[MacOS]crash on zoom since kitty 0.40

[dmtrKovalenko]

Describe the bug

Changing font size in runtime crashes the application. No matter it is change_font_size action or manually editing and saving the config

To Reproduce
Steps to reproduce the behavior:

1. Open kittty
2. Make the zoom in command
3. Crash

Here is my command config

map cmd+plus   change_font_size all +2.0
map cmd+minus       change_font_size all -2.0

Crash report:

Process:               kitty [69567]
Path:                  /Applications/kitty.app/Contents/MacOS/kitty
Identifier:            net.kovidgoyal.kitty
Version:               0.40.0 (0.40.0)
Code Type:             ARM-64 (Native)
Parent Process:        launchd [1]
User ID:               501

Date/Time:             2025-03-15 09:32:48.8135 +0100
OS Version:            macOS 15.3.2 (24D81)
Report Version:        12
Anonymous UUID:        D4636D81-E07D-6D22-C1F1-5CDF3DF54E08

Sleep/Wake UUID:       3B332C79-4FB6-4938-8572-494A41D44D56

Time Awake Since Boot: 37000 seconds
Time Since Wake:       350 seconds

System Integrity Protection: enabled

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_CRASH (SIGABRT)
Exception Codes:       0x0000000000000000, 0x0000000000000000

Termination Reason:    Namespace SIGNAL, Code 6 Abort trap: 6
Terminating Process:   kitty [69567]

Application Specific Information:
abort() called


Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib        	       0x18e2a3720 __pthread_kill + 8
1   libsystem_pthread.dylib       	       0x18e2dbf70 pthread_kill + 288
2   libsystem_c.dylib             	       0x18e1e8908 abort + 128
3   libsystem_malloc.dylib        	       0x18e0f1e38 malloc_vreport + 896
4   libsystem_malloc.dylib        	       0x18e11a458 malloc_zone_error + 100
5   libsystem_malloc.dylib        	       0x18e109774 nanov2_guard_corruption_detected + 44
6   libsystem_malloc.dylib        	       0x18e109734 nanov2_allocate_outlined + 460
7   libsystem_malloc.dylib        	       0x18e108468 nanov2_calloc_type + 568
8   libobjc.A.dylib               	       0x18df0ba44 class_createInstance + 72
9   CoreFoundation                	       0x18e34b5a8 __CFAllocateObject + 20
10  CoreFoundation                	       0x18e34b558 __NSSingleObjectArrayI_new + 48
11  CoreFoundation                	       0x18e36dc78 -[NSArray initWithArray:range:copyItems:] + 368
12  Foundation                    	       0x18f58377c -[NSObject(NSThreadPerformAdditions) performSelector:onThread:withObject:waitUntilDone:modes:] + 512
13  Foundation                    	       0x18f5833d4 -[NSObject(NSThreadPerformAdditions) performSelectorOnMainThread:withObject:waitUntilDone:] + 112
14  kitty.glfw-cocoa.so           	       0x1037ec43c 0x1037d0000 + 115772
15  kitty.glfw-cocoa.so           	       0x1037e5ccc 0x1037d0000 + 89292
16  AppKit                        	       0x192060ba4 _NSSendEventToObservers + 252
17  AppKit                        	       0x19289f404 -[NSApplication(NSEventRouting) sendEvent:] + 116
18  AppKit                        	       0x1924a6b04 -[NSApplication _handleEvent:] + 60
19  AppKit                        	       0x191f2d89c -[NSApplication run] + 520
20  kitty.glfw-cocoa.so           	       0x1037d9150 glfwRunMainLoop + 112
21  kitty.fast_data_types.so      	       0x102e1e2a4 0x102e14000 + 41636
22  Python                        	       0x1038ea404 method_vectorcall_NOARGS + 120
23  Python                        	       0x103a1be9c _PyEval_EvalFrameDefault + 52788
24  Python                        	       0x1038d7de4 _PyObject_FastCallDictTstate + 96
25  Python                        	       0x10396d09c slot_tp_call + 200
26  Python                        	       0x1038d790c _PyObject_MakeTpCall + 128
27  Python                        	       0x103a1c018 _PyEval_EvalFrameDefault + 53168
28  Python                        	       0x103a0e1a0 PyEval_EvalCode + 296
29  Python                        	       0x103a09a00 builtin_exec + 408
30  Python                        	       0x1039431c0 cfunction_vectorcall_FASTCALL_KEYWORDS + 92
31  Python                        	       0x103a1be9c _PyEval_EvalFrameDefault + 52788
32  Python                        	       0x103aca29c pymain_run_module + 276
33  Python                        	       0x103ac9a64 pymain_run_python + 872
34  Python                        	       0x103ac96b8 Py_RunMain + 24
35  kitty                         	       0x10256e864 0x10256c000 + 10340
36  kitty                         	       0x10256dc50 main + 2064
37  dyld                          	       0x18df5c274 start + 2840

