351230 - crashes clicking on menubar while popup displayed (OS X 10.3 only) [@ FadeMenuWindows]

Status: VERIFIED FIXED

(Core Graveyard :: Widget: Mac, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Talkback is reporting a bunch of crashes in Firefox 2 builds at signature FadeMenuWindows.  Almost the entire stack is within system code, and they weren't fixed by bug 345388 (though this is an order of magnitude fewer crashes).  For example:

Incident ID: 22803251
Stack Signature	FadeMenuWindows() e426123a
Product ID	Firefox2
Build ID	2006090103
Trigger Time	2006-09-02 04:15:47.0
Platform	MacOSX
Operating System	Darwin 7.9.0
Module	HIToolbox.145.0.0 + (000a9b80)
URL visited	
User Comments	
Since Last Crash	13281 sec
Total Uptime	71002 sec
Trigger Reason	SIGBUS: Bus Error: (signal 10)
Source File, Line No.	N/A
Stack Trace 	
FadeMenuWindows()
FadeMenuWindows()
TrackMenuCommon()
MenuSelectCore()
MenuSelect()
HandleMouseEvent()
StandardMenuBarEventHandler()
DispatchEventToHandlers()
SendEventToEventTargetInternal()
SendEventToEventTarget()
HandleMouseEvent()
ToolboxEventDispatcherHandler()
DispatchEventToHandlers()
SendEventToEventTargetInternal()
SendEventToEventTarget()
ToolboxEventDispatcher()
HLTBEventDispatcher()
RunApplicationEventLoop()
nsAppShell::Run()  [mozilla/widget/src/mac/nsAppShell.cpp, line 94]
nsAppStartup::Run()  [mozilla/db/sqlite3/src/pragma.c, line 152]
XRE_main()  [mozilla/toolkit/xre/nsAppRunner.cpp, line 2440]
_start()   start()

All the ones I've looked at report OS as "Darwin 7.9.0".

See http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=FadeMenuWindows&vendor=MozillaOrg&product=Firefox2&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid for more details.

Comment 1

[Jean-Yves Perrier [:teoli]]

It seems to me that each time I get this crash I was trying to open a menu (bookmarks or history). Of course, that doesn't happen each time, but once every 4 to 8 hour...

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Haven't seen any reports of this on the 1.8 branch on builds since 2006-09-02-07.

Comment 3

[Marcia Knous [:marcia]]

I crashed in this stack today - TB23326646Z. using Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1) Gecko/20060915 BonEcho/2.0. Had feed preview open at the time and was operating in the menu area.

Comment 4

[Mark Mentovai]

10.3?

Maybe the icons in the bookmarks menu are causing problems on 10.3?  I haven't had any trouble on 10.4.

Comment 5

[Jean-Yves Perrier [:teoli]]

(In reply to comment #4)
> 10.3?
> 
> Maybe the icons in the bookmarks menu are causing problems on 10.3?  I haven't
> had any trouble on 10.4.
> 
For one week, I'm no more experiencing that problem anymore under 10.3 (and I really try to make it happens). That doesn't mean it isn't there anymore (Marcia's still experiencing it), but as I use the bookmarks menu all the time, I doubt it is the cause. 

Comment 6

[Jean-Yves Perrier [:teoli]]

I'm able to reproduce it 100% of the time with the latest branch nightly: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; fr-FR; rv:1.8.1) Gecko/20060916 BonEcho/2.0 ID:2006091607
(Mac OS X 10.3)

Reproduceable: Always
Steps:
1. Launch Firefox (even in safe-mode)
2. Visit http://www.mozilla.org (the site is not important, it is to fill the history)
3. Go to the address bar, select all and type 'm'.
(The list of hints appears in a window under the Address bar)
4. Without closing that window, click on Bookmarks in the main menu: Firefox crashes immediately.

Comment 7

[Jean-Yves Perrier [:teoli]]

One more information: the bug (and the procedure) doesn't happen with the latest trunk. The bug may have been cured by Places.

Comment 8

[Jean-Yves Perrier [:teoli]]

Some more searches lead to the following:

The bug happens reliably each time a drop-down menu is displayed and we click on the menubar (except on the system apple or on the BonEcho entry).

It does not happen if we close the drop-down menu with ESC previously; but it does happen with the drop-down menu of the address bar, the search bar or of any form in a web page. It also happen with a drop-down menu from the preferences.

Comment 9

[Marcia Knous [:marcia]]

I am able to reproduce this as well following those steps, running 10.3.9 using the RC build - Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1) Gecko/20060918 Firefox/2.0.

