Open Bug 1602352 Opened 5 years ago Updated 3 years ago

Crash in [@ -[NSApplication _crashOnException:] | __62+[CATransaction NS_setFlushesWithDisplayLink]_block_invoke]

Categories

(Core :: Widget: Cocoa, defect, P2)

x86_64
macOS
defect

Tracking

()

ASSIGNED
Tracking Status
firefox-esr68 --- unaffected
firefox71 --- unaffected
firefox72 --- fixed
firefox73 --- fixed
firefox74 --- fixed
firefox75 --- fixed

People

(Reporter: gsvelto, Assigned: mstange)

References

Details

(Keywords: crash, regression)

Crash Data

This bug is for crash report bp-b28ee147-160d-406b-86a8-ce7cd0191208.

Top 10 frames of crashing thread:

0 AppKit -[NSApplication _crashOnException:] 
1 AppKit __62+[CATransaction NS_setFlushesWithDisplayLink]_block_invoke 
2 AppKit ___NSRunLoopObserverCreateWithHandler_block_invoke 
3 CoreFoundation __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ 
4 CoreFoundation __CFRunLoopDoObservers 
5 CoreFoundation __CFRunLoopRun 
6 CoreFoundation CFRunLoopRunSpecific 
7 HIToolbox RunCurrentEventLoopInMode 
8 HIToolbox ReceiveNextEventCommon 
9 HIToolbox _BlockUntilNextEventMatchingListInModeWithFilter 

This seems to have started with version 72.

I found a similar stack but I'm not sure if they're related.

Keywords: regression
Flags: needinfo?(mstange)
Priority: -- → P2
Crash Signature: [@ -[NSApplication _crashOnException:] | __62+[CATransaction NS_setFlushesWithDisplayLink]_block_invoke] → [@ -[NSApplication _crashOnException:] | __62+[CATransaction NS_setFlushesWithDisplayLink]_block_invoke] [@ -[NSApplication _crashOnException:] | __65+[CATransaction NS_setFlushesWithDisplayRefresh]_block_invoke ]

Since this is starting with 72, I think it's likely that it was somehow caused by bug 1592739. That bug has now been backed out of 72 because it caused other regressions and crashes, too.
These crashes would be much more helpful if they contained the Objective C exception message, similar to bug 1579688.

Assignee: nobody → mstange
Status: NEW → ASSIGNED
Flags: needinfo?(mstange)

This crash is happening in automation as well, bug 1595523.

Blocks: 1595523

:mstange, do you have any update on this? This bug is tracked for FF74. Thank you!

Flags: needinfo?(mstange)

the underlying regressing bug 1592739 got backed out from beta and mozilla-central again, so we are good here for now (no crashes in 74.0b3 and later).

Flags: needinfo?(mstange)
Crash Signature: [@ -[NSApplication _crashOnException:] | __62+[CATransaction NS_setFlushesWithDisplayLink]_block_invoke] [@ -[NSApplication _crashOnException:] | __65+[CATransaction NS_setFlushesWithDisplayRefresh]_block_invoke ] → [@ -[NSApplication _crashOnException:] | __62+[CATransaction NS_setFlushesWithDisplayLink]_block_invoke] [@ -[NSApplication _crashOnException:] | __65+[CATransaction NS_setFlushesWithDisplayRefresh]_block_invoke ] [@ -]
Severity: normal → S3
Crash Signature: [@ -[NSApplication _crashOnException:] | __62+[CATransaction NS_setFlushesWithDisplayLink]_block_invoke] [@ -[NSApplication _crashOnException:] | __65+[CATransaction NS_setFlushesWithDisplayRefresh]_block_invoke ] [@ -] → [@ -[NSApplication _crashOnException:] | __62+[CATransaction NS_setFlushesWithDisplayLink]_block_invoke] [@ -[NSApplication _crashOnException:] | __65+[CATransaction NS_setFlushesWithDisplayRefresh]_block_invoke ] [@ -]

These are still happening in low numbers. Many of them have "app notes" or "mac crash info" with the following error message:

    -[CALayer enqueueSampleBuffer:]: unrecognized selector sent to instance

enqueueSampleBuffer: is a method of the AVSampleBufferDisplayLayer class (a subclass of CALayer), defined in the AVFoundation framework. It's used directly from Mozilla code.

My guess is that the original AVSampleBufferDisplayLayer object has been deleted and replaced by an ordinary CALayer object.

