1509050 - Crash in objc_release | CGSWindowInvalidateSize

Status: RESOLVED WORKSFORME

(Core :: Widget: Cocoa, defect, P3)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-6050c517-28ac-4467-8f10-aadd90181121.
=============================================================

Seen while looking at crash stats: https://bit.ly/2qVwf7q. Marking as security sensitive since there are potential UAFs in the signature. All crashes are using 10.13. A total of 8 crashes in the last week.

Top 10 frames of crashing thread:

0 libobjc.A.dylib objc_release 
1 SkyLight CGSWindowInvalidateSize 
2 SkyLight shape_window_internal 
3 SkyLight SLSShapeWindowInWindowCoordinates 
4 AppKit __NSCGSWindowMark__block_invoke_2 
5 AppKit _NSCGSWindowEnumerateForCommit 
6 AppKit __NSCGSWindowMark__block_invoke 
7 AppKit NSCGSTransactionRunPreCommitActionsForOrder_ 
8 AppKit NSCGSTransactionRunPreCommitActions_ 
9 AppKit -[_NSCGSTransaction synchronize] 

=============================================================

Comment 1

[Marcia Knous [:marcia]]

It looks as if all the URLs are either youtube.com or video sites.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Adding the usual MacOS suspects.

Comment 3

[Stephen A Pohl [:spohl]]

This is a very similar (although not identical) stack as in bug 1452763.

Comment 4

[Marcia Knous [:marcia]]

I found some additional crashes when looking at nightly crash data with a similar signature, they are all 10.14: https://bit.ly/2MVA2Mf. From what I can see from the URLs, a few people are using password managers - https://bitwarden.com/#download is one example. Some of the other URLs are behind logins.

One comment "Attempt to open the Grammarly extension on a Desire2Learn myCourses page. That is all I can think of."

Comment 6

[Wayne Mery (:wsmwk)]

For both signatures, there are no crashes newer than version 68
https://crash-stats.mozilla.org/signature/?signature=objc_release%20%7C%20CGSWindowInvalidateSize&date=%3E%3D2020-06-05T14%3A18%3A00.000Z&date=%3C2020-12-05T14%3A18%3A00.000Z
https://crash-stats.mozilla.org/signature/?signature=CGSWindowInvalidateCache&date=%3E%3D2020-06-05T14%3A18%3A00.000Z&date=%3C2020-12-05T14%3A18%3A00.000Z

WFM?

Comment 7

[Wayne Mery (:wsmwk)]

Also true for bug 1452763 with respect to https://crash-stats.mozilla.org/signature/?signature=objc_release%20%7C%20CGSWindowInvalidateCache&date=%3E%3D2020-06-05T14%3A21%3A00.000Z&date=%3C2020-12-05T14%3A21%3A00.000Z