(In reply to comment #6)
> I'm able to reproduce it 100% of the time with the latest branch nightly:
> Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; fr-FR; rv:1.8.1) Gecko/20060916
> BonEcho/2.0 ID:2006091607
> (Mac OS X 10.3)
> 
> Reproduceable: Always
> Steps:
> 1. Launch Firefox (even in safe-mode)
> 2. Visit http://www.mozilla.org (the site is not important, it is to fill the
> history)
> 3. Go to the address bar, select all and type 'm'.
> (The list of hints appears in a window under the Address bar)
> 4. Without closing that window, click on Bookmarks in the main menu: Firefox
> crashes immediately.
> 

Comment 10

[Marcia Knous [:marcia]]

I am not able to reproduce this on the Intel Mac - Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1) Gecko/20060918 Firefox/2.0 using the steps in Comment 6. I will try on a PPC mac running 10.4.x as well.

Comment 11

[Marcia Knous [:marcia]]

I am not able to reproduce this using 10.4.7 on a PPC mac running Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1) Gecko/20060918 Firefox/2.0, so I think this problem might be confined to 10.3.9.

Comment 12

[Mark Mentovai]

I've got a test build that bypasses menu item icons on 10.3, but I'm trying to find a place to put it.

Comment 13

[Marcia Knous [:marcia]]

I just hit this crash in Tbird as well: http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=TB24190066G

Comment 14

[Mark Mentovai]

Test build: http://jackassofalltrades.com/tmp/bonecho-20061002-351230.dmg

(ppc-only, menu item icons will be disabled on 10.3.)

Comment 15

[Jean-Yves Perrier [:teoli]]

Unfortunately, the crash still happen reliably with the test build.

Two questions:
1) Has anybody tested with Mac OS X 10.2 (I do believe that it still is in the list of OS supported by Fx 2) ? (I don't have one to test on)
2) Is it worth that I try to look for a regression window?

Comment 16

[Mark Mentovai]

OK, then I guess the icons didn't cause this.  (Unless I goofed the test build - confirm that the bookmarks menu didn't have any icons in it.)  Regression window would be helpful.

Comment 17

[Jean-Yves Perrier [:teoli]]

I confirm that the test release didn't display icons on Mac OS X 10.3. You didn't goofed, Mark ;-)

I found the regression window: 2006081503 has the regression, 2006081404 do not have it. (on the branch)

I looked at bonsai: http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&branch=MOZILLA_1_8_BRANCH&branchtype=match&date=explicit&mindate=2006-08-14+04%3A00&maxdate=2006-08-15+03%3A00

and a very good candidate for the regression cause is: bug 348341 that was corrected between the two.

Comment 18

[Jean-Yves Perrier [:teoli]]

Oups, bug 348371 and not bug 348341 as erroneously stated. Sorry

Comment 19

[Jean-Yves Perrier [:teoli]]

I'm also able to reproduce the crash on the latest Trunk. As there is no Talkback on it for MacOS X I cannot confirm that the stack is the same, but the steps to reproduce and the symptoms are the same.

As I wasn't able to get it there a few day earlier, I suppose that the removal from Places (by default) made it appears on it also.

The good news is that we will be able to validate a future patch on the Trunk before to bring it to the Branch.

And, as a side question, shouldn't the keyword 'regression' be added to that bug?

Comment 20

[Marcia Knous [:marcia]]

*** Bug 356979 has been marked as a duplicate of this bug. ***

Comment 21

[Adam Guthrie]

*** Bug 358230 has been marked as a duplicate of this bug. ***

Comment 22

[Adam Guthrie]

This is still (by a large number of crashes) the number one crash on Mac OS X for Firefox 2 (234 crashes with 224 unique users). I think this needs to be fixed for Firefox 2.0.0.1.

Comment 23

[Bill McGonigle (not currently reading bugmail; please contact directly)]

Attachment: CrashReporter log

Adding an attachment as this didn't trigger a Talkback - same symptoms, slightly different stack than a Talkback report I looked at.

Comment 24

[Bill McGonigle (not currently reading bugmail; please contact directly)]

*** Bug 357885 has been marked as a duplicate of this bug. ***

Comment 25

[Marcia Knous [:marcia]]

Seth and I discussed whether this happens with 1.5.0.8, and I can confirm that I was not able to reproduce this using Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.8) Gecko/20061023 Firefox/1.5.0.8 (1.5.0.8) candidate running 10.3.9.

Comment 26

[Mark Mentovai]

According to comment 18 and comment 19, this was caused between 2006081404 and 2006081503 on the 1.8 branch.  I would have to agree that bug 348371 seems like the likely trigger.

Comment 27

[Marcia Knous [:marcia]]

Josh - any ideas? The talkback count is growing, and since this affects both FF and Tbird users would be nice win to get this in for 1.8.1.1.

Comment 28

[Adam Guthrie]

We could just back out the patch for bug 348371. What's worse, a menu not closing or someone crashing?

Comment 29

[Asa Dotzler [:asa]]

We should always strive to fix the top crashers for each platform and as this is the top crasher for Mac, we should do our best to fix it for the next security and stability release. That it's a regression should also pressure us into trying to fix for the next security and stability release. 

If a fix cannot be made in time for the next security and stability release, then we should consider backing out the change at bug  34837.

Josh, can you please take a look at this ASAP and see what can be done? If not you, then who?

