[Bug] macOS Desktop: main process crashes repeatedly (EXC_BAD_ACCESS / NULL deref on UI rendering thread) #896

Activity

1. sponjat

   added

   status: 待评估已收到，等待团队评估已收到，等待团队评估

   type: Bug产品缺陷或异常产品缺陷或异常

   on Oct 1, 2026
2. github-actions

   added

   priority: P2普通优先级普通优先级

   on Oct 1, 2026
3. github-actions commented on Oct 1, 2026

   

   github-actionsbot

   on Oct 1, 2026 – with GitHub Actions

   More actions

   👋 感谢你的反馈，我们已经收到。

   • 维护者看到后会尽快回复你。
   • 状态保持为 status: 待评估，你可以随时补充信息。
   • 信息不全时我们会打上 needs: 更多信息 标签并 @ 你。

   ---

   👋 Thanks — we've received your issue.

   • A maintainer will get back to you as soon as we can.
   • Status stays at status: 待评估 (Triage); feel free to add context.
   • If we need more details, we'll add needs: 更多信息 and ping you.
4. sponjat commented on Oct 1, 2026

   

   sponjat

   on Oct 1, 2026

   Author

   More actions

   Technical appendix — all details inline (no file attachments)

   All data below was extracted programmatically from the 5 Crashpad minidumps the app itself archived under ~/.zcode/v2/crash/archive/ (the app prunes them at every startup — see the log line pruned 2 archive file(s) source=startup — so a 6th dump from Sep 30 07:50 was already deleted; its exception params were recorded before pruning).

   Build identity (for symbolication)

   • ZCode 3.14.4 (3.14.4.7912) — app binary UUID 4C4C4450-5555-3144-A175-A5A5EB513DF3 (arm64)
   • Electron 41.0.3 / Chromium 146.0.7680.80 — Electron Framework UUID 4C4C4456-5555-3144-A1D7-2F9FC95F5CF0 (arm64)
   • macOS 26.6.2 (25G83), Apple Silicon (arm64), 48 GB RAM, 0 bytes swap used at all times
   • All offsets below are module-relative (Electron Framework __TEXT vmaddr = 0x0)

   Per-dump exception summary (all Crashpad annotation process_type=browser)

   Dump prefix	Crash time (local)	GPU	Fault address	Crash PC	LR candidates (from context)
   15e9388b	Sep 30 07:50	on	0x10	(dump pruned before deep parse)	—
   d904725f	Sep 30 10:34	on	0x18	Electron Framework+0x287c6ec	+0x16cc324, +0x16cc328
   1d5e6d27	Sep 30 19:27	on	0x18	Electron Framework+0x287c6ec	+0x16cc324, +0x16cc328
   06f6177c	Sep 30 20:04	on	0x18	Electron Framework+0x287c6ec	+0x16cc324, +0x16cc328
   bd319993	Sep 30 23:07	on	0x18	Electron Framework+0x287c6ec	+0x16cc324, +0x16cc328
   c69696a1	Oct 1 03:40	--disable-gpu	0x10	Electron Framework+0x128d988	+0x128d990

   • Exception code 0x1 (EXC_BAD_ACCESS) on every dump; exception params (0xA, 0xB100001, <fault addr>) — ESR 0xB100001 = read data abort, so a NULL pointer + 0x10/0x18 field dereference (a read), identical every time.
   • Crashed thread starts at libsystem_pthread.dylib+0x1c8c; process has ~51 threads; module count 1066–1081.

   Poor-man's backtrace — raw stack scan, return-address candidates in order (dump bd319993, GPU on, PC = EF+0x287c6ec)

   EF+0x486c, EF+0x16ccc5c, EF+0x16cc324, EF+0x1db2c04, EF+0x1db2a98, EF+0x1dbca98,
   EF+0x9410cb5, EF+0x1dbc7b8, EF+0x20be1dc, EF+0x20bc5c8, EF+0x20bc150, EF+0x493f054,
   EF+0x493edfc, EF+0x493f248, EF+0x1db3428, EF+0x8d5504, EF+0x1db2ea8, EF+0x1ac4ab0,
   EF+0x5459f4, EF+0x94f238, EF+0x13dd5c, EF+0x113f6c, EF+0x3690c, EF+0x93581c6,
   EF+0x113e58, EF+0x23ea8, EF+0x23cc8, EF+0x2839688, EF+0x232c0, EF+0xfa998,
   EF+0x113d08, EF+0x113c34, EF+0x113bc4, EF+0xfaf98, EF+0x68b9fc, EF+0x91e50,
   EF+0xfa47c, EF+0x93581c6, EF+0x279bea4, EF+0x967734, EF+0x2878988, EF+0x337530,
   EF+0x28789cc, EF+0x96761c
   

   Deeper system-side region of the same stack (ordered): CoreFoundation+0x7df60 / +0x7def4 / +0x7dc60 / +0x7c884, libsystem_blocks.dylib+0xee4, AppKit+0x128584 / +0xacd1d0 / +0xad5508 / +0xad52ac, libobjc.A.dylib+0xf24c / +0x3cef4 / +0x142d8, QuartzCore+0x1d4bb4 / +0x1d473c, Foundation+0x13468, UpdateCycle+0xcb8, HIToolbox+0xbd560, AppKit+0x6e53d0.

   (EF = Electron Framework. Raw scan of stack memory, not a CFI/DWARF unwind; repeated EF+0x93581c6 is a shared stub trampoline.)

   Poor-man's backtrace — dump c69696a1 (--disable-gpu, PC = EF+0x128d988)

   EF+0x128d964, EF+0xf49a3c, EF+0x94f238, EF+0x661864, EF+0x75e3f0, EF+0x113f6c,
   EF+0x3690c, EF+0x93589da, EF+0x113e58, EF+0x23ea8, EF+0x2839688, EF+0x232c0,
   EF+0xfa998, EF+0x113d08, EF+0x113c34, EF+0x113bc4, EF+0xfaf98, EF+0x68b9fc,
   EF+0x91e50, EF+0xfa47c, EF+0x93589da, EF+0x279c5e4, EF+0x967734, EF+0x2878988,
   EF+0x337530, EF+0x28789cc, EF+0x96761c, CoreFoundation+0x7df60, CoreFoundation+0x7def4,
   CoreFoundation+0x7dc60, CoreFoundation+0x7c884, libsystem_blocks.dylib+0xee4,
   AppKit+0x128584, EF+0x57c1624, libobjc.A.dylib+0xf24c, QuartzCore+0x1d4bb4,
   QuartzCore+0x1d473c, EF+0x55f9ad4, libobjc.A.dylib+0x3cef4, libobjc.A.dylib+0x142d8,
   Foundation+0x13468, AppKit+0xacd1d0, AppKit+0xad5508, AppKit+0xad52ac
   

   Shared tail frames between the two variants (EF+0x967734 → +0x2878988 → +0x337530 → +0x28789cc → +0x96761c → CoreFoundation) suggest both paths converge on the same message-loop / display-link dispatch before diverging in the paint code.

   Context register candidates (values falling in module ranges, in context order)

   • GPU on: EF+0x287c6ec (PC), EF+0x16cc324, EF+0x16cc328, libsystem_pthread.dylib+0x1c8c (thread entry); small values: 0x1, 0x1f0, 0x2, 0x4000, 0x3fff, 0x1d, 0x30, 0xcb, 0x1f8, 0xff
   • --disable-gpu: EF+0x128d988 (PC), EF+0x128d990, libsystem_pthread.dylib+0x1c8c; small values include 0x18 (the fault address itself), 0x21a, 0x20, 0x6cc0, 0x4000, 0x3fff

   App-log tail immediately before each death (sanitized; identical pattern every time)

   [renderer] v4 conversation subscription started {…}
   [renderer] v4 session data lease acquired {openKind:cold}
   [main] [browser-use] attachGuest …
   [host] [rpc:call] zcode-session.readSession FAIL (Session is not active: …)   <- recurring warning, present also in healthy runs
   [host] [cua-pip-session] event delivery skipped {skipReason:credentials-unavailable}   <- recurring warning
   <log ends with no error, no JS exception>
   

   The Oct 1 03:40 crash happened while the app was idle overnight (no user input for hours), so no user interaction is required.

   How to symbolicate locally

   atos -o "Electron Framework" -l <load-address-slide> 0x287c6ec
   

   Note: running atos against the stripped installed binary yields a misleading v8-compiler symbol for +0x287c6ec; with internal symbols the offsets above should map directly (UUIDs identify the exact builds).

   What rules out common causes

   • Not OOM: 48 GB RAM, zero swap, ~2.4–2.5 GB RSS at death; dumps carry no v8 OOM annotations.
   • Not GPU-specific: crashes on both GPU and software compositing (two distinct PCs, same exception signature).
   • Not version-3.14.4-specific: identical appDeath cadence began on 3.14.3 (Sep 28), first crash dump seen Sep 28 01:16.
   • No macOS .ips reports are ever generated — the app's Crashpad handler catches everything, so system Console shows nothing.
5. Albert-Rocareer commented on Oct 3, 2026

   

   Albert-Rocareer

   on Oct 3, 2026

   More actions

   补充一条macOS 主进程崩溃的另一种形态，栈与你们报告的不同，供 triage 区分：

   • 我在 [Bug] Windows 桌面端 3.8.1：内置浏览器(browser-use)标签页销毁时主进程空指针写入崩溃 0xC0000005 @ ZCode.exe+0x174C2F2（升级后 3 分钟内 2 次） #342（内置浏览器标签页销毁时主进程空指针崩溃）下补了完整证据链：macOS 3.14.4 上这类崩溃的触发点是内嵌浏览器（IAB）guest 被"驻留挂起/替换"时 CDP 仍附着——崩溃线程 CrBrowserMain、出错地址 0x10/0x18（空指针 + 小偏移、与 [Bug] Windows 桌面端 3.8.1：内置浏览器(browser-use)标签页销毁时主进程空指针写入崩溃 0xC0000005 @ ZCode.exe+0x174C2F2（升级后 3 分钟内 2 次） #342 的 0x8 同型），且伴随 render-process-gone {"name":"webview","exitCode":11} 与 App 自身埋点 perf_crash {"crash_scope":"embedded_webview","exit_code":11}。判据可 grep 日志 detachGuest cdp still attached on destroyed guest（我这边崩溃日 43 次 / 平稳日 0–2 次）。
   • 你们报告的栈是 HIToolbox → AppKit → QuartzCore(UpdateCycle/CADisplayLink) → Electron Framework，且 --disable-gpu 后换成软件合成路径仍崩。两者不像同一个缺陷，建议在 macOS 上分开跟踪，避免归因合并后修不掉。
   • 另外提醒一个证据坑：我另开了 [Bug] macOS：chrome_crashpad_handler 自身反复崩溃（EXC_BREAKPOINT @ CrashpadHandlerMain，启动后约 126ms，2 天 75 次）→ 该时段崩溃转储静默丢失 #911——本机 chrome_crashpad_handler 会在启动后约 126ms 自行崩溃（2 天内 75 次、成串出现），那段时间的 dump 会静默丢失；你在统计"崩溃次数"时用 macOS 侧记录（如 loginwindow appDeath）交叉验证是对的做法。