Bug 18959 – REGRESSION (3.1.1-TOT): Reproducible crash when copying OBJECT with fake image data

• Component: New Bugs
• Status: RESOLVED FIXED

[Bob Maguire]

Note: This crash does NOT occur in the official stable release of Safari 3.1.1.

This is with Nightly Build v32945, but has been happening in previous nightly builds at least since the Acid 3 test was passed.

I only first noticed this when I started using the nightly builds of WebKit when it was announced it passed the Acid 3 test.  I opened the test, let it finish loading, then I did a Cmd-A to select all, and a Cmd-C to copy (no idea why it occured to me to try, but I did).  After a few seconds of hearing the CPU fans spin up, WebKit crashed.  I relaunched and tried again... same thing.  I've been trying this off and on now for a couple of weeks every time a new nightly comes out.

I managed to boil the problem down to a single HTML tag with a single attribute.  The OBJECT tag using the DATA attribute with a value that appears to be an image file, but an image file that doesn't actually exist.  WebKit keeps attempting to load the image file and then finally seems to give up after 200 attempts (!).

I've set up an example page here: http://ckdown.com/object_data_image.html
And a screenshot of it all going down is here: http://ckdown.com/object_data_image.png

Actually, it's small enough I can put it inline right here:
<object data="foo.gif" />

[If you're interested, the reason the Acid 3 page was crashing was because of the OBJECT elements that get created in Test 16 that point to the non-existent "support-a.png" file.]

The page will appear to be blank, but there is an object element there once it finishes loading.  I suppose I could've added a border to make it more visible.  Regardless, if you select the rendered object and try to copy, WebKit soon crashes.  This is different from Safari 3.1.1, as Safari just shows a broken image placeholder, and stops immediately.  Selecting and copying in Safari exhibits no ill effects.

Some other noteworthy details:
- It only happens while being served.  Load the exact same file through "file://" and the browser stops on the very first attempt with "file doesn't exist" in the activity window.  My guess is it's somehow ignoring the 404 status code returned from the browser, and just keeps trying.

- It only exhibits this loading loop when the DATA attribute appears to point to an image file (i.e. "foo.gif", "foo.jpg", "foo.png", "foo.bmp", and "foo.tif" all did the same thing).  "foo.txt", "foo.mov", "foo.bar", "foo", or just blank, didn't cause the looping.

- And just to eliminate all possible variables, I removed all extensions and even all my plugins (as demonstrated by the screenshot), with no change in the behaviour.  I thought there might be the off chance I had a weird plugin that was trying to do something strange (like the Mr.Sid plugin or something), but turns out that wasn't the case.  It made no difference what plugins I had installed.

----------
My web server error log:
[Thu May 08 21:05:48 2008] [error] [client ##.##.##.###] File does not exist: /Library/WebServer/Sites/ckdown/Documents/foo.gif, referer: http://ckdown.com/object_data_image.html
[Thu May 08 21:05:48 2008] [error] [client ##.##.##.###] File does not exist: /Library/WebServer/Sites/ckdown/Documents/foo.gif, referer: http://ckdown.com/object_data_image.html
[Thu May 08 21:05:48 2008] [error] [client ##.##.##.###] File does not exist: /Library/WebServer/Sites/ckdown/Documents/foo.gif, referer: http://ckdown.com/object_data_image.html
[Thu May 08 21:05:48 2008] [error] [client ##.##.##.###] File does not exist: /Library/WebServer/Sites/ckdown/Documents/foo.gif, referer: http://ckdown.com/object_data_image.html
etc..., etc...

