670914 - crash [@ -[NativeMenuItemTarget menuItemHit:] ] and [ @0x0 | -[NativeMenuItemTarget menuItemHit:] ]

Status: RESOLVED FIXED

(Core :: Widget: Cocoa, defect)

Description

[Wayne Mery (:wsmwk)]

Mac crash 
[@ -[NativeMenuItemTarget menuItemHit:] ]
[@0x0 | -[NativeMenuItemTarget menuItemHit:] ]

only in version 5 thunderbird and it's alphas and betas, i.e. gecko 2.0

bp-fcf3f757-f80c-40fc-aa34-f60012110709 (fergus)
0x8
new install!
0	XUL	-[NativeMenuItemTarget menuItemHit:]	widget/src/cocoa/nsMenuBarX.mm:857
1	AppKit	-[NSApplication sendAction:to:from:]	
2	AppKit	-[NSMenu performActionForItemAtIndex:]	
3	AppKit	-[NSCarbonMenuImpl performActionWithHighlightingForItemAtIndex:]	
4	AppKit	-[NSMenu performKeyEquivalent:]	
5	AppKit	-[NSApplication _handleKeyEquivalent:]	
6	AppKit	-[NSApplication sendEvent:]	
7	AppKit	-[NSApplication run]	
8	XUL	nsAppShell::Run	widget/src/cocoa/nsAppShell.mm:746
9	XUL	nsAppStartup::Run	toolkit/components/startup/nsAppStartup.cpp:218

Comment 1

[Wayne Mery (:wsmwk)]

(rephrasing)
STARTING in version 5 thunderbird and it's alphas and betas, i.e. gecko 2.0

Firefox crashes are not so common. some examples with comments:
bp-3e51bc2b-74d6-4394-b316-a93e72110626 same old message every time I quit firefox, it thinks it has crashed on my mac
bp-22d802b6-a281-4ebe-89bf-eeb3f2110630 Just tried to pulll up the About box. 
bp-c9e828ff-cf54-4946-8fb2-875112110626 I always get this message when I quit firefox. 
bp-d330ff70-9db4-4251-8a98-f23ba2110614 (Kenny) clicked 'About Firefox' after telling it to restart to update add-ons

Comment 2

[Florian Quèze [:florian]]

This is currently the top crasher for Instantbird. It started happening with Instantbird 1.0 (Mozilla 2.0) and happens too in current nightly builds (based on Mozilla 7).

I've no idea of why it seems to happen more frequently for Instantbird than for Firefox. I've no reliable steps to reproduce. When it happens to me (less when once a week), it's after I've pressed Command + , to open the pref window. I also saw some reports of people crashing with this stack when opening the About dialog (which AFAIK has no keyboard shortcut), so I don't think it's related to keyboard shortcuts.

Some stacks we have (they look similar to those from comment 0 and comment 1):
http://crash-stats.instantbird.com/report/index/8ca39ea8-7456-434b-b2d9-569942110831
http://crash-stats.instantbird.com/report/index/4685e122-b317-4b8b-88d0-007bd2110902
http://crash-stats.instantbird.com/report/index/4e2f1217-3206-4311-a8de-05ca02110812
http://crash-stats.instantbird.com/report/index/caba4bc0-9014-4ec3-b5b9-a61562110822

Comment 3

[Wayne Mery (:wsmwk)]

TB7 example bp-a2f422a7-65aa-44de-b332-c90312110829
FF7 bp-34d4bcae-ee6b-4ac1-bef6-cd40a2110902  bp-97001ad6-bb40-4777-9d9f-ac7a02110831

Comment 4

[Robert Kaiser]

https://crash-stats.mozilla.com/report/list?signature=-[NativeMenuItemTarget%20menuItemHit%3A] and https://crash-stats.mozilla.com/report/list?signature=%400x0%20|%20-[NativeMenuItemTarget%20menuItemHit%3A] show this happening across different OS X versions, which is interesting given that most of the stack trace is in the OS (even if the crashing frame itself is in our code). It also happens across a range of different Firefox and Thunderbird versions, mostly releases.

