Startup crashes with "unable to open IOSurface kernel service" in mac_crash_info, mostly on macOS 12.0.0, mostly on nb-no locale
Categories
(Core :: Widget: Cocoa, defect, P2)
Tracking
()
People
(Reporter: smichaud, Unassigned)
References
(Blocks 2 open bugs)
Details
Crash Data
These crashes have at least two different signatures. But all are startup crashes, and all happen on the latest macOS 12.0.0 beta (build 21A5268h):
As they only happen on this build, deep in system code, they're probably an Apple bug.
|
Reporter | |
Updated•3 years ago
|
|
|
Reporter | |
Comment 1•3 years ago
|
||
These have various mac_crash_info sections. Here's the most common:
{
"num_records": 1,
"records": [
{
"message": "Assertion failed: (_iosConnectInitalize() unable to open IOSurface kernel service: e00002c7\n1020 existing clients:\n{\n}\n), function _iosConnectInitalize, file /System/Volumes/Data/SWE/macOS/BuildRoots/0ed32b12e4/Library/Caches/com.apple.xbs/Sources/IOSurface/IOSurface-302.7/IOSurfaceUser/IOSurfaceClient.m, line 407.\n",
"module": "/usr/lib/system/libsystem_c.dylib"
}
]
}
|
|
Reporter | |
Comment 2•3 years ago
•
|
||
On macOS 10.15.7 at least, this error message is written by _iosConnectInitalize.cold.3() in the IOSurface framework, on the failure of a call to IOServiceOpen() (https://developer.apple.com/documentation/iokit/1514515-ioserviceopen?language=objc), as that framework is being initialized.
There are no crashes with iosConnectInitalize.cold in the proto signature, so these crashes are definitely new with macOS 12.0.0 build 21A5268h.
|
|
Reporter | |
Comment 3•3 years ago
|
||
It's conceivable, but not very likely, that this is a sandbox bug.
I'm CCing you, Haik, because I know you used to work on Mac sandbox things. Please pass the NI along if you're no longer doing this.
|
|
Reporter | |
Comment 4•3 years ago
|
||
The error number 0xe00002c7 is an IOKit error defined as kIOReturnUnsupported.
|
||
Updated•3 years ago
|
|
|
||
Comment 5•3 years ago
|
||
I can't reproduce locally so far with Beta 21A5268h and a 6-core MacBook Pro (15-inch 2018). I noticed all of the crash reports are from a 16 CPU, 64 GB system. I think we just have to keep an eye on this for now. Given what you found regarding iosConnectInitalize.cold, this seems like a macOS bug. To debug further, we could try disassembling the IOService functions looking for an interaction with sandboxing.
|
|
Reporter | |
Updated•3 years ago
|
|
|
Reporter | |
Updated•3 years ago
|
|
|
Reporter | |
Comment 6•3 years ago
|
||
I found one this bug's crash reports on macOS 10.13.6 (bp-c87c7b64-c93c-4fff-b51e-68f140210713), so its crash stack is symbolicated:
0 libsystem_kernel.dylib __pthread_kill context
1 libsystem_c.dylib abort frame_pointer
2 libsystem_c.dylib __assert_rtn frame_pointer
3 IOSurface _iosConnectInitalize frame_pointer
4 libsystem_pthread.dylib __pthread_once_handler frame_pointer
5 libsystem_platform.dylib _os_once frame_pointer
6 libsystem_pthread.dylib pthread_once frame_pointer
7 IOSurface IOSurfaceClientGetPropertyMaximum frame_pointer
8 CoreImage __iosurface_limits_block_invoke frame_pointer
9 libdispatch.dylib _dispatch_client_callout frame_pointer
10 libdispatch.dylib dispatch_once_f frame_pointer
...
|
|
Reporter | |
Comment 7•3 years ago
|
||
Some of the crash reports with signatures [@ libsystem_kernel.dylib@0x71c2 ] and [@ libsystem_kernel.dylib@0x7db6 ] don't belong to this bug -- they have different mac_crash_info sections.
|
|
Reporter | |
Updated•3 years ago
|
|
|
Reporter | |
Comment 8•3 years ago
|
||
There are no crashes with iosConnectInitalize.cold in the proto signature
Oops, I didn't look far enough back:
|
|
Reporter | |
Updated•3 years ago
|
|
|
Reporter | |
Updated•3 years ago
|
|
|
Reporter | |
Comment 9•3 years ago
|
||
Most of these crashes (though not all of them) are on the nb-no locale:
|
|
Reporter | |
Updated•3 years ago
|
|
||
Updated•3 years ago
|
|
|
Reporter | |
Updated•3 years ago
|
|
|
Reporter | |
Updated•3 years ago
|
|
|
Reporter | |
Comment 10•3 years ago
|
||
Something I didn't notice before -- these are (roughly) evenly divided between the "content" and "parent" processes:
|
||
Comment 11•2 years ago
|
||
Closing because no crashes reported for 12 weeks.
|
|
Reporter | |
Comment 12•2 years ago
•
|
||
Crashes are actually still happening that match this bug's description. But their signatures are somewhat different, they no longer happen mostly on macOS 12, and they no longer happen on the nb-no locale. So it's likely now a different bug.
Edit: Also, these are now almost entirely content process crashes.
Description
•