1573853 - Crash in [@ logMessageSend] on macos 10.14

Status: RESOLVED WORKSFORME

(Core :: Widget: Cocoa, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-63029747-b502-4868-a54b-a28ff0190814.

Not exactly sure where to bucket this, but filing since the signatures are almost all potential UAFs: https://bit.ly/2YOEOEs. All of the crashes occur on 10.14.

Some comments:

• Had just downloaded a large pdf. File, which I had begun to read. As I then tried to return to Firefox search page, from the still open download, Firefox crashed. Hope this helps?
• Closed with no notice suddenly
• I was adding Excel attachments to an email I was sending.
• Ready to send a document with an attachment and the system crashes. Then, I have to start over, with frustration

Top 10 frames of crashing thread:

0 libobjc.A.dylib logMessageSend 
1 Foundation KVO_IS_RETAINING_ALL_OBSERVERS_OF_THIS_OBJECT_IF_IT_CRASHES_AN_OBSERVER_WAS_OVERRELEASED_OR_SMASHED 
2 Foundation NSKeyValueWillChangeWithPerThreadPendingNotifications.llvm.15185137406513792962 
3 CloudDocs -[BRContainer setCurrentStatus:] 
4 CloudDocs __52-[BRContainerCache subscribeToContainerStatusUpdate]_block_invoke 
5 Foundation -[__NSObserver _doit:] 
6 CoreFoundation CFStringFindCharacterFromSet 
7 CoreFoundation CFStringFindCharacterFromSet 
8 Foundation __NSBLOCKOPERATION_IS_CALLING_OUT_TO_A_BLOCK__ 
9 Foundation -[NSBlockOperation main] 

Comment 1

[Stephen A Pohl [:spohl]]

Unfortunately, there doesn't seem to be anything immediately actionable here. We appear to crash off-main-thread in system code. It is suspicious that the main thread shows the following frames for many of the crash reports:

[...]
1 CoreFoundation __CFStringDecodeByteStream3
2 CoreFoundation +[__NSTaggedDate __new:]
3 CoreFoundation __CFRunLoopRun
[...]

I have not been able to reproduce the crash and we may need to wait until we can reproduce in house.

Comment 2

[Markus Stange [:mstange]]

(In reply to Marcia Knous [:marcia - needinfo? me] from comment #0)

1 Foundation KVO_IS_RETAINING_ALL_OBSERVERS_OF_THIS_OBJECT_IF_IT_CRASHES_AN_OBSERVER_WAS_OVERRELEASED_OR_SMASHED 

Heh. It sounds like "an observer was overreleased or smashed". The crashing thread has frames in the CloudDocs framework, which seems to be related to iCloud.
This is probably a bug in iCloud code.

Comment 3

[Markus Stange [:mstange]]

And it's likely triggered by interactions with the file picker dialog, judging by the comments.

Comment 4

[Selena Deckelmann :selenamarie :selena]

Markus - is it worth reporting this to Apple? Or should we mark this as stalled and move on?

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

Dan, do you want to report this to Apple?

Comment 6

[Daniel Veditz [:dveditz]]

Their old bug reporting mechanism is gone, replaced by "Feedback Assistant". I reported it there but I'm dubious. The report is private to my account, but fwiw https://feedbackassistant.apple.com/feedback/7386774

Comment 7

[Markus Stange [:mstange]]

Thanks Dan and Liz for forwarding this to Apple!

Comment 8

[Daniel Veditz [:dveditz]]

Haven't seen any crashes on anything newer than Firefox 71 and ESR-68, all end-of-life

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit auto_nag documentation.