1884624 - [macOS 14] Crash in [@ __CFCheckCFInfoPACSignature] and [@ _CFAssertMismatchedTypeID] on 124 branch and up

Status: RESOLVED FIXED

(Core :: Widget: Cocoa, defect, P3)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/501c92b7-6cc5-45a7-8231-d8ee40240307

Reason: EXC_BREAKPOINT / EXC_ARM_BREAKPOINT

Top 10 frames of crashing thread:

0  CoreFoundation  __CFCheckCFInfoPACSignature  
1  CoreFoundation  CFRunLoopObserverInvalidate  
2  AppKit  -[NSWindow _cancelPerformSelectors]  
3  AppKit  -[NSWindow dealloc]  
4  XUL  -[BaseWindow dealloc]  widget/cocoa/nsCocoaWindow.mm:3571
5  XUL  -[ToolbarWindow dealloc]  widget/cocoa/nsCocoaWindow.mm:4085
6  Foundation  _NSKVOPerformWithDeallocatingObservable  
7  Foundation  NSKVODeallocate  
8  libdispatch.dylib  _dispatch_client_callout  
9  libdispatch.dylib  _dispatch_main_queue_drain  

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-02-02
• Process type: Parent
• Is startup crash: No
• Has user comments: No
• Is null crash: No

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Widget: Cocoa' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Steven Michaud [:smichaud] (Retired)]

These crashes are all on macOS 14 -- so ultimately they're (probably) caused by one or more macOS bugs. But they're much more likely to happen on the Mozilla 124 branch and up -- so something must have changed in Mozilla code to make them more likely.

"KVO" stands for "key-value observing" -- for observing when a value changes without having to use delegates. This feature has been around for a while -- it's not new in macOS 14. And as best I can tell Mozilla code doesn't use it directly.

Another bug (unfortunately security sensitive) is also macOS 14 only and much more frequent on the 124 branch and up. So the two may be related.

https://crash-stats.mozilla.org/search/?proto_signature=~__CFCheckCFInfoPACSignature&platform=Mac%20OS%20X&date=%3E%3D2024-03-11T16%3A03%3A00.000Z&date=%3C2024-03-25T16%3A03%3A00.000Z&_facets=signature&_facets=platform_version&_facets=cpu_arch&_facets=proto_signature&_facets=version&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-platform_version

Comment 3

[Steven Michaud [:smichaud] (Retired)]

And as best I can tell Mozilla code doesn't use it directly.

Not true. Search at searchfox.org on "addObserver:".

Comment 4

[Steven Michaud [:smichaud] (Retired)]

There are almost none of these on the 125 branch (currently in beta) and up. But let's see if that persists after the FF 125 release. Edit: Yes, it has.

Comment 5

[Joel Maher ( :jmaher ) (UTC -8)]

trying to add more CI to macosx 14.x I run into this crash often:
https://treeherder.mozilla.org/jobs?repo=try&tier=1%2C2%2C3&revision=3d26f0f3e31d4c8cbb1b3268b71c60d792fa317f

this is on the m2 chipset (aarch64). It could be something I need to adjust in the build, test harness, toolchains, os setup, etc.

Given this is the same machine setup and build we run perf tests on for macosx 14.x, I would assume things are for the most part setup correctly.

Comment 6

[Steven Michaud [:smichaud] (Retired)]

These are still happening mostly on macOS 14. Though there are also a few on macOS 15.

They are now half and half amd64 (signature _CFAssertMismatchedTypeID) and arm64 (signature __CFCheckCFInfoPACSignature).

Comment 7

[Steven Michaud [:smichaud] (Retired)]

Many of these crashes have the following mac crash info (or something very close to it):

{
  "num_records": 1,
  "records": [
    {
      "abort_cause": null,
      "backtrace": null,
      "dialog_mode": null,
      "message": "Expected typeID 45 (CFRunLoopObserver) does not match actual typeID 381 (<unknown>)",
      "message2": null,
      "module": "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation",
      "signature_string": null,
      "thread": null
    }
  ]
}

And here's a fuller (and much more informative) crash stack:

