Closed Bug 1587351 Opened 2 years ago Closed 2 years ago

Crash in [@ _object_remove_assocations]

Categories

(Core :: Widget: Cocoa, defect, P1)

71 Branch
Desktop
macOS
defect

Tracking

()

VERIFIED FIXED
mozilla71
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox69 --- unaffected
firefox70 --- unaffected
firefox71 blocking fixed

People

(Reporter: Pike, Unassigned)

References

Details

(Keywords: crash, regression, Whiteboard: [rca - codingerror])

Crash Data

This bug is for crash report bp-32f682de-036a-43a2-bb84-06dc30191009.

Top 10 frames of crashing thread:

0 libobjc.A.dylib _object_remove_assocations 
1 libobjc.A.dylib look_up_class 
2 CoreFoundation __CFNumberGetValue 
3 Foundation -[NSAutoreleasePool release] 
4 XUL nsAppShell::AfterProcessNextEvent widget/cocoa/nsAppShell.mm:808
5 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1278
6 XUL NS_ProcessPendingEvents xpcom/threads/nsThreadUtils.cpp:434
7 XUL nsBaseAppShell::NativeEventCallback widget/nsBaseAppShell.cpp:87
8 XUL nsAppShell::ProcessGeckoEvents widget/cocoa/nsAppShell.mm:440
9 CoreFoundation -[__NSDictionaryM removeObjectForKey:] 

This seems to have spiked today, thus filing a bug.

There's bug 1569461 with the same top stack, but the other frames look different.

Filing in Untriaged as there's nothing standing out in the stack trace.

Volume's huge on the latest nightly build.

Priority: -- → P1

I can reliably reproduce this by manually checking for an update and then closing the about dialog.

OS: Unspecified → macOS
Hardware: Unspecified → Desktop

4 bugs which touched widget/cocoa/ (Bug 1563350, Bug 1563351, Bug 1563349, Bug 1567939) have been backout. Please verify if the upcoming Nightly with buildid 20191009103354 isn't affected anymore.

Other STR (based on crash report comments): it crashes when I make a video on YouTube full screen.

(In reply to Sebastian Hengst [:aryx] (needinfo on intermittent or backout) from comment #3)

4 bugs which touched widget/cocoa/ (Bug 1563350, Bug 1563351, Bug 1563349, Bug 1567939) have been backout. Please verify if the upcoming Nightly with buildid 20191009103354 isn't affected anymore.

I verified with autoland builds that this push caused it.

Component: Untriaged → Widget: Cocoa
Product: Firefox → Core
Version: unspecified → 71 Branch

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Keywords: regression
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla71
Status: RESOLVED → VERIFIED
Duplicate of this bug: 1587249
Crash Signature: [@ _object_remove_assocations] → [@ _object_remove_assocations] [@ libobjc.A.dylib@0x8598]

This crash is triggered when a new window is opened and then the user returns to the original Firefox window. This includes modal windows, which is why opening the About window (per comment 2) triggers this. I've marked this as blocking the meta bug for the stack of changes listed in comment 3 that have since been backed out. Sorry for the extra work everyone-- I'm working on this now.

Blocks: 1563347
Crash Signature: [@ _object_remove_assocations] [@ libobjc.A.dylib@0x8598] → [@ _object_remove_assocations] [@ libobjc.A.dylib@0x8598]
Crash Signature: [@ _object_remove_assocations] [@ libobjc.A.dylib@0x8598] → [@ _object_remove_assocations] [@ libobjc.A.dylib@0x8598] [@ libobjc.A.dylib@0x8558 ]

This bug might benefit from an analysis using a HookCase hook library (https://github.com/steven-michaud/HookCase).

Duplicate of this bug: 1587675
Crash Signature: [@ _object_remove_assocations] [@ libobjc.A.dylib@0x8598] [@ libobjc.A.dylib@0x8558 ] → [@ _object_remove_assocations] [@ libobjc.A.dylib@0x8598] [@ libobjc.A.dylib@0x8558 ] [@ libobjc.A.dylib@0x68a9] [@ libobjc.A.dylib@0x705d] [@ objc_msgSend | (anonymous namespace)::AutoreleasePoolPage::pop] [@ objc_release | (anonymous namespace)::Autor…
Crash Signature: [@ _object_remove_assocations] [@ libobjc.A.dylib@0x8598] [@ libobjc.A.dylib@0x8558 ] [@ libobjc.A.dylib@0x68a9] [@ libobjc.A.dylib@0x705d] [@ objc_msgSend | (anonymous namespace)::AutoreleasePoolPage::pop] [@ objc_release | (anonymous → [@ _object_remove_assocations] [@ libobjc.A.dylib@0x8598] [@ libobjc.A.dylib@0x8558 ] [@ libobjc.A.dylib@0x68a9] [@ libobjc.A.dylib@0x705d] [@ objc_msgSend | (anonymous namespace)::AutoreleasePoolPage::pop] [@ objc_release | (anonymous
Flags: qe-verify+

This bug has been identified as part of a pilot on determining root causes of blocking and dot release drivers.

It needs a root-cause set for it. Please see the list at https://docs.google.com/document/d/1FFEGsmoU8T0N8R9kk-MXWptOPtXXXRRIe4vQo3_HgMw/.

Add the root cause as a whiteboard tag in the form [rca - <cause> ] and remove the rca-needed keyword.

If you have questions, please contact :tmaity.

Keywords: rca-needed
Keywords: rca-needed
Whiteboard: [rca - logicalerror]

Tania, should I be listing something as specific as "logical error" here, or should I use the broader "coding error" category in the Google Doc?

Flags: needinfo?(tmaity)

(In reply to Harry Twyford [:harry] from comment #12)

Tania, should I be listing something as specific as "logical error" here, or should I use the broader "coding error" category in the Google Doc?

logical error is a sub category/type under coding error. So please tag is as "coding error"

Flags: needinfo?(tmaity)
Whiteboard: [rca - logicalerror] → [rca - codingerror]
You need to log in before you can comment on or make changes to this bug.