[kovidgoyal]

Unfortunately I am travelling and dont have access to my mac machine. So
it would help if you built kitty from source with --sanitize and --debug
and posted the crash report.

https://sw.kovidgoyal.net/kitty/build/

[dmtrKovalenko]

Unfortunately I wasn't able to use your instructions to run kitty locally, unfortunately I do not have a lot of time right now to investigate this issue one my own. I am getting this sigbus error on startup which might or might not be the same issue becuase I wasn't able to actually run the debug build

==40157==ERROR: AddressSanitizer: BUS on unknown address (pc 0x00000bad4007 bp 0x00016b4e7ea0 sp 0x00016b4e7af0 T0)
==40157==The signal is caused by a READ memory access.
==40157==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
==40157==WARNING: atos failed to symbolize address "0xbad4007"
    #0 0xbad4007  (/Users/neogoose/dev/kitty/kitty/launcher/kitty:arm64+0x71c0007)
    #1 0x199b949d0 in IIOReadPlugin::callInitialize()+0x180 (ImageIO:arm64e+0xf9d0)
    #2 0x199b94778 in IIO_Reader::initImageAtOffset(CGImagePlugin*, unsigned long, unsigned long, unsigned long)+0xa0 (ImageIO:arm64e+0xf778)
    #3 0x199b91e10 in IIOImageSource::makeImagePlus(unsigned long, IIODictionary*)+0x33c (ImageIO:arm64e+0xce10)
    #4 0x199b916d4 in IIOImageSource::getPropertiesAtIndexInternal(unsigned long, IIODictionary*)+0x44 (ImageIO:arm64e+0xc6d4)
    #5 0x199b915f0 in IIOImageSource::copyPropertiesAtIndex(unsigned long, IIODictionary*)+0x14 (ImageIO:arm64e+0xc5f0)
    #6 0x199b91498 in CGImageSourceCopyPropertiesAtIndex+0x168 (ImageIO:arm64e+0xc498)
    #7 0x192024a70 in ImageSourceOptionsForCGImageSource_index_+0x3c (AppKit:arm64e+0x125a70)
    #8 0x192024900 in +[NSBitmapImageRep _imagesWithData:hfsFileType:extension:zone:expandImageContentNow:includeAllReps:]+0x1ac (AppKit:arm64e+0x125900)
    #9 0x19202472c in +[NSBitmapImageRep _imageRepsWithData:hfsFileType:extension:expandImageContentNow:]+0x54 (AppKit:arm64e+0x12572c)
    #10 0x192024228 in +[NSImageRep _imageRepsWithContentsOfURL:expandImageContentNow:giveUpOnNetworkURLsWithoutGoodExtensions:]+0x2e4 (AppKit:arm64e+0x125228)
    #11 0x1920d38d0 in -[NSImage initWithContentsOfURL:]+0x1c (AppKit:arm64e+0x1d48d0)
    #12 0x108470e6c in cocoa_set_app_icon cocoa_window.m:1048
    #13 0x105c4e7b8 in cfunction_call+0x74 (Python:arm64+0x1067b8)
    #14 0x105be3908 in _PyObject_MakeTpCall+0x7c (Python:arm64+0x9b908)
    #15 0x105d28014 in _PyEval_EvalFrameDefault+0xcfac (Python:arm64+0x1e0014)
    #16 0x105be3de0 in _PyObject_FastCallDictTstate+0x5c (Python:arm64+0x9bde0)
    #17 0x105c79098 in slot_tp_call+0xc4 (Python:arm64+0x131098)
    #18 0x105be3908 in _PyObject_MakeTpCall+0x7c (Python:arm64+0x9b908)
    #19 0x105d28014 in _PyEval_EvalFrameDefault+0xcfac (Python:arm64+0x1e0014)
    #20 0x105d1a19c in PyEval_EvalCode+0x124 (Python:arm64+0x1d219c)
    #21 0x105d159fc in builtin_exec+0x194 (Python:arm64+0x1cd9fc)