0  CoreFoundation  _CFAssertMismatchedTypeID   context
1  CoreFoundation  CFRunLoopObserverInvalidate   cfi
2  AppKit  -[NSWindow _cancelPerformSelectors]   cfi
3  AppKit  -[NSWindow dealloc]   cfi
4  XUL  -[BaseWindow dealloc]  widget/cocoa/nsCocoaWindow.mm:3283  cfi
5  XUL  -[ToolbarWindow dealloc]  widget/cocoa/nsCocoaWindow.mm:3747  cfi
6  Foundation  _NSKVOPerformWithDeallocatingObservable   cfi
7  Foundation  NSKVODeallocate   cfi
8  libdispatch.dylib  _dispatch_client_callout   cfi
9  libdispatch.dylib  _dispatch_main_queue_drain   cfi
10  libdispatch.dylib  _dispatch_main_queue_callback_4CF   cfi
11  CoreFoundation  __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__   cfi
12  CoreFoundation  __CFRunLoopRun   cfi
13  CoreFoundation  CFRunLoopRunSpecific   cfi
14  HIToolbox  RunCurrentEventLoopInMode   cfi
15  HIToolbox  ReceiveNextEventCommon   cfi
16  HIToolbox  _BlockUntilNextEventMatchingListInModeWithFilter   cfi
17  AppKit  _DPSNextEvent   cfi
18  AppKit  -[NSApplication(NSEventRouting) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]   cfi
19  XUL  -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:]  widget/cocoa/nsAppShell.mm:189  cfi
20  AppKit  -[NSApplication run]   cfi
21  XUL  -[GeckoNSApplication run]  widget/cocoa/nsAppShell.mm:173  cfi
22  XUL  nsAppShell::Run()  widget/cocoa/nsAppShell.mm:864  cfi
23  XUL  nsAppStartup::Run()  toolkit/components/startup/nsAppStartup.cpp:295  cfi
24  XUL  XREMain::XRE_mainRun()  toolkit/xre/nsAppRunner.cpp:5807  cfi
25  XUL  XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)  toolkit/xre/nsAppRunner.cpp:6036  cfi
26  XUL  XRE_main(int, char**, mozilla::BootstrapConfig const&)  toolkit/xre/nsAppRunner.cpp:6108  cfi
27  firefox  do_main(int, char**, char**)  browser/app/nsBrowserApp.cpp:233  inlined
27  firefox  main  browser/app/nsBrowserApp.cpp:470  cfi
28  dyld  start   cfi

Comment 8

[Steven Michaud [:smichaud] (Retired)]

How to search for this bug's crashes:

https://crash-stats.mozilla.org/search/?proto_signature=~__CFCheckCFInfoPACSignature&proto_signature=~_CFAssertMismatchedTypeID&platform=Mac%20OS%20X&date=%3E%3D2024-09-25T14%3A08%3A00.000Z&date=%3C2024-10-25T14%3A08%3A00.000Z&_facets=signature&_facets=platform_version&_facets=cpu_arch&_facets=proto_signature&_facets=version&_facets=mac_crash_info&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform_version&_columns=cpu_arch#facet-mac_crash_info

Comment 9

[Steven Michaud [:smichaud] (Retired)]

As best I can tell, these crashes are "fixed" (worked around) by the latest patch for bug 1880582.

Comment 10

[Steven Michaud [:smichaud] (Retired)]

Here's how to search for this bug's crashes in distros that have bug 1880582's latest patch. As of right now there still aren't any. I don't expect that to change, but just to be sure:

https://crash-stats.mozilla.org/search/?proto_signature=~__CFCheckCFInfoPACSignature&proto_signature=~_CFAssertMismatchedTypeID&build_id=%3E%3D20241024094434&release_channel=nightly&release_channel=beta&release_channel=aurora&modules_in_stack=%21~hook.dylib&version=133.0b&version=133.0a1&version=134.0a1&platform=Mac%20OS%20X&date=%3E%3D2024-10-07T22%3A13%3A00.000Z&date=%3C2024-11-07T22%3A13%3A00.000Z&_facets=signature&_facets=platform_version&_facets=cpu_arch&_facets=proto_signature&_facets=version&_facets=mac_crash_info&page=1&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform_version&_columns=cpu_arch#crash-reports