1618418 - Input type color crashes on color picker close on Mac

Status: REOPENED

(Core :: Widget: Cocoa, defect, P3)

Description

[Max Lynch]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:73.0) Gecko/20100101 Firefox/73.0

Steps to reproduce:

Create an <input type="color" in a vdom tree using Stencil JS (uses snabdom). Set an event handler for either input or change on the element. The color can be changed freely, but upon closing the color picker modal on Mac OS, Firefox will occasionally crash.

Actual results:

Firefox crashed

Expected results:

Firefox should not have crashed

Comment 1

[Max Lynch]

This actually has nothing to do with stencil, here's a simple one liner that reliably crashes firefox on Catalina: https://codepen.io/yesimahuman/pen/oNXWxNZ

To repro: open the color picker, select a few colors, close it. If Firefox doesn't crash, open it again and try a few more times.

Comment 2

[Max Lynch]

Some more info: I'm on Mac OS 10.15.2, a co-worker who is on 10.15.3 with the same FF version is not able to reproduce.

I will try upgrading Mac OS to see if that fixes it

Comment 3

[Daniel Bodea [:danibodea]]

I attempted to reproduce this issue on MacBook Pro with MacOS 10.13, 10.13.6 and 10.14.6, but could not reproduce. Then, I attempted reproducing it on a MacBook Air with Mac OS 10.15.3 and I reproduced ONCE on Nightly. It appears it is not as easy to reproduce as previously thought.

Furthermore, it appears that 2 crashed were being recorded for the exact same time and date, but for different versions, although, I've been using the Nightly v75.0a1 version:

• https://crash-stats.mozilla.org/report/index/77b4c6c8-1cae-4962-bd49-ca5910200302
• https://crash-stats.mozilla.org/report/index/4f95cc81-aac2-4a41-8987-2790f0200302
  A technical opinion on these crashes is needed, but we also need a crash report from the user to make sure this is the same issue.

@Mac: Can you please reproduce this again and provide us with a crash report link? (To do that, you need to restart the browser after the crash, reach the "about:crashes" page, submit (if unsubmited) and view the crash report ar the exact time you crashed the browser and put the link in a comment.)

Thank you for your contribution!

Comment 4

[Jonathan Kew [:jfkthame]]

The reports in comment 3 -- if they're the same issue -- don't really look like a Layout bug to me; seems to be more of a DOM issue while trying to handle an event that gets fired when the picker is closed.

Max, are you still able to reproduce this color-picker crash? If so, it would be really helpful to have a link to a crash report from your system, to confirm if it looks the same as Daniel's example. (I was not able to reproduce the problem on my MacBook just now.)

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

(nothing there looks DOM Events to me)

Comment 6

[Edgar Chen [:edgar]]

I am on Mac OS 10.14.4 and not able to reproduce the crash.

Comment 7

[arinaldoni]

Hello,

I can reproduce the error on Firefox Developer edition (76.0b8, mac OS 10.15.4), getting this crash report:
https://crash-stats.mozilla.org/report/index/d25153d4-03b5-44f8-a560-179ae0200424

On standard Firefox (75.0), I was not able to reproduce this error.

Comment 8

[talby]

Firefox 76.0 (64-bit)
macOS 10.15.4

In the color picker itself, using the "Color Wheel" or "Color Palettes" mode do not crash, but the "Color Sliders" (I used the "RGB Sliders") does.

Comment 9

[flyx]

Firefox 76.0.1 (64-bit)
macos 10.15.4

Can reliably reproduce using RGB sliders or Grayscale slider:

• open Firefox, open a page with a color input
• open color picker, change something, close it
• open color picker again, change something, close it
• Firefox crashes every time at this point, never later, never earlier

Crash does not occur if you ever change the color using one of the other tabs of Color Picker (just opening the other tabs is not enough). This includes doing it on a color input in a different browser tab or between page reloads. Crash can only reproduced again after restarting Firefox.

Comment 10

[foxt]

Can consistently repro on FF97.0.1, macOS 12.1, using the saved colours area near the bottom. Attempting to drag a colour there crashes Firefox. Nothing else seemed to cause a crash for me.

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

The bug has a release status flag that shows some version of Firefox is affected, thus it will be considered confirmed.

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:nika, since the bug has recent activity, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 13

[Andrew McCreight [:mccr8]]

I was able to reproduce this crash using the steps in comment 10, on OSX. bp-cafbad5f-dec2-4cee-b992-875a70220525

The Mac crash info includes this:
"message": "Assertion failed: (backingScaleFactor > 0.f), function drawnFocusRingBitmapForTime, file NSAutomaticFocusRing.m, line 346.\n",

The crash reports from 2 years ago are of course gone now, and nobody actually copied what they saw in the crash reports into the bug, so that's all we have to go on, I guess.

Anyways, this looks like a Widget issue. I'm not sure why it ended up in XPCOM.

Comment 14

[Stephen A Pohl [:spohl]]

I'm currently unable to reproduce this on macOS 12.4 Beta (21F5048e) on M1, both with Firefox 100.0.2 as well as a local build from current Nightly. Andrew, what version of macOS and Firefox were you using?

Comment 15

[Andrew McCreight [:mccr8]]

Firefox is 102.0a1 (2022-05-24). OSX is whatever the latest release is. System info says 12.4 (21F79).

Comment 16

[Andrew McCreight [:mccr8]]

I tried again, and I couldn't reproduce it. I'm not sure what the difference is.

Comment 17

[Steven Michaud [:smichaud] (Retired)]

For a full account of these crashes, you need to search on "mac_crash_info contains 'backingScaleFactor > 0.f'":

https://crash-stats.mozilla.org/search/?mac_crash_info=~backingScaleFactor%20%3E%200.f&platform=Mac%20OS%20X&date=%3E%3D2021-11-25T15%3A31%3A00.000Z&date=%3C2022-05-25T15%3A31%3A00.000Z&_facets=signature&_facets=platform_version&_facets=cpu_arch&_facets=mac_crash_info&_facets=proto_signature&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-platform_version

They seem to happen only on macOS 11 and 12. I'd bet these are an Apple bug.

It's interesting that about 40% of these happen on ARM64 (Apple Silicon) hardware. As far as I know, Apple Silicon users are only a tiny percentage of Firefox users on macOS. So it seems these crashes are much more likely to happen on Apple Silicon than Intel hardware.

Comment 18

[Steven Michaud [:smichaud] (Retired)]

As far as I know, Apple Silicon users are only a tiny percentage of Firefox users on macOS.

Judging by crash statistics over the last week, only about 7.5% of Mac users are currently on Apple Silicon:

https://crash-stats.mozilla.org/search/?platform=Mac%20OS%20X&date=%3E%3D2022-05-18T15%3A41%3A00.000Z&date=%3C2022-05-25T15%3A41%3A00.000Z&_facets=signature&_facets=cpu_arch&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-cpu_arch

Comment 19

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 20

[Steven Michaud [:smichaud] (Retired)]

These crashes are still happening under different signatures.

https://crash-stats.mozilla.org/search/?mac_crash_info=~backingScaleFactor%20%3E%200.f&platform=Mac%20OS%20X&date=%3E%3D2022-10-28T05%3A01%3A00.000Z&date=%3C2022-11-04T05%3A01%3A00.000Z&_facets=signature&_facets=platform_version&_facets=cpu_arch&_facets=mac_crash_info&_facets=proto_signature&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature