745579 - Intermittent shutdown crash [@ CoreFoundation + 0x580b6] [@ nsMenuBarX::Paint]

Status: RESOLVED WORKSFORME

(Core :: Widget: Cocoa, defect)

Description

[Phil Ringnalda (:philor)]

https://tbpl.mozilla.org/php/getParsedLog.php?id=10925019&tree=Mozilla-Inbound
Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test jsreftest on 2012-04-15 17:22:18 PDT for push 1b19214a0a50

REFTEST TEST-START | Shutdown
TEST-UNEXPECTED-FAIL | Shutdown | Exited with code 2 during test run
INFO | automation.py | Application ran for: 0:12:13.705268
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpr_4A0ypidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-macosx64-debug/1334533453/firefox-14.0a1.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | Shutdown | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpGLVyT4/minidumps/19A648F6-D756-4B8A-BACC-54FE08E59107.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_INSTRUCTION / 0x00000001
Crash address: 0x7fff80a0b0b6

Thread 0 (crashed)
 0  CoreFoundation + 0x580b6
    rbx = 0x00000001   r12 = 0x001249d0   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x5fbf7d20   rip = 0x80a0b0b6   rsp = 0x5fbf7d20   rbp = 0x5fbf7e80
    Found by: given as instruction pointer in context
 1  CoreFoundation + 0x58284
    rip = 0x80a0b285   rsp = 0x5fbf7d40
    Found by: stack scanning
 2  AppKit + 0x742a67
    rip = 0x84ff1a68   rsp = 0x5fbf7d60
    Found by: stack scanning
 3  libSystem.B.dylib + 0x6153
    rip = 0x86c68154   rsp = 0x5fbf7dd8
    Found by: stack scanning
 4  CoreFoundation + 0x6621
    rip = 0x809b9622   rsp = 0x5fbf7de0
    Found by: stack scanning
 5  CoreFoundation + 0x22793
    rip = 0x809d5794   rsp = 0x5fbf7e10
    Found by: stack scanning
 6  CoreFoundation + 0x55d59
    rip = 0x80a08d5a   rsp = 0x5fbf7e30
    Found by: stack scanning
 7  AppKit + 0x157ed
    rip = 0x848c47ee   rsp = 0x5fbf7e90
    Found by: stack scanning
 8  XUL!nsMenuBarX::Paint [nsMenuBarX.mm : 392 + 0x10]
    rip = 0x03170011   rsp = 0x5fbf7ee0
    Found by: stack scanning
 9  XUL!-[WindowDelegate windowDidResignMain:] [nsCocoaWindow.mm : 2011 + 0x7]
    rip = 0x0319395e   rsp = 0x5fbf7f10
    Found by: stack scanning
10  Foundation + 0x10bc4
    rip = 0x83886bc5   rsp = 0x5fbf7f30
    Found by: stack scanning
11  CoreFoundation + 0xe8cf
    rip = 0x809c18d0   rsp = 0x5fbf7f50
    Found by: stack scanning
12  CoreFoundation + 0x58fff
    rip = 0x80a0c000   rsp = 0x5fbf7f90

Comment 1

[Steven Michaud [:smichaud] (Retired)]

The top two levels of comment #0's stack are in +[NSDictionary dictionaryWithObjectAndKeys:].

At https://crash-stats.mozilla.com I couldn't find any crashes corresponding to either NSDictionary or to either CoreFoundation@0x580b6 or CoreFoundation@0x58284.

So these crashes won't become "interesting" until they increase in volume or become reproducible.

Note, though, that the results I got from crash-stats showed signs of corruption: It listed 13 crashes in the last week matching "+[NSException raise:format:] | _NSDictionaryRaiseInsertNilValueException ".  But when I followed the link to look at individual examples of these crashes, I was told there are no reports matching these criteria.

So it'd be worthwhile looking at crash-stats again in a week or so.

Comment 2

[Steven Michaud [:smichaud] (Retired)]

These crashes, though they happen deep in system code, appear to be taking place at the following line:

http://hg.mozilla.org/mozilla-central/annotate/e080a936c899/widget/cocoa/nsMenuBarX.mm#l391

So they appear to happen while "retain"ing the first item in the main menu.  Which (probably) means that either that item or the entire menu is invalid.

Comment 3

[Steven Michaud [:smichaud] (Retired)]

(Following up comment #2)

Oops, I was wrong.

The crashes take place here:
http://hg.mozilla.org/mozilla-central/annotate/e080a936c899/widget/cocoa/nsMenuBarX.mm#l392

It still seems likely, though, that either the main menu's first item or the entire main menu is invalid.