissone: other than if we can figure out how to not ever get stuck buttons :P
[1:41pm] ardissone: ok
[1:41pm] smorgan: But clearly we or Gecko is doing *something* wrong
[1:42pm] smorgan: I just don't know what/where

Comment 33

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

I didn't realize this bug was still UNCO; we know it happens, if only because crash-stats keeps showing it.  We just don't have reliable STR for any of the ways to trigger it :(

Comment 34

[Mehmet]

ID: 01af0453-543f-4353-a13d-cfe1b2100927 -> related bug was this one in crash-stats.mozilla.com:

I had a window open with about 15 Tabs. While closing every single tab by clicking on the (x) (very fast) Camino crashed.

Comment 35

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Mehmet, can you look in the console.log for any messages from around the time of the crash?

You may have to go back to console.log.0; in Console.app, click "Show Log List" toolbar button, expand the "LOG FILES" section, expand "/Library/Logs", expand "Console" and then your UID, e.g. "501", and click on "console.log.0" to load it.

Comment 36

[Mehmet]

> in Console.app, click "Show Log List"
> toolbar button, expand the "LOG FILES" section, expand "/Library/Logs", expand
> "Console" and then your UID, e.g. "501", and click on "console.log.0" to load
> it.

Smokey, I haven't a log-file called console.log.0 in that section :-(

Comment 37

[Mehmet]

Attachment: log_28-10-2010

(In reply to comment #36)

> Smokey, I haven't a log-file called console.log.0 in that section :-(

EDIT: The last date in my console is 28-09-2010, but the crash was on 27-09.2010. I enclosed the file. Maybe it helps. 

Hmm... I installed on 27-10-2010 (5 minutes before the crash) betterTouchTool for the magic mouse. Maybe the crash was related to that ???

Comment 38

[Mehmet]

(In reply to comment #37)

> Hmm... I installed on 27-10-2010 (5 minutes before the crash) betterTouchTool
> for the magic mouse. Maybe the crash was related to that ???

Ehhhhm... I mean 27-"09"-2010 of course :-)

Comment 39

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

It's interesting: Mehmet's bp-01af0453-543f-4353-a13d-cfe1b2100927 crash has http://hg.mozilla.org/camino/annotate/7c4858d891f0/src/extensions/RolloverImageButton.m#l178 as the first line of Camino code, and then http://hg.mozilla.org/releases/mozilla-1.9.2/annotate/2c72c179ce74/widget/src/cocoa/nsAppShell.mm#l694

Right before that line in RolloverImageButton, we have Stuart's attempt to fix bug 509311; when you throw out all the swizzling and JEP in the crash report for that bug, the first line of Gecko is http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/widget/src/cocoa/nsAppShell.mm&rev=1.34&mark=518#518.  That's the very same line as the appshell line in Mehmet's crash on 1.9.2.

I found http://hg.mozilla.org/releases/mozilla-1.9.2/annotate/2c72c179ce74/widget/src/cocoa/nsAppShell.mm#l616 particularly interesting, because that sounds exactly like what we're seeing here (and I don't remember it as a regression from any of the appshell rewrites, which is what that comment is describing).

I hate the appshell.

Comment 40

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to comment #39)
> Right before that line in RolloverImageButton, we have Stuart's attempt to fix
> bug 509311; when you throw out all the swizzling and JEP in the crash report
> for that bug, the first line of Gecko is
> http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/widget/src/cocoa/nsAppShell.mm&rev=1.34&mark=518#518.
>  That's the very same line as the appshell line in Mehmet's crash on 1.9.2.

(In reply to comment #32)
> [1:36pm] ardissone: I don't see how contentView could be involved there given
> that Thread 0, though
> [1:38pm] smorgan: It's probably calling -[NSWindow contentView]
> [1:39pm] smorgan: My guess would be it was trying to deliver one of the
> "hammering on the bookmark sheet" events to the now-destroyed sheet

http://mxr.mozilla.org/camino/source/camino/src/browser/BrowserTabBarView.mm#1257
1257   // To prevent a rare crash when clicking on the dragged tab window right when it's being removed,
1258   // do not immediately release it.  (The crash is because of Gecko's NSWindow -sendEvent method swizzling
1259   // calling firstResponder on our deallocated floating tab window.)

Comment 41

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

bp-bccddaa0-4da3-4aaf-875c-2eeec2111029 says "Just updated, crashed after logging in to ravelry.com (and saving new credentials).", so this is the "Save new password" sheet.  This user is 10.7.2, and 2.1.

0 	libobjc.A.dylib 	objc_msgSend 	
1 	AppKit 	-[NSControl sendAction:to:] 	
2 	AppKit 	-[NSCell _sendActionFrom:] 	
3 	AppKit 	-[NSCell trackMouse:inRect:ofView:untilMouseUp:] 	
4 	AppKit 	-[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:] 	
5 	AppKit 	-[NSControl mouseDown:] 	
6 	AppKit 	-[NSWindow sendEvent:] 	
7 	AppKit 	-[NSApplication sendEvent:] 	
8 	AppKit 	-[NSApplication run] 	
9 	AppKit 	NSApplicationMain 	
10 	Camino 	main 	src/application/main.m:64
11 	Camino 	_start 	
12 	Camino 	start