1534388 - Crash in [@ nsObserverService::NotifyObservers] called from nsChildView::PaintWindow

Status: RESOLVED FIXED

(Core :: Widget: Cocoa, defect)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-4e0833d9-3949-49ef-a52d-c73c10190311.

Seen while looking at 65 release crash stats - smaller volume crash which appears to affect Mac 10.14 more than the other platforms: https://bit.ly/2TBC6Qg. What concerned me was several comments mentioned "Fresh install of Firefox crashes on startup" as well as "under mojave 10.14.4 no possible opening of firefox"

Code was touched in Bug 1502284 in the 65 timeframe

ni on :gsvelto for ideas

Top 10 frames of crashing thread:

0 XUL nsObserverService::NotifyObservers xpcom/ds/nsObserverService.cpp:173
1 XUL mozilla::PresShell::DidPaintWindow layout/base/PresShell.cpp:8078
2 XUL nsView::DidPaintWindow view/nsViewManager.cpp:703
3 XUL nsChildView::PaintWindow widget/cocoa/nsChildView.mm:1514
4 libobjc.A.dylib objc_msgLookup_fpret 
5 XUL -[ChildView drawRect:] widget/cocoa/nsChildView.mm:3658
6 AppKit GCC_except_table7 
7 libobjc.A.dylib _class_initialize 
8 AppKit GCC_except_table7 
9 libobjc.A.dylib _class_resolveInstanceMethod 

Comment 1

[Andrew McCreight [:mccr8]]

The crash reason is:
MOZ_CRASH(Using observer service off the main thread!)

It looks to me like gsvelto's patch just moved around where this check was done, rather than added any checks.

Comment 2

[Andrew McCreight [:mccr8]]

It looks like this crash also existed in 64: bp-9c6be3f5-f6d4-4310-933f-302a70190105

In fact, I can see similar crashes going back to 60 ESR: https://crash-stats.mozilla.com/search/?moz_crash_reason=~Using%20observer%20service%20off%20the%20main%20thread&proto_signature=~nsChildView%3A%3APaintWindow&product=Firefox&platform=Mac%20OS%20X&date=%3E%3D2018-12-11T20%3A00%3A00.000Z&date=%3C2019-03-11T20%3A00%3A00.000Z&_facets=signature&_sort=version&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports

Markus, any ideas?

FWIW, this crash from 60 ESR has a better looking stack than the more recent crashes I saw: bp-6b3d176d-7d99-4722-a531-6407f0181215

Comment 3

[Andrew McCreight [:mccr8]]

There are a couple of crashes talking about crashing in light mode.

"Still crashes on startup in Light Mode."
bp-2948c019-df1e-4c38-b5db-3fcdd0181213

This crash report maybe has some STR:

  Happens after setting:
  > defaults write -g NSRequiresAquaSystemAppearance -bool NO

bp-27edb217-7e5e-48a2-bf32-4c5e00181223

Comment 4

[Markus Stange [:mstange]]

We added a main thread check to this method in bug 1515183. Should we uplift that patch?

Comment 5

[Andrew McCreight [:mccr8]]

I think so.

Comment 6

[Markus Stange [:mstange]]

I'll request uplift.

Comment 7

[Andrew McCreight [:mccr8]]

Thanks!

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Looks like the remaining crashes with this signature on 66 are on Windows. Calling this Mac-specific variant fixed by bug 1515183.