My web server's combined log:
##.##.##.### - - [08/May/2008:21:05:48 -0600] "GET /foo.gif HTTP/1.1" 404 205 "http://ckdown.com/object_data_image.html" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_5_2; en-us) AppleWebKit/526.5+ (KHTML, like Gecko) Version/3.1.1 Safari/525.18"
##.##.##.### - - [08/May/2008:21:05:48 -0600] "GET /foo.gif HTTP/1.1" 404 205 "http://ckdown.com/object_data_image.html" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_5_2; en-us) AppleWebKit/526.5+ (KHTML, like Gecko) Version/3.1.1 Safari/525.18"
##.##.##.### - - [08/May/2008:21:05:48 -0600] "GET /foo.gif HTTP/1.1" 404 205 "http://ckdown.com/object_data_image.html" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_5_2; en-us) AppleWebKit/526.5+ (KHTML, like Gecko) Version/3.1.1 Safari/525.18"
##.##.##.### - - [08/May/2008:21:05:48 -0600] "GET /foo.gif HTTP/1.1" 404 205 "http://ckdown.com/object_data_image.html" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_5_2; en-us) AppleWebKit/526.5+ (KHTML, like Gecko) Version/3.1.1 Safari/525.18"
etc..., etc...


The Apple crash report:
Process:         Safari [14322]
Path:            /Applications/Internet & Network/WebKit.app/Contents/MacOS/WebKit
Identifier:      org.webkit.nightly.WebKit
Version:         r32945 (32945)
Code Type:       PPC (Native)
Parent Process:  launchd [125]

Date/Time:       2008-05-08 21:09:42.605 -0600
OS Version:      Mac OS X 10.5.2 (9C7010)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000000
Crashed Thread:  0

Thread 0 Crashed:
0   com.apple.WebCore             	0x011c240c -[WebCoreSharedBufferData initWithSharedBuffer:] + 76
1   com.apple.WebKit              	0x001f8a0c -[WebResource data] + 44
2   com.apple.AppKit              	0x9125388c -[NSHTMLReader _addAttachmentForElement:URL:needsParagraph:usePlaceholder:] + 404
3   com.apple.AppKit              	0x910dd690 -[NSHTMLReader _processElement:tag:display:depth:] + 3144
4   com.apple.AppKit              	0x910db33c -[NSHTMLReader _traverseNode:depth:embedded:] + 984
5   com.apple.AppKit              	0x910db3a8 -[NSHTMLReader _traverseNode:depth:embedded:] + 1092
6   com.apple.AppKit              	0x912282ec -[NSHTMLReader _loadFromDOMRange] + 612
7   com.apple.AppKit              	0x910da264 -[NSHTMLReader attributedString] + 32
8   com.apple.AppKit              	0x91227f48 -[NSAttributedString(NSAttributedStringKitAdditions) _initWithDOMRange:] + 200
9   com.apple.WebCore             	0x01004bac WebCore::Pasteboard::writeSelection(NSPasteboard*, WebCore::Range*, bool, WebCore::Frame*) + 156
10  com.apple.WebCore             	0x00d9501c WebCore::Editor::copy() + 268
11  com.apple.WebCore             	0x00d98990 WebCore::executeCopy(WebCore::Frame*, WebCore::Event*, WebCore::EditorCommandSource, WebCore::String const&) + 16
12  com.apple.WebKit              	0x001cf880 -[WebHTMLView executeCoreCommandBySelector:] + 96
13  com.apple.AppKit              	0x910493b8 -[NSApplication sendAction:to:from:] + 104
14  com.apple.Safari              	0x0002cf60 0x1000 + 180064
15  com.apple.AppKit              	0x910e4ab8 -[NSMenu performActionForItemAtIndex:] + 408
16  com.apple.AppKit              	0x910e47e8 -[NSCarbonMenuImpl performActionWithHighlightingForItemAtIndex:] + 228
17  com.apple.AppKit              	0x910e44b0 -[NSMenu performKeyEquivalent:] + 744
18  com.apple.AppKit              	0x910e2f94 -[NSApplication _handleKeyEquivalent:] + 456
19  com.apple.AppKit              	0x9101993c -[NSApplication sendEvent:] + 3556
20  com.apple.Safari              	0x0002ae20 0x1000 + 171552
21  com.apple.AppKit              	0x90f86a68 -[NSApplication run] + 776
22  com.apple.AppKit              	0x90f57444 NSApplicationMain + 440
23  com.apple.Safari              	0x000bd1c0 0x1000 + 770496
24  ???                           	0xbffffb90 0 + 3221224336

Thread 1:
0   libSystem.B.dylib             	0x936bb38c __semwait_signal + 12
1   libSystem.B.dylib             	0x936f7f40 _pthread_cond_wait + 1580
2   com.apple.WebCore             	0x00e827ec WebCore::IconDatabase::syncThreadMainLoop() + 316
3   com.apple.WebCore             	0x00e829d4 WebCore::IconDatabase::iconDatabaseSyncThread() + 420
4   libSystem.B.dylib             	0x936f6b98 _pthread_start + 316

Thread 2:
0   libSystem.B.dylib             	0x936bb38c __semwait_signal + 12
1   libSystem.B.dylib             	0x936f7f40 _pthread_cond_wait + 1580
2   com.apple.WebCore             	0x012dad28 WebCore::LocalStorageThread::localStorageThread() + 120
3   libSystem.B.dylib             	0x936f6b98 _pthread_start + 316

Thread 3:
0   libSystem.B.dylib             	0x936b4978 mach_msg_trap + 8
1   libSystem.B.dylib             	0x936bb89c mach_msg + 56
2   com.apple.CoreFoundation      	0x93e45618 CFRunLoopRunSpecific + 1828
3   com.apple.CFNetwork           	0x9410fb5c CFURLCacheWorkerThread(void*) + 292
4   libSystem.B.dylib             	0x936f6b98 _pthread_start + 316

Thread 4:
0   libSystem.B.dylib             	0x936b4978 mach_msg_trap + 8
1   libSystem.B.dylib             	0x936bb89c mach_msg + 56
2   com.apple.CoreFoundation      	0x93e45618 CFRunLoopRunSpecific + 1828
3   com.apple.Foundation          	0x9337d344 +[NSURLConnection(NSURLConnectionReallyInternal) _resourceLoadLoop:] + 280
4   com.apple.Foundation          	0x933264f4 __NSThread__main__ + 1004
5   libSystem.B.dylib             	0x936f6b98 _pthread_start + 316

Thread 5:
0   libSystem.B.dylib             	0x93719004 select$DARWIN_EXTSN + 12
1   com.apple.CoreFoundation      	0x93e50a68 __CFSocketManager + 764

Thread 6:
0   libSystem.B.dylib             	0x936b49f8 semaphore_timedwait_signal_trap + 8
1   libSystem.B.dylib             	0x936f7e3c _pthread_cond_wait + 1320
2   com.apple.Foundation          	0x93363898 -[NSCondition waitUntilDate:] + 384
3   com.apple.Foundation          	0x933636c4 -[NSConditionLock lockWhenCondition:beforeDate:] + 268
4   com.apple.AppKit              	0x90fe8b80 -[NSUIHeartBeat _heartBeatThread:] + 664
5   com.apple.Foundation          	0x933264f4 __NSThread__main__ + 1004
6   libSystem.B.dylib             	0x936f6b98 _pthread_start + 316

Thread 0 crashed with PPC Thread State 32:
  srr0: 0x011c240c  srr1: 0x0200f030   dar: 0x00000000 dsisr: 0x40000000
    r0: 0x00544a28    r1: 0xbfffe1f0    r2: 0x17eb9e00    r3: 0x17eb9e00
    r4: 0x96e9d630    r5: 0x00000000    r6: 0x00000001    r7: 0x00000000
    r8: 0x00000001    r9: 0x17eb9e10   r10: 0x96e93060   r11: 0x0000000c
   r12: 0x93eb9bd4   r13: 0x00000000   r14: 0x00000000   r15: 0xa01aaf64
   r16: 0x00000000   r17: 0x17ec8e10   r18: 0xa01b36f8   r19: 0xa01aca48
   r20: 0x00000000   r21: 0x00000000   r22: 0x17f84d80   r23: 0xa01b36f8
   r24: 0x195a5bd0   r25: 0x1931c820   r26: 0x17e95070   r27: 0x17e81c00
   r28: 0x17f08390   r29: 0x96ec0b08   r30: 0x00000000   r31: 0x011c23d0
    cr: 0x44022412   xer: 0x00000000    lr: 0x011c2400   ctr: 0x93eb9bd4
vrsave: 0x00000000