I wonder who knows Mac widget integration well enough to look at this.

Comment 5

[Steven Michaud [:smichaud] (Retired)]

> I wonder who knows Mac widget integration well enough to look at this.

For now there's really only me.  But for that reason I have very little time.

So let's make a deal.  Someone else needs to find an easily reproducible testcase for this bug.  Once we have that, I can start working on it.

Comment 6

[Steven Michaud [:smichaud] (Retired)]

And no, even I can't figure this out just looking at the crash stacks.

Comment 7

[Marcia Knous [:marcia]]

One comment from a 10.5 user: I upgraded Flip4Mac and the new version keeps crashing Firefox when I try and play a song.

Comment 8

[Florian Quèze [:florian]]

(In reply to Florian Quèze from comment #2)
> This is currently the top crasher for Instantbird. [...]
> 
> I've no idea of why it seems to happen more frequently for Instantbird than
> for Firefox.

I've no way to verify this idea at this point, but I wondered yesterday if it would be possible that the crash only occurs when there is a Growl notification displayed (or recently displayed).

This would explain why the crash is way more frequent in Instantbird, as in Instantbird we display a Growl notification (when they are enabled) each time a new IM is received while the conversation window isn't focused.

If this guess is right, the crash would then be random, but only when an action of the application menu (I've seen reports for "About", "Preferences", "Hide <application name>" and "Quit", so really, any action of the menu) is performed while a notification is visible. It may also be related to some specific versions of Growl.

Comment 9

[Steven Michaud [:smichaud] (Retired)]

(Following up comment #5)

Because access to bugzilla was so flaky yesterday, I had a couple of hours to kill.  I spent it digging through the tree, trying to figure out bug 704866 (which appears to be a dup of this bug).

I came up with a plausible explanation for these crashes, and just landed a patch on mozilla-inbound (which means it should be in tomorrow's mozilla-central nightlies).

Since we can't reproduce these crashes, we'll need to watch http://crash-stats.mozilla.com/, to see if the crashes go away, or are reduced in number.

Comment 10

[Steven Michaud [:smichaud] (Retired)]

> which means it should be in tomorrow's mozilla-central nightlies

Actually, probably the day after tomorrow's mozilla-central nightlies.

Comment 11

[Wayne Mery (:wsmwk)]

topcrash for tbird version 11b and 12a - for example bp-3621ed05-90c8-43f8-9b0e-7b6c12120207

majority of comments cite quit from the file menu thunderbird.
still haven't gotten a crash reporter to go on record.

Comment 12

[Steven Michaud [:smichaud] (Retired)]

Let's see what happens to these crash reports now that bug 728964 is fixed.

If they persist in large numbers, it'll probably be worthwhile for me to try what I suggest in the following comment as a fallback.  (I added this as part of my "fix" for bug 704866.)

http://hg.mozilla.org/mozilla-central/annotate/cb01e23f83cf/widget/cocoa/nsMenuBarX.mm#l842

Comment 13

[Wayne Mery (:wsmwk)]

another signature, also mostly quitting thunderbird, 
bp-4a9a850d-e495-41bf-b13d-b731e2120218 nsMenuUtilsX::DispatchCommandTo

Comment 14

[Steven Michaud [:smichaud] (Retired)]

(Following up comment #12)

For what it's worth, there've been none of these crashes in the two days since my fix for bug 728964 landed on the 11, 12 and 13 branches (on 2012-02-29).  Previously there were several a day.

Let's check again in a week.  But so far things are looking very good.

Comment 15

[Steven Michaud [:smichaud] (Retired)]

There have been *no* crashes over the last two weeks containing "menuItemHit" in any Thunderbird build containing my fix for bug 728964.

I'd say this bug is fixed, by a combination of my patches for bug 728964 and bug 704866.