Comment 30

[Josh Aas]

I do not have access to a 10.3 machine, until I'm able to do something about this I would be fine with backing out the patch that triggers this.

Comment 31

[Daniel Veditz [:dveditz]]

Can we prepare a backout then?

Comment 32

[Josh Aas]

I'm on it, we can probably actually do better than a backout. We can just check the OS version and only call the crashy code if we're on Tiger or higher.

Comment 33

[Josh Aas]

Attachment: fix v1.0

This is better than a backout so long as it fixes the problem on 10.3 (I can't test). It leaves full functionality on Tiger, and stops the crash prior to Tiger.

I don't know if returning userCanceledErr is crashing or the popup rollup code, I'm guessing returning userCanceledErr. If its the popup rollup then this will still work with one minor tweak.

Comment 34

[Mark Mentovai]

Comment on attachment 245304 [details] [diff] [review]
fix v1.0

>Index: nsMenuX.cpp

>+PRBool OnTigerOrLater() // Return true if we are on Mac OS X 10.3 or later

This function should be declared static.

The comment should be fixed.

>+{
>+  static PRBool gInitVer1040 = PR_FALSE;
>+  static PRBool gOnTigerOrLater = PR_FALSE;
>+  if (!gInitVer1040) {
>+    gOnTigerOrLater = (nsToolkit::OSXVersion() >= MAC_OS_X_VERSION_10_4_HEX);
>+    gInitVer1040 = PR_TRUE;
>+  }
>+  return gOnTigerOrLater;
>+}

I'd rename the "g" variables to "s" because they're not globals.  (I know the code was taken from elsewhere, but there's no sense in perpetuating the bad habit.)

Other than that, this looks OK.

I would also support consolidating all of the current independent OnPanterOrLater and OnTigerOrLater implementations in nsToolkit.

Comment 35

[Adam Guthrie]

Why not just call nsToolkit::OSXVersion in the if statement? Or is that function expensive enough that we need to cache it?

Comment 36

[Josh Aas]

Attachment: branch fix v1.0.1

I tested this on a QA machine and it seems to work fine. Also addresses Mark's review comments.

Comment 37

[Stuart Parmenter]

Comment on attachment 245639 [details] [diff] [review]
branch fix v1.0.1

i'm with adam here -- i don't really see any reason to add a new function here just for one call site.  nsToolkit::OSXVersion is already cached so calling it should be roughly just as cheap without adding more code.

Comment 38

[Josh Aas]

Attachment: fix v1.1

Comment 39

[Daniel Veditz [:dveditz]]

Comment on attachment 246694 [details] [diff] [review]
fix v1.1

approved for 1.8 branch, a=dveditz for drivers

Comment 40

[Josh Aas]

landed on ff2 branch and trunk, somebody with 10.3 please confirm the fix in ff2 nightly builds

Comment 41

[Jay Patel [:jay]]

Marcia or teoli2003:  Can you please try a recent 1.8.1 nightly build (11/28 or newer) on Mac PPC 10.3 and verify this fix?  Is the crash gone for you now?  Please replace "fixed1.8.1.1" with "verified1.8.1.1" keyword if things look good.  Thanks!

Comment 42

[HARUNAGA Hirotoshi]

branch-20061128 doesn't crash but trunk-20061128 still crashes on OS 10.3.9.

Comment 43

[Hiro]

(In reply to comment #42)
> branch-20061128 doesn't crash but trunk-20061128 still crashes on OS 10.3.9.
> 
Similarly, it crashes. 

Talkback ID: TB26655380Z

Mac OS X 10.3.9
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20061129 Minefield/3.0a1

Comment 44

[Josh Aas]

Hiro - what kind of trunk build were you using? Default trunk builds are cocoa-cairo, were you building with carbon widgets (mac)?

Comment 45

[HARUNAGA Hirotoshi]

Attachment: crash log on trunk

I'm using firefox-3.0a1.en-US.mac.dmg on
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/ 
although I'm not Hiro.

Comment 46

[Hiro]

(In reply to comment #44)
> Hiro - what kind of trunk build were you using? Default trunk builds are
> cocoa-cairo, were you building with carbon widgets (mac)?
> 

It is build of same trunk as HARUNAGA-san. 
(It is Cocoa+Cairo. )

Comment 47

[Josh Aas]

I forgot that the cocoa code also has the code that 10.3 doesn't like. Will check in the fix soon.

Comment 48

[Josh Aas]

Attachment: cocoa fix v1.0

Comment 49

[Josh Aas]

cocoa fix landed on trunk, please confirm the fix on 10.3

Comment 50

[Hiro]

The problem is repaired.

Mac OS X 10.3.9
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20061130 Minefield/3.0a1

Comment 51

[HARUNAGA Hirotoshi]

v.

Comment 52

[Marcia Knous [:marcia]]

verified using Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.1pre) Gecko/20061201 BonEcho/2.0.0.1pre. No crash. Yay. 

Comment 53

[Adam Guthrie]

*** Bug 362684 has been marked as a duplicate of this bug. ***