Mac crash info from a recent crash report:

    {
      "num_records": 1,
      "records": [
        {
          "backtrace": "0   CoreFoundation                      0x00007fff204e283b __exceptionPreprocess + 242
    1   libobjc.A.dylib                     0x00007fff2021ad92 objc_exception_throw + 48
    2   CoreFoundation                      0x00007fff2056534d -[NSObject(NSObject) __retain_OA] + 0
    3   CoreFoundation                      0x00007fff2044a8cb ___forwarding___ + 1448
    4   CoreFoundation                      0x00007fff2044a298 _CF_forwarding_prep_0 + 120
    5   XUL                                 0x0000000116d33403 _ZN7mozilla6layers13NativeLayerCA14Representation14EnqueueSurfaceEP11__IOSurface + 259
    6   XUL                                 0x0000000114c04a85 _ZN7mozilla6layers17NativeLayerRootCA14Representation6CommitENS1_19WhichRepresentationERK8nsTArrayI6RefPtrINS0_13NativeLayerCAEEEb + 3973
    7   XUL                                 0x0000000114c039ca _ZN7mozilla6layers17NativeLayerRootCA14CommitToScreenEv + 74
    8   XUL                                 0x000000011830616e _ZN11nsChildView29HandleMainThreadCATransactionEv + 238
    9   XUL                                 0x000000011522bf42 -[ChildView updateRootCALayer] + 66
    10  AppKit                              0x00007fff22d4803c _NSViewUpdateLayer + 98
    11  AppKit                              0x00007fff22c5a275 +[NSAppearance _performWithCurrentAppearance:usingBlock:] + 66
    12  AppKit                              0x00007fff22eba423 __30-[_NSViewBackingLayer display]_block_invoke + 113
    13  AppKit                              0x00007fff22c9948d -[NSFocusStack performWithFocusView:inWindow:usingBlock:] + 92
    14  AppKit                              0x00007fff22d479c5 -[_NSViewBackingLayer display] + 382
    15  QuartzCore                          0x00007fff26bf5853 _ZN2CA5Layer17display_if_neededEPNS_11TransactionE + 863
    16  QuartzCore                          0x00007fff26d40d3e _ZN2CA7Context18commit_transactionEPNS_11TransactionEdPd + 666
    17  QuartzCore                          0x00007fff26bd6cdf _ZN2CA11Transaction6commitEv + 713
    18  AppKit                              0x00007fff22df1bfc __62+[CATransaction(NSCATransaction) NS_setFlushesWithDisplayLink]_block_invoke + 285
    19  AppKit                              0x00007fff235474d3 ___NSRunLoopObserverCreateWithHandler_block_invoke + 41
    20  CoreFoundation                      0x00007fff20467d01 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 23
    21  CoreFoundation                      0x00007fff20467b95 __CFRunLoopDoObservers + 543
    22  CoreFoundation                      0x00007fff20467028 __CFRunLoopRun + 841
    23  CoreFoundation                      0x00007fff2046661c CFRunLoopRunSpecific + 563
    24  HIToolbox                           0x00007fff286aba83 RunCurrentEventLoopInMode + 292
    25  HIToolbox                           0x00007fff286ab7e5 ReceiveNextEventCommon + 587
    26  HIToolbox                           0x00007fff286ab583 _BlockUntilNextEventMatchingListInModeWithFilter + 70
    27  AppKit                              0x00007fff22c6d502 _DPSNextEvent + 864
    28  AppKit                              0x00007fff22c6bcd5 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1364
    29  XUL                                 0x0000000115232701 -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 177
    30  AppKit                              0x00007fff22c5e049 -[NSApplication run] + 586
    31  XUL                                 0x0000000115233a2b _ZN10nsAppShell3RunEv + 171
    32  XUL                                 0x000000011909539c _ZN12nsAppStartup3RunEv + 60
    33  XUL                                 0x0000000115684fd1 _ZN7XREMain11XRE_mainRunEv + 2369
    34  XUL                                 0x000000011911754f _ZN7XREMain8XRE_mainEiPPcRKN7mozilla15BootstrapConfigE + 991
    35  XUL                                 0x0000000119117a35 _Z8XRE_mainiPPcRKN7mozilla15BootstrapConfigE + 133
    36  firefox                             0x000000010aedf3c2 main + 658
    37  libdyld.dylib                       0x00007fff2038af3d start + 1
    38  ???                                 0x0000000000000001 0x0 + 1",
          "message": "Crashing on exception: -[CALayer enqueueSampleBuffer:]: unrecognized selector sent to instance 0x139f6bec0",
          "module": "/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit"
        }
      ]
    }

Notice how many lines are missing (at the top) from this bug's Socorro crash stacks, by comparison to the "backtrace" from comment #9.

I've opened bug 1732571 to deal with this.

Crash Signature: [@ -[NSApplication _crashOnException:] | __62+[CATransaction NS_setFlushesWithDisplayLink]_block_invoke] [@ -[NSApplication _crashOnException:] | __65+[CATransaction NS_setFlushesWithDisplayRefresh]_block_invoke ] [@ -] → [@ -[NSApplication _crashOnException:] | __62+[CATransaction NS_setFlushesWithDisplayLink]_block_invoke] [@ -[NSApplication _crashOnException:] | __65+[CATransaction NS_setFlushesWithDisplayRefresh]_block_invoke ] [@ -[NSApplication _crashOnException:] …
You need to log in before you can comment on or make changes to this bug.