[macOS 11] Crash in [@ _HIWindowRemoveBackdrop]
Categories
(Core :: Widget: Cocoa, defect, P2)
Tracking
()
People
(Reporter: aryx, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: crash)
Crash Data
8 crashes so far, starting with macOS 11.0 developer beta 5 / 11.0 public beta 2 (10.16.0 20A5354i).
Crash report: https://crash-stats.mozilla.org/report/index/b5ee9bdd-f7bb-473c-8030-836d60200908
Reason: EXC_BAD_ACCESS / EXC_I386_GPFLT
Top 10 frames of crashing thread:
0 HIToolbox _HIWindowRemoveBackdrop
1 HIToolbox HIStandardMenuView::RemoveBackdrop
2 HIToolbox HIStandardMenuView::FreeLayout
3 HIToolbox HIStandardMenuView::GetOptimalSizeSelf
4 HIToolbox HIView::SendGetOptimalBounds
5 HIToolbox HIView::GetOptimalSize
6 HIToolbox HandleCalculateMenuSize
7 HIToolbox DispatchEventToHandlers
8 HIToolbox SendEventToEventTargetInternal
9 HIToolbox SendEventToEventTargetWithOptions
|
||
Comment 1•5 years ago
|
||
Over the last 30 days, we have had 7 crashes reported. The distribution across beta versions is as follows:
11.0 public beta 5 build 20A5384c: 1
11.0 developer beta 7 build 20A5374i: 1
11.0 public beta 3 build 20A5364e: 3
11.0 public beta 2 build 20A5354i: 2
There have not been any reported crashes for the 11.0 public beta 6 that was released on 10/16 yet. However, it may be too soon to say that this has been fixed by Apple in the latest beta.
|
||
Comment 2•5 years ago
|
||
This sounds like a bug outside of Firefox, in the native menu system. Firefox does not use HIViews.
|
|
||
Comment 3•5 years ago
|
||
Reported to Apple via Feedback Assistant. Case is FB8829594:
Description:
Users of Firefox on macOS 11.0 are reporting new application crashes. The crashes do not seem restricted to any particular version of Firefox or macOS 11.0 Beta as we are receiving crashes for several version combinations of Firefox and macOS 11.0 Beta. There is no Firefox-specific code on the stack at the time of the crash, which seems to point towards a newly introduced problem in macOS.
The crash appears to be a Null dereference. The reported crash reason is “EXC_BAD_ACCESS / EXC_I386_GPFLT” with a crash address 0x0.
The call stack of the crashing thread (main thread) is as follows:
Frame Module Signature Trust
0 HIToolbox _HIWindowRemoveBackdrop(WindowBackdrop*) context
1 HIToolbox HIStandardMenuView::RemoveBackdrop(WindowBackdrop**, unsigned char) frame_pointer
2 HIToolbox HIStandardMenuView::Remove1LayoutBackdrops(ItemLayout*, unsigned char) frame_pointer
3 HIToolbox HIStandardMenuView::FreeLayout(ItemLayout*&, unsigned long) frame_pointer
4 HIToolbox HIStandardMenuView::GetOptimalSizeSelf(CGSize*, float*) frame_pointer
5 HIToolbox HIView::SendGetOptimalBounds(CGRect*, float*, CGSize*) frame_pointer
6 HIToolbox HIView::GetOptimalSize(CGSize*, float*, CGSize*) frame_pointer
7 HIToolbox HandleCalculateMenuSize(OpaqueEventRef*) frame_pointer
8 HIToolbox DispatchEventToHandlers(EventTargetRec*, OpaqueEventRef*, HandlerCallRec*) frame_pointer
9 HIToolbox SendEventToEventTargetInternal(OpaqueEventRef*, OpaqueEventTargetRef*, HandlerCallRec*) frame_pointer
10 HIToolbox SendEventToEventTargetWithOptions frame_pointer
11 HIToolbox _CalcMenuSizeOnDevice(MenuData*, unsigned short, unsigned int, CGRect const*, unsigned int) frame_pointer
12 HIToolbox GetInitialMenuRect(MenuSelectData*, MenuData*, unsigned char, Point, unsigned short, Rect*, unsigned int*, CGPoint*) frame_pointer
13 HIToolbox GetMenuRect(MenuSelectData*, MenuData*, unsigned char, Rect*, unsigned int*, CGPoint*) frame_pointer
14 HIToolbox ResetRectScrollData(MenuSelectData*) frame_pointer
15 HIToolbox MenuChanged(MenuSelectData*, unsigned char, unsigned char) frame_pointer
16 HIToolbox TrackMenuCommon(MenuSelectData&, unsigned char*, SelectionData*, MenuResult*, MenuResult*) frame_pointer
17 HIToolbox MenuSelectCore(MenuData*, Point, double, unsigned int, OpaqueMenuRef**, unsigned short*) frame_pointer
18 HIToolbox _HandleMenuSelection2 frame_pointer
19 AppKit _NSHandleCarbonMenuEvent frame_pointer
20 AppKit _DPSEventHandledByCarbon frame_pointer
21 AppKit -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] frame_pointer
22 libobjc.A.dylib objc_object::rootAutorelease2() scan
23 AppKit -[NSEvent CGEvent] scan
|
|
||
Updated•5 years ago
|
|
||
Comment 5•4 years ago
|
||
There was a fair spike with version 83. Now pretty much died out with 85 and 86
https://crash-stats.mozilla.org/signature/?signature=_HIWindowRemoveBackdrop&date=%3E%3D2020-10-06T02%3A21%3A00.000Z&date=%3C2021-04-06T02%3A21%3A00.000Z#summary
|
Reporter | |
Comment 6•4 years ago
|
||
Fixed on the macOS side, last affected platform version was 10.16.0 20B5022a.
Description
•