673456 - [10.7] crash [@ libobjc.A.dylib@0xb390]

Status: RESOLVED DUPLICATE of bug 678607

(Firefox :: General, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-97dbd972-828a-445a-a30f-987232110721 .
============================================================= 

10.7 specific crash that has moved up to the #2 10.7 crash. https://crash-stats.mozilla.com/report/list?signature=libobjc.A.dylib@0xb390 and seen across all versions.

Comments include:

"Happened when opening ETrade web site using 1Password shortcut that performs auto login"

"Bombed while editing Google Docs

Comment 1

[Scoobidiver (away)]

It's #1 top browser crasher in 7.0b1.

Comment 2

[Steven Michaud [:smichaud] (Retired)]

This seems to be at least two different bugs.

But most of the crashes (particularly those in FF 7 beta1) seem to belong to bug 678607 ... whose fix landed on the trunk on 8-18, two days after beta1 was created :-(

More in a later comment.

Comment 3

[Steven Michaud [:smichaud] (Retired)]

At least some of these crashes in FF 6 and earlier are in font code:

bp-b82099f6-f4d4-4090-bb4a-b5e5d2110822
bp-7a02a515-73c6-4d10-9b2e-2c9252110822
bp-0fceebc5-7aa3-4fa3-9a4d-351ee2110823
bp-92f2f5ec-d4d6-495b-925c-40a492110823
bp-19db2504-5449-4987-9b34-4c5ec2110823
bp-cd6d3a7c-1490-4b62-9f5b-08a312110822

All of these are in FF 5 and earlier, and they look very much like crashes from bug 663688 (an Apple bug in 10.7 font code).  Workarounds of one kind or another have been on the trunk (mozilla-central) since 2011-06-20 -- which would explain why we don't see any of these in FF 6.

So the evidence strongly suggests that these crashes are from a bug that's already been fixed (or more properly worked around).

Though of course these crashes are only a small minority of those which share this bug's signature ... which I strongly suspect will turn out to be in CFRelease().  *Many* different kinds of bugs lead to crashes in CFRelease().

Comment 4

[Steven Michaud [:smichaud] (Retired)]

> Workarounds of one kind or another have been on the trunk
> (mozilla-central) since 2011-06-20 -- which would explain why we
> don't see any of these in FF 6.

Actually, bug 663688 has been fixed in releases since FF 5.0.1.

Comment 5

[Steven Michaud [:smichaud] (Retired)]

Most of the crash stacks for this bug currently look like this (with a few variations):

0  libobjc.A.dylib  libobjc.A.dylib@0xb390 	
1  CoreFoundation   CoreFoundation@0x87ff 	
2  CoreFoundation   CoreFoundation@0x30d1f 	
3  libobjc.A.dylib  libobjc.A.dylib@0xd2c5 	
4  libobjc.A.dylib  libobjc.A.dylib@0xd4f8 	
5  libobjc.A.dylib  libobjc.A.dylib@0xf03b 	
6  AppKit           AppKit@0x8c485d 	
7  AppKit           AppKit@0x6c221 	
8  AppKit           AppKit@0x6ceef 	
9  AppKit           AppKit@0x6d938 	
10 libobjc.A.dylib  libobjc.A.dylib@0xd2c5 	
11 libobjc.A.dylib  libobjc.A.dylib@0xd254 	
12 CoreFoundation   CoreFoundation@0x30738 	
13 AppKit           AppKit@0x6d55b 	
14 AppKit           AppKit@0x8e04

objc_msgSend_vtable14 (in libobjc.A.dylib) + 16
CFRelease (in CoreFoundation) + 175
-[__NSArrayM dealloc] (in CoreFoundation) + 303
objc::DenseMap<objc_object*, unsigned long, true, objc::DenseMapInfo<objc_object*>, objc::DenseMapInfo<unsigned long> >::FindAndConstruct(objc_object* const&) (in libobjc.A.dylib) + 75
_objc_rootReleaseWasZero (in libobjc.A.dylib) + 188
(anonymous namespace)::AutoreleasePoolPage::pop(void*) (in libobjc.A.dylib) + 433
0x008c485d (in AppKit)
-[NSApplication(NSWindowCache) _findWindowUsingCache:] (in AppKit) + 251
_NSPopoverPreProcessLocalEvent (in AppKit) + 46
-[NSApplication sendEvent:] (in AppKit) + 64
objc::DenseMap<objc_object*, unsigned long, true, objc::DenseMapInfo<objc_object*>, objc::DenseMapInfo<unsigned long> >::FindAndConstruct(objc_object* const&) (in libobjc.A.dylib) + 75
_objc_rootRetain (in libobjc.A.dylib) + 107
-[NSObject retain] (in CoreFoundation) + 40
-[NSApplication sendEvent:] (in AppKit) + 701
-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (in AppKit) + 1014

This is definitely bug 678607.

So (as best I can tell), to the extent that this bug represents a topcrasher, it's a dup of bug 678607.