Open Bug 1799247 Opened 3 years ago Updated 2 years ago

Crash in [@ nsMenuBarX::Paint] when opening Window menu with multiple monitors

Categories

(Core :: Widget: Cocoa, defect, P3)

Product:
Core
Component:
Widget: Cocoa
Version:
Firefox 108
Platform:
Desktop
macOS
Type:
defect

Tracking

()

Status:
REOPENED

People

(Reporter: sam, Unassigned)

References

Details

(Keywords: crash, Whiteboard: [tbird crash])

Crash Data

Steps to reproduce:

  1. Open a Firefox window on monitor A.
  2. Open another Firefox window on monitor B.
  3. Monitor B's Firefox window should have focus. Open Firefox's Window menu on monitor B.
  4. Without dismissing the Window menu, click Firefox's Window menu that is on monitor A's menu bar.
  5. 💣

Crash report: https://crash-stats.mozilla.org/report/index/79faf826-20b6-43a7-8964-6b3a90221105

MOZ_CRASH Reason: MOZ_CRASH(Encountered unexpected Objective C exception)

Top 10 frames of crashing thread:

0  XUL  nsMenuBarX::Paint  widget/cocoa/nsMenuBarX.mm:458
1  XUL  -[WindowDelegate windowDidResignMain:]  widget/cocoa/nsCocoaWindow.mm:2845
2  CoreFoundation  __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__  
3  CoreFoundation  ___CFXRegistrationPost_block_invoke  
4  CoreFoundation  _CFXRegistrationPost  
5  CoreFoundation  _CFXNotificationPost  
6  Foundation  -[NSNotificationCenter postNotificationName:object:userInfo:]  
7  AppKit  -[NSWindow _changeKeyAndMainLimitedOK:]  
8  AppKit  -[NSWindow _makeKeyRegardlessOfVisibility]  
9  AppKit  -[NSWindow makeKeyAndOrderFront:]
Regressed by: 1642138

:spohl, since you are the author of the regressor, bug 1642138, could you take a look? Also, could you set the severity field?

For more information, please visit auto_nag documentation.

Flags: needinfo?(spohl.mozilla.bugs)

Fixed by backout of bug 1642138.

Status: UNCONFIRMED → RESOLVED
Closed: 3 years ago
Flags: needinfo?(spohl.mozilla.bugs)
Resolution: --- → FIXED

Set release status flags based on info from the regressing bug 1642138

status-firefox106: --- → unaffected
status-firefox107: --- → unaffected
status-firefox108: --- → affected
status-firefox-esr102: --- → unaffected

@spohl I do not believe this crash is a regression from bug 1642138. I was able to reproduce this after the backout, and I can also reproduce it with the updated patch from bug 1642138.

Flags: needinfo?(spohl.mozilla.bugs)

(In reply to Sam Johnson from comment #4)

I was able to reproduce this after the backout

Can you link to a crash report that you submitted from a build after the backout? I can't find any reports with that signature with a build ID > 20221104160427.

Here's the exception stack from the report linked in comment 0:

Obj-C Exception data:
NSGenericException: *** Collection <__NSArrayM: 0x13fd55d60> was mutated while being enumerated.