    #22 0x105c4f1bc in cfunction_vectorcall_FASTCALL_KEYWORDS+0x58 (Python:arm64+0x1071bc)
    #23 0x105d27e98 in _PyEval_EvalFrameDefault+0xce30 (Python:arm64+0x1dfe98)
    #24 0x105dd6298 in pymain_run_module+0x110 (Python:arm64+0x28e298)
    #25 0x105dd5a60 in pymain_run_python+0x364 (Python:arm64+0x28da60)
    #26 0x105dd56b4 in Py_RunMain+0x14 (Python:arm64+0x28d6b4)
    #27 0x10491cc74 in run_embedded main.c:217
    #28 0x104918300 in main main.c:467
    #29 0x18df5c270  (<unknown module>)
==40157==Register values:
 x[0] = 0x0000000199eb775c   x[1] = 0x0000000000000000   x[2] = 0x0000000199c22710   x[3] = 0x0000000199c22768  
 x[4] = 0x00006160002cce20   x[5] = 0x00006160002cce38   x[6] = 0x00006160002ccf38   x[7] = 0x00006030001b8b00  
 x[8] = 0x000060b0001d2328   x[9] = 0x0000000000000000  x[10] = 0x000000000000001d  x[11] = 0x0000000000000000  
x[12] = 0x0000000000000005  x[13] = 0x00006190008c0620  x[14] = 0x00000001f7c645d8  x[15] = 0x00000001f7c645d8  
x[16] = 0x000000000bad4007  x[17] = 0x00000002002ad2b0  x[18] = 0x0000000000000000  x[19] = 0x00006160002cce38  
x[20] = 0x00000001f99d3148  x[21] = 0x00006160002ccf38  x[22] = 0x00006060002f4860  x[23] = 0x00006030001b8a70  
x[24] = 0x00006030001b8b00  x[25] = 0x000000016b4e8208  x[26] = 0x0000000000000000  x[27] = 0x0000000000000000  
x[28] = 0x0000000000000000     fp = 0x000000016b4e7ea0     lr = 0x0000000199b9cc58     sp = 0x000000016b4e7af0  
AddressSanitizer can not provide additional info.
==40157==WARNING: atos failed to symbolize address "0xbad4007"
SUMMARY: AddressSanitizer: BUS (/Users/neogoose/dev/kitty/kitty/launcher/kitty:arm64+0x71c0007) 
==40157==ABORTING
fish: Job 1, './kitty/launcher/kitty' terminated by signal SIGABRT (Abort)

[kovidgoyal]

Does not repro for me on macOS running kitty as

kitty --config=NONE

Pressing ctrl+shift+plus and ctrl+shift+mius to change font sizes repeatedly does not crash. And looking at both your stack traces, the crashes are happening deep inside Apple system libraries, not kitty code. For the latter crash it looks like its happening when loading a custom application icon, do you have something in ~/.config/kitty/kitty.app.*?

Closing as this doesnt look like an issue in kitty code, but feel free to follow up.

[dmtrKovalenko]

This is definetely the problem of v40 because simple downgrading to 0.38 fixes the issue + I was able to reproduce the crash by pressying ctr+shift+plus without config many times.

Anyways gonna downgrade to 0.38 for now

[dmtrKovalenko]

I found a way to reproduce this crash more correctly:

# modify_font cell_height 102% 
# modify_font underline_position +2
# modify_font underline_thickness 7%
# background_blur 100

the combination of these 4 options making it crash. Funny enough that if you remove one of them like background blur you can still change the font but it might crash randomly. Looks like some kind of data race is going when the config is updated

[kovidgoyal]

OK I will have a look when I have a moment