1587351 - Crash in [@ _object_remove_assocations]

Status: VERIFIED FIXED

(Core :: Widget: Cocoa, defect, P1)

Description

[Axel Hecht [:Pike]]

This bug is for crash report bp-32f682de-036a-43a2-bb84-06dc30191009.

Top 10 frames of crashing thread:

0 libobjc.A.dylib _object_remove_assocations 
1 libobjc.A.dylib look_up_class 
2 CoreFoundation __CFNumberGetValue 
3 Foundation -[NSAutoreleasePool release] 
4 XUL nsAppShell::AfterProcessNextEvent widget/cocoa/nsAppShell.mm:808
5 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1278
6 XUL NS_ProcessPendingEvents xpcom/threads/nsThreadUtils.cpp:434
7 XUL nsBaseAppShell::NativeEventCallback widget/nsBaseAppShell.cpp:87
8 XUL nsAppShell::ProcessGeckoEvents widget/cocoa/nsAppShell.mm:440
9 CoreFoundation -[__NSDictionaryM removeObjectForKey:] 

This seems to have spiked today, thus filing a bug.

There's bug 1569461 with the same top stack, but the other frames look different.

Filing in Untriaged as there's nothing standing out in the stack trace.

Comment 1

[Julien Cristau [:jcristau]]

Volume's huge on the latest nightly build.

Comment 2

[Axel Hecht [:Pike]]

I can reliably reproduce this by manually checking for an update and then closing the about dialog.

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

4 bugs which touched widget/cocoa/ (Bug 1563350, Bug 1563351, Bug 1563349, Bug 1567939) have been backout. Please verify if the upcoming Nightly with buildid 20191009103354 isn't affected anymore.

Comment 4

[Jan de Mooij [:jandem]]

Other STR (based on crash report comments): it crashes when I make a video on YouTube full screen.

(In reply to Sebastian Hengst [:aryx] (needinfo on intermittent or backout) from comment #3)

4 bugs which touched widget/cocoa/ (Bug 1563350, Bug 1563351, Bug 1563349, Bug 1567939) have been backout. Please verify if the upcoming Nightly with buildid 20191009103354 isn't affected anymore.

I verified with autoland builds that this push caused it.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 6

[Julien Cristau [:jcristau]]

Marking as fixed by the backout:
https://hg.mozilla.org/mozilla-central/rev/0c108c06ee6e3173a22578d00bc0f02ab0fb9e31

Comment 8

[Harry Twyford]

This crash is triggered when a new window is opened and then the user returns to the original Firefox window. This includes modal windows, which is why opening the About window (per comment 2) triggers this. I've marked this as blocking the meta bug for the stack of changes listed in comment 3 that have since been backed out. Sorry for the extra work everyone-- I'm working on this now.

Comment 9

[Steven Michaud [:smichaud] (Retired)]

This bug might benefit from an analysis using a HookCase hook library (https://github.com/steven-michaud/HookCase).

Comment 11

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

This bug has been identified as part of a pilot on determining root causes of blocking and dot release drivers.

It needs a root-cause set for it. Please see the list at https://docs.google.com/document/d/1FFEGsmoU8T0N8R9kk-MXWptOPtXXXRRIe4vQo3_HgMw/.

Add the root cause as a whiteboard tag in the form [rca - <cause> ] and remove the rca-needed keyword.

If you have questions, please contact :tmaity.

Comment 12

[Harry Twyford]

Tania, should I be listing something as specific as "logical error" here, or should I use the broader "coding error" category in the Google Doc?

Comment 13

[Tania Maity (:tmaity)]

(In reply to Harry Twyford [:harry] from comment #12)

Tania, should I be listing something as specific as "logical error" here, or should I use the broader "coding error" category in the Google Doc?

logical error is a sub category/type under coding error. So please tag is as "coding error"