Open Bug 1899823 Opened 2 years ago Updated 1 month ago

Crashes with Apple's SpeechSynthesis framework's BabelFish class on stack

Categories

(Core :: Web Speech, defect)

x86_64
macOS
defect

Tracking

()

Tracking Status
firefox-esr115 --- wontfix
firefox-esr128 --- affected
firefox132 --- wontfix
firefox133 --- wontfix
firefox134 --- affected

People

(Reporter: smichaud, Unassigned, NeedInfo)

Details

Crash Data

Attachments

(1 file)

These are almost entirely on macOS 14, on Intel Macs, and have increased dramatically with the most recent release -- 14.5. They're presumably an Apple bug.

Their signature, unfortunately, is shared with many other unrelated bugs. Here's how to search for this bug's crashes:

https://crash-stats.mozilla.org/search/?proto_signature=~BabelFish&platform=Mac%20OS%20X&date=%3E%3D2024-05-16T16%3A41%3A00.000Z&date=%3C2024-05-30T16%3A41%3A00.000Z&_facets=signature&_facets=proto_signature&_facets=platform_version&_facets=cpu_arch&_facets=address&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform_version#facet-platform_version

Typical crash stack:

Crashing Thread (110), Name: SpeechWorker
Frame  Module  Signature  Source  Trust
0  XUL  CrashReporter::TerminateHandler()  toolkit/crashreporter/nsExceptionHandler.cpp:1880  context
1  libc++abi.dylib  std::__terminate(void (*)())   cfi
2  libc++abi.dylib  std::terminate()   cfi
3  libobjc.A.dylib  objc_terminate   cfi
4  libdispatch.dylib  _dispatch_client_callout   cfi
5  libdispatch.dylib  _dispatch_lane_barrier_sync_invoke_and_complete   cfi
6  SpeechSynthesis  -[BabelFish allVoices]   cfi
7  SpeechSynthesis  BFCountVoices(short*)   cfi
8  AppKit  +[NSSpeechSynthesizer availableVoices]   cfi
9  XUL  mozilla::dom::EnumVoicesRunnable::Run()  dom/media/webspeech/synth/cocoa/OSXSpeechSynthesizerService.mm:282  cfi
10  XUL  nsThread::ProcessNextEvent(bool, bool*)  xpcom/threads/nsThread.cpp:1193  inlined
10  XUL  NS_ProcessNextEvent(nsIThread*, bool)  xpcom/threads/nsThreadUtils.cpp:480  cfi
11  XUL  mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)  ipc/glue/MessagePump.cpp:300  cfi
12  XUL  MessageLoop::RunInternal()  ipc/chromium/src/base/message_loop.cc:370  inlined
12  XUL  MessageLoop::RunHandler()  ipc/chromium/src/base/message_loop.cc:363  inlined
12  XUL  MessageLoop::Run()  ipc/chromium/src/base/message_loop.cc:345  cfi
13  XUL  nsThread::ThreadFunc(void*)  xpcom/threads/nsThread.cpp:370  cfi
14  libnss3.dylib  _pt_root  nsprpub/pr/src/pthreads/ptthread.c:201  cfi
15  libsystem_pthread.dylib  _pthread_start   cfi
16  libsystem_pthread.dylib  thread_start   cfi

Someone from Mozilla should probably report this bug to Apple.

The bug is linked to a topcrash signature, which matches the following criterion:

  • Top 5 desktop browser crashes on Mac on release

For more information, please visit BugBot documentation.

Keywords: topcrash

For what it's worth, I've found a way to exercise the code that crashes, but not to make it crash:

https://web-api-examples.github.io/speech.html

In this example, add some text under "Demo - Text to Speech", then click "Tap to Speak".

(In reply to Steven Michaud [:smichaud] (Retired) from comment #1)

Someone from Mozilla should probably report this bug to Apple.

Thanks, Steven. I'll get this filed with Apple.

I've filed FB13814516 and have alerted our Apple contact.

These crashes still happen on macOS 14.6 and up, but their numbers are much reduced. Tentatively, I'm going to call this bug fixed.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Crash Signature: [@ _dispatch_client_callout ] → [@ _dispatch_client_callout ] [@ -[BabelFish allVoices] ]
Crash Signature: [@ _dispatch_client_callout ] [@ -[BabelFish allVoices] ] → [@ _dispatch_client_callout ] [@ -[BabelFish allVoices] ] [@ pthread_kill | abort | abort_report_np | libMobileGestaltLibrary ]

But there are still a lot of these crashes on macOS 14.6 and up -- 117 over the last week. So I'm going to reopen this again :-(

Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Status: REOPENED → NEW

For what it's worth, this bug also effects Safari, and there's a workaround:

https://discussions.apple.com/thread/255655882

Status: NEW → RESOLVED
Closed: 2 years ago → 1 year ago
Resolution: --- → FIXED
Assignee: nobody → bwerth
Target Milestone: --- → 133 Branch
Status: RESOLVED → REOPENED
No longer depends on: 1880582
Resolution: FIXED → ---
Status: REOPENED → NEW

I'm not actively working on this. Taking myself off the Bug.

Assignee: bwerth → nobody
Target Milestone: 133 Branch → ---

Based on the topcrash criteria, the crash signatures linked to this bug are not in the topcrash signatures anymore.

For more information, please visit BugBot documentation.

Keywords: topcrash

The severity field is not set for this bug.
:padenot, could you have a look please?

For more information, please visit BugBot documentation.

Flags: needinfo?(padenot)

Eitan, can you check this one?

Flags: needinfo?(padenot) → needinfo?(eitan)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: