2

Since many versions of MacOS, I got different applications leaving a ghost version only visible at the Finder and Dock level but not at the basic Unix level. Here is the usual error message the Finder does display when trying to start such a ghost application: enter image description here

Meanwhile, Activity Monitor doesn't show any Preview process, and moreover the Unix command ps either:

# ps ax | egrep '[ /](PID|Preview)'
  PID   TT  STAT      TIME COMMAND
#

Next, the Dock does display a small dot near the application icon, but refuse to force quit the ghost application.

Tested and failing solutions

The usual receipe ++escfrom the Finder doesn't permit to force quit the ghost application.

Many not tested ( by their authors ) receipes talk of removing preferences files, but since these files are only open by the running application, this advice can only lead to a waste of time and a loss of working preferences. Killing the Finder or the Dock is possible but doesn’t fix the bad vision of the ghost application.

The MacOS cannot shutdown through the Finder menu entry:  > Shut Down... since the Finder cannot get rid of the ghost application it sees as running when it isn't, here Preview.

On the other hand, a very basic Unix command permit to get a clean and fast shutdown, since at the Unix level there isn't any application impossible to kill:

/usr/bin/sudo shutdown -h now 'Finder see ghost applications'

Spread of the problem

From my experience this problem is concerning Yosemite and High Sierra. If you had the same problem on any more recent version of MacOS, could you signal it within the comments.

Versions of MacOS exhibiting the problem:

  • Yosemite
  • El Capitan
  • Sierra
  • High Sierra
  • Mojave
  • Big Sur

Applications exhibiting the problem:

  • Preview
  • Safari
  • TeamViewer
  • XQuartz

From what I read in different discussion groups, it looks like any application might reach this state of ghost for the Finder and the Dock. It is a very large spectrum problem, and Apple doesn't look to have figured it and doesn't provide any decent workaround or solution ( but the stupid and huge waste of time: reinstall MacOS. Stupid because you can't give such an advice when you don't understand a problem. )

Simple workaround

The application seen as a ghost by the Finder is not the origin of the problem and none of its preference files. A simple demonstration can be obtained by starting it without the Finder:

In a Terminal simply enter for example:

$ open -n -a Preview.app
$

and you will get a fresh new Preview running with all its usual preferences and functions available. This new version will get a new icon within the Dock.

Analysis of the problem

Since I didn't find any decent explanation of this problem and no clean fix of it I started my own investigation with the help of the truss command which traces every key event within a Unix process running.

First I tried in a Terminal window:

$ /usr/bin/sudo dtruss -W Preview

and on another Terminal Window I tried to start Preview through:

$ open -a Preview.app
LSOpenURLsWithRole() failed for the application /Applications/Preview.app with error -600.
$

but nothing appeared within the dtruss track, meaning that Preview didn't even start and of course none of its preference files were opened.

How to furter invistigate this large spectrum bug

My state of understanding of the problem is that there is a false view of the processes running on MacOS from the Finder and the Dock.

What may lead to this corrupted image of the processes on the system?

Which tools would be the best suited to further investigate this bug?

Where could I find any documentation about this LSOpenURLsWithRole and the meaning of its error codes?

6
  • 1
    Are you sure you mean Yosemite 10.10 & High Sierra 10.13? - that's an odd gap. [Personally I thought both the Sierras were ..poor to say the least. I have many older Macs here on either El Cap or Mojave, nothing in between. Your specific issue I have never seen, but If the usual tricks of testing clean admin account, testing in Safe Mode & removing all 3rd party kexts doesn't work, next test would be a clean install + migrate from Time Machine [not restore from TM, that doesn't works as well.] I'd also try just killing the Dock, that was very flaky in the Sierras & sometimes just 'fixes stuff'
    – Tetsujin
    Jul 18 at 17:46
  • Since the error message you get appears to come from Finder, my first thought is to kill Finder. I already had an AppleScript for exactly this purpose which can be grabbed from here if you are interested pastebin.com/4bHuzf0i
    – wch1zpink
    Jul 18 at 17:59
  • @tetsujin: I witnessed myself this bug on Yosemite ( a few years ago ) and High Sierra. No need to test with an admin account since as I wrote, open -n -a Preview.app shows that neither the app. neither the OS are broken.
    – dan
    Jul 18 at 19:34
  • I suggested 5 course of action, which you appear to have dismissed without even considering. Good luck. btw LSOpenURLsWithRole is a permissions issue - but that doesn't seem to be related to the original issue.
    – Tetsujin
    Jul 19 at 8:06
  • 1
    I think it's a dead end to look for erro -600. It's failing on getting PID inside. You can use hopper app and look for (CMD+F) 0xfffffffffffffda8 (-600) It's failing on LSApplicationCopyByASN(__LSSession const*, unsigned long long) which calls LSApplication::CopyProcess(__LSSession const*, unsigned long, unsigned long) which call one of these 2: LSSessionCopySystemProcessApplication(__LSSession const*) LSApplication::CopyProcessByPid(__LSSession const*, int, bool) PS: Big Sur made reverse engineering harder. Use older frameworks from mojave/catalina
    – Marek H
    Aug 29 at 16:55

You must log in to answer this question.

Browse other questions tagged .