Bug 5661 - REGRESSION: Crash in sendDeferredTimerEvents
Summary: REGRESSION: Crash in sendDeferredTimerEvents
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 420+
Hardware: Mac OS X 10.4
: P1 Critical
Assignee: Darin Adler
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-11-07 21:29 PST by Jon
Modified: 2005-11-08 13:53 PST (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jon 2005-11-07 21:29:23 PST
Recent NSTimer -> CFTimerRunLoopRef change is unstable in general browsing. This is Deployment 
mode through Safari on 10.4.3. Crash as follows, every time: 

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   com.apple.CoreFoundation 	0x907400bc CFArrayGetCount + 52
1   com.apple.WebCore        	0x00456f3c sendDeferredTimerEvents(__CFRunLoopTimer*, void*) + 64 
(icplusplus.c:28)
2   com.apple.CoreFoundation 	0x90770ae0 __CFRunLoopDoTimer + 184
3   com.apple.CoreFoundation 	0x9075d458 __CFRunLoopRun + 1680
4   com.apple.CoreFoundation 	0x9075ca0c CFRunLoopRunSpecific + 268
5   com.apple.HIToolbox      	0x931831e0 RunCurrentEventLoopInMode + 264
6   com.apple.HIToolbox      	0x93182874 ReceiveNextEventCommon + 380
7   com.apple.HIToolbox      	0x931826e0 BlockUntilNextEventMatchingListInMode + 96
8   com.apple.AppKit         	0x93681904 _DPSNextEvent + 384
9   com.apple.AppKit         	0x936815c8 -[NSApplication 
nextEventMatchingMask:untilDate:inMode:dequeue:] + 116
10  com.apple.SafariDev      	0x00006ef0 0x1000 + 24304
11  com.apple.AppKit         	0x9367db0c -[NSApplication run] + 472
12  com.apple.AppKit         	0x9376e618 NSApplicationMain + 452
13  com.apple.SafariDev      	0x0000265c 0x1000 + 5724
14  com.apple.SafariDev      	0x00056d1c 0x1000 + 351516
Comment 1 mitz 2005-11-07 23:11:46 PST
Confirmed w/Nov 8 nightly.
Comment 2 Darin Adler 2005-11-08 10:05:03 PST
I guess I can just roll it out -- or if there was a reliable way to reproduce I could fix it quickly!
Comment 3 Darin Adler 2005-11-08 10:48:25 PST
Mitz said the steps to reproduce are: "just go to any form, click in one text field, wait, click in another. 
http://bugzilla.opendarwin.org/query.cgi will do".
Comment 4 Geoffrey Garen 2005-11-08 10:56:02 PST
This is the errant function:

WebCore/kwq/KWQObject.mm:250
static void sendDeferredTimerEvents(CFRunLoopTimerRef, void *)
{
    CFRelease(sendDeferredTimerEventsTimer);
    sendDeferredTimerEventsTimer = 0;

    CFArrayRef timers = deferredTimers;
    deferredTimers = 0;

    CFArrayApplyFunction(timers, CFRangeMake(0, CFArrayGetCount(timers)), sendDeferredTimerEvent, 
0);

    CFRelease(timers);
}

GDB says deferredTimers is null (probably never initialized).

I notice that other parts of the code, like timerFired, check for a null deferredTimers -- maybe we 
should do the same here? If so, I'd suggest making a static getDeferredTimers() accessor method to do 
the work in one place.
Comment 5 Geoffrey Garen 2005-11-08 10:59:21 PST
s/deferredTimers/timers/

*timers* is null, probably because deferredTimers was never initialized.
Comment 6 Adele Peterson 2005-11-08 13:53:14 PST
I checked in nil check for timers in sendDeferredTimerEvents.