Thrown at stack:
__exceptionPreprocess (in CoreFoundation) + 0xe2
objc_exception_throw (in libobjc.A.dylib) + 0x30
__NSFastEnumerationMutationHandler (in CoreFoundation) + 0x97
-[NSCarbonMenuImpl _destroyMenuRefIfNotCheckedOut] (in AppKit) + 0x104
-[NSCarbonMenuImpl _menuLostMainMenuStatus] (in AppKit) + 0x1ed
-[NSMenu _setMenuName:] (in AppKit) + 0x27b
-[NSApplication setMainMenu:] (in AppKit) + 0x15e
-[NSMenu _setMenuName:] (in AppKit) + 0x40a
nsMenuBarX::Paint() (in XUL) + 0x8d
-[WindowDelegate windowDidResignMain:] (in XUL) + 0x51
__CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ (in CoreFoundation) + 0x89
___CFXRegistrationPost_block_invoke (in CoreFoundation) + 0x58
_CFXRegistrationPost (in CoreFoundation) + 0x218
_CFXNotificationPost (in CoreFoundation) + 0x2df
-[NSNotificationCenter postNotificationName:object:userInfo:] (in Foundation) + 0x52
-[NSWindow _changeKeyAndMainLimitedOK:] (in AppKit) + 0x413
-[NSWindow _makeKeyRegardlessOfVisibility] (in AppKit) + 0x4c
-[NSWindow makeKeyAndOrderFront:] (in AppKit) + 0x1b
__CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ (in CoreFoundation) + 0x89
___CFXRegistrationPost_block_invoke (in CoreFoundation) + 0x58
_CFXRegistrationPost (in CoreFoundation) + 0x218
_CFXNotificationPost (in CoreFoundation) + 0x2df
-[NSNotificationCenter postNotificationName:object:userInfo:] (in Foundation) + 0x52
activeDisplayNotificationHandler (in AppKit) + 0x74
(anonymous namespace)::notify_datagram_handler(unsigned int, CGSDatagramType, void*, unsigned long, void*) (in SkyLight) + 0x406
CGSDatagramReadStream::dispatchMainQueueDatagrams() (in SkyLight) + 0xca
invocation function for block in CGSDatagramReadStream::mainQueueWakeup() (in SkyLight) + 0x12
_dispatch_call_block_and_release (in libdispatch.dylib) + 0xc
_dispatch_client_callout (in libdispatch.dylib) + 0x8
_dispatch_main_queue_drain (in libdispatch.dylib) + 0x3b8
_dispatch_main_queue_callback_4CF (in libdispatch.dylib) + 0x1f
__CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ (in CoreFoundation) + 0x9
__CFRunLoopRun (in CoreFoundation) + 0x996
CFRunLoopRunSpecific (in CoreFoundation) + 0x230
RunCurrentEventLoopInMode (in HIToolbox) + 0x124
ReceiveNextEventCommon (in HIToolbox) + 0x2a7
_BlockUntilNextEventMatchingListInModeWithFilter (in HIToolbox) + 0x46
_DPSNextEvent (in AppKit) + 0x38d
-[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (in AppKit) + 0x4c3
-[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (in XUL) + 0x92
_NSHLTBMenuEventProc (in AppKit) + 0xd5
IsUserStillTracking(MenuSelectData*, unsigned char*) (in HIToolbox) + 0xc6
TrackMenuCommon(MenuSelectData&, unsigned char*, SelectionData*, MenuResult*, MenuResult*) (in HIToolbox) + 0x629
MenuSelectCore(MenuData*, Point, double, unsigned int, OpaqueMenuRef**, unsigned short*) (in HIToolbox) + 0x18d
_HandleMenuSelection2 (in HIToolbox) + 0x1c8
_NSHandleCarbonMenuEvent (in AppKit) + 0xd7
_DPSEventHandledByCarbon (in AppKit) + 0x36
-[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (in AppKit) + 0xb6e
-[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (in XUL) + 0x92
-[NSApplication run] (in AppKit) + 0x24a
nsAppShell::Run() (in XUL) + 0xb1
nsAppStartup::Run() (in XUL) + 0x3c
XREMain::XRE_mainRun() (in XUL) + 0x934
XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) (in XUL) + 0x366
XRE_main(int, char**, mozilla::BootstrapConfig const&) (in XUL) + 0x47
main (in firefox) + 0x225
Severity: -- → S3
Flags: needinfo?(spohl.mozilla.bugs)
Priority: -- → P3
Status: RESOLVED → REOPENED
Ever confirmed: true
Resolution: FIXED → ---
Keywords: regression

The bug is linked to a topcrash signature, which matches the following criterion:

  • Top 5 desktop browser crashes on Mac on release (startup)

:spohl, could you consider increasing the severity of this top-crash bug?

For more information, please visit auto_nag documentation.

Flags: needinfo?(spohl.mozilla.bugs)
Keywords: topcrash, topcrash-startup

I haven't had a chance to verify that these are all the same crashes (i.e. identical or similar call stack). I'll increase the severity once verified.

Flags: needinfo?(spohl.mozilla.bugs)

(In reply to Sam Johnson from comment #4)

@spohl I do not believe this crash is a regression from bug 1642138. I was able to reproduce this after the backout, and I can also reproduce it with the updated patch from bug 1642138.

Sort of the same conclusion as bug 1765391 comment 5

(In reply to Release mgmt bot [:suhaib / :marco/ :calixte] from comment #7)

The bug is linked to a topcrash signature, which matches the following criterion:

  • Top 5 desktop browser crashes on Mac on release (startup)

Is nag incorrect?

https://crash-stats.mozilla.org/topcrashers/?product=Firefox&version=106.0.5&_facets_size=200 it currently only ranks approximately #12 in Mac crashes

And the long term graph for Firefox suggests the crash rate it rather steady https://crash-stats.mozilla.org/signature/?product=Firefox&signature=nsMenuBarX%3A%3APaint&date=%3E%3D2022-08-20T16%3A19%3A00.000Z&date=%3C2022-11-20T16%3A19%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_columns=startup_crash&_sort=-date&page=1#graphs. (similar long term graph for Thunderbird.

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit auto_nag documentation.

Keywords: topcrash, topcrash-startup

bp-72046647-ecd3-459e-810a-5c8380221213 Thunderbird example

Whiteboard: [tbird crash]
See Also: → 1765391

(In reply to Release mgmt bot [:suhaib / :marco/ :calixte] from comment #11)

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

It is however the #1 startup crash for Mac + Thunderbird

Keywords: crash

These are Japanese startup crashes:

Not a startup crash - Thunderbird bp-da6c1824-4d10-4683-aa58-a53e10230505 "owl installed and clicked in the menu"

bp-1c848f7e-878b-40d0-a101-d0ad90230920 mentions dragging tabs to new window

You need to log in before you can comment on or make changes to this bug.