0

Since many versions of MacOS, I got different applications leaving a ghost version only visible at the Finder and Dock level but not at the basic Unix level. Here is the usual error message the Finder does display when trying to start such a ghost application: enter image description here

Meanwhile, Activity Monitor doesn't show any Preview process, and moreover the Unix command ps either:

# ps ax | egrep '[ /](PID|Preview)'
  PID   TT  STAT      TIME COMMAND
#

Next, the Dock does display a small dot near the application icon, but refuse to force quit the ghost application.

Tested and failing solutions

The usual receipe ⌘+⌥+escfrom the Finder doesn't permit to force quit the ghost application.

Many not tested ( by their authors ) receipes talk of removing preferences files, but since these files are only open by the running application, this advice can only lead to a waste of time and a loss of working preferences. Killing the Finder or the Dock is possible but doesn’t fix the bad vision of the ghost application.

The MacOS cannot shutdown through the Finder menu entry:  > Shut Down... since the Finder cannot get rid of the ghost application it sees as running when it isn't, here Preview.

On the other hand, a very basic Unix command permit to get a clean and fast shutdown, since at the Unix level there isn't any application impossible to kill:

/usr/bin/sudo shutdown -h now 'Finder see ghost applications'

Spread of the problem

From my experience this problem is concerning Yosemite and High Sierra. If you had the same problem on any more recent version of MacOS, could you signal it within the comments.

Versions of MacOS exhibiting the problem:

  • Yosemite
  • El Capitan
  • Sierra
  • High Sierra
  • Mojave
  • Big Sur

Applications exhibiting the problem:

  • Preview
  • Safari
  • TeamViewer
  • XQuartz

From what I read in different discussion groups, it looks like any application might reach this state of ghost for the Finder and the Dock. It is a very large spectrum problem, and Apple doesn't look to have figured it and doesn't provide any decent workaround or solution ( but the stupid and huge waste of time: reinstall MacOS. Stupid because you can't give such an advice when you don't understand a problem. )

Simple workaround

The application seen as a ghost by the Finder is not the origin of the problem and none of its preference files. A simple demonstration can be obtained by starting it without the Finder:

In a Terminal simply enter for example:

$ open -n -a Preview.app
$

and you will get a fresh new Preview running with all its usual preferences and functions available. This new version will get a new icon within the Dock.

Analysis of the problem

Since I didn't find any decent explanation of this problem and no clean fix of it I started my own investigation with the help of the truss command which traces every key event within a Unix process running.

First I tried in a Terminal window:

$ /usr/bin/sudo dtruss -W Preview

and on another Terminal Window I tried to start Preview through:

$ open -a Preview.app
LSOpenURLsWithRole() failed for the application /Applications/Preview.app with error -600.
$

but nothing appeared within the dtruss track, meaning that Preview didn't even start and of course none of its preference files were opened.

Through a small program tracking all events, I was able to figure out that the program responsible of the error window is CoreServicesUIAgent. But making different kind of snoop on this process I wasn't able to find on which file or internal DB it was making this diagnosis.

lsappinfo(8) shows that Preview is registered among services, but the PID is one of a process not existing anymore:

% lsappinfo info -app Preview
[...]
    pid = 16898 !cgsConnection [...]
[...]
%

How to furter invistigate this large spectrum bug

My state of understanding of the problem is that there is a false view of the processes running on MacOS from the Finder and the Dock.

What may lead to this corrupted image of the processes on the system?

Which tools would be the best suited to further investigate this bug?

Where could I find any documentation about this LSOpenURLsWithRole and the meaning of its error codes?

dan
  • 199
  • 1
  • 8
  • LSOpenURLsWithRole => LS = Launch Services framework, Roles https://developer.apple.com/documentation/coreservices/lsrolesmask – Marek H Aug 29 '21 at 15:51
  • 1
    I think it's a dead end. It's failing on getting PID inside. You can use hopper app and look for (CMD+F) 0xfffffffffffffda8 (-600) It's failing on LSApplicationCopyByASN(__LSSession const*, unsigned long long) which calls LSApplication::CopyProcess(__LSSession const*, unsigned long, unsigned long) which call one of these 2: LSSessionCopySystemProcessApplication(__LSSession const*) LSApplication::CopyProcessByPid(__LSSession const*, int, bool) PS: Big Sur made reverse engineering harder. Use older frameworks from mojave/catalina – Marek H Aug 29 '21 at 16:40
  • also try "ps -e" or "ps auxm" – Marek H Aug 29 '21 at 16:59
  • @MarekH: I share your analysis: "It's failing on getting PID inside." How may I force `launchservicesd` ( if I guessed right which daemon is making this association ) to free this wrong association: app → PID, and make a fresh one? – dan Aug 30 '21 at 14:58
  • All the `ps` war options were used: nothing. My chance is that I have a live case on `High Sierra` where Apple hasn't yet killed too many analysis tools. – dan Aug 30 '21 at 15:10
  • I would look at Dock.app (if you can see the app there). On top there are more variables than pid. Namely psn and cid. psn = process serial number. Look for those as well I would be able to debug + reverse engineer but I cannot simulate this bug. "Mac OS X assigns a unique process serial number ("PSN") to all apps launched via GUI. It's used for identifying various processes and instances of executables." http://mirror.informatimago.com/next/developer.apple.com/documentation/Carbon/Reference/Process_Manager/prmref_main/data_type_5.html#//apple_ref/doc/uid/TP30000208/C001951 – Marek H Aug 30 '21 at 16:43
  • Look here is your error -600 https://stackoverflow.com/questions/8639379/getprocessforpid-error-600-with-some-process To find your hanging process: https://developer.apple.com/library/archive/qa/qa2001/qa1123.html – Marek H Aug 30 '21 at 17:15
  • If you encounter you can look for processes using this https://github.com/osxfuse/filesystems/blob/master/filesystems-c/grabfs/GetPID.c just compile it and see if you can find something. – Marek H Aug 30 '21 at 17:35

0 Answers0