Binary Images:
    0x1000 -   0x13cff7  com.apple.Safari 3.1.1 (5525.18) <6350ad5d06c31ced48d4970b6c0677be> /Applications/Safari.app/Contents/MacOS/Safari
  0x180000 -   0x181fff +WebKitNightlyEnabler.dylib ??? (???) /Applications/Internet & Network/WebKit.app/Contents/Resources/WebKitNightlyEnabler.dylib
  0x185000 -   0x259fff  com.apple.WebKit 526.5+ (526.5+) /Applications/Internet & Network/WebKit.app/Contents/Frameworks/10.5/WebKit.framework/Versions/A/WebKit
  0x2ec000 -   0x2fbffc  SyndicationUI ??? (???) <c7dc7b6ce0213e8b71bedf8c8b301c2a> /System/Library/PrivateFrameworks/SyndicationUI.framework/Versions/A/SyndicationUI
  0x30b000 -   0x3eaff7  com.apple.JavaScriptCore 526.5+ (526.5+) /Applications/Internet & Network/WebKit.app/Contents/Frameworks/10.5/JavaScriptCore.framework/Versions/A/JavaScriptCore
  0xc2c000 -  0x13faff1  com.apple.WebCore 526.5+ (526.5+) /Applications/Internet & Network/WebKit.app/Contents/Frameworks/10.5/WebCore.framework/Versions/A/WebCore
 0x18c6000 -  0x18ccfff  libCGXCoreImage.A.dylib ??? (???) <4e1cd099b993b5ad9637cd0435a3a182> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGXCoreImage.A.dylib
 0x1a00000 -  0x1ae9ffb  com.apple.RawCamera.bundle 2.0.4 (2.0.4) /System/Library/CoreServices/RawCamera.bundle/Contents/MacOS/RawCamera
0x8fe00000 - 0x8fe30b23  dyld 96.2 (???) <39109181acbf30fed542e6c9abcf1798> /usr/lib/dyld
0x90053000 - 0x9005fff3  com.apple.audio.SoundManager 3.9.2 (3.9.2) <79588842bcaf6c747a95b2120304397a> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound
0x90060000 - 0x9006bff9  com.apple.helpdata 1.0 (14) /System/Library/PrivateFrameworks/HelpData.framework/Versions/A/HelpData
0x9009b000 - 0x9016afff  com.apple.ColorSync 4.5.0 (4.5.0) /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync
0x9019e000 - 0x90237fc3  libvDSP.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib
0x90238000 - 0x9023bffb  com.apple.securityhi 3.0 (30817) <e50c0cac9048f8923b95797753d50b5c> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.framework/Versions/A/SecurityHI
0x9023c000 - 0x902a3ffb  libstdc++.6.dylib ??? (???) <a4e9b10268b3ffac26d0296499b24e8e> /usr/lib/libstdc++.6.dylib
0x902b8000 - 0x9038afff  com.apple.CoreServices.OSServices 224.4 (224.4) <1972b141810adcc01c30c31fcbab5af3> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices
0x9038b000 - 0x903afffb  libGL.dylib ??? (???) /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib
0x903b0000 - 0x903b0fff  com.apple.Carbon 136 (136) <6a6a209ec9179368db7ead8382b8ee63> /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
0x903b1000 - 0x90444fff  com.apple.framework.IOKit 1.5.1 (???) <590e7f24d3cbfc072c8659173d2141e3> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x90445000 - 0x90494ff7  libGLImage.dylib ??? (???) <1b1db85f633ad1eed75cd6645ec99a5c> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib
0x90495000 - 0x904bbfff  libcups.2.dylib ??? (???) <d60807e6cfdc208c2e5520f7acb473f6> /usr/lib/libcups.2.dylib
0x904bc000 - 0x90544fff  com.apple.ink.framework 101.3 (86) <66a99ad6bc695390a66dd24789e23dcc> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink
0x90545000 - 0x90553fff  libz.1.dylib ??? (???) <1a70dd3594a8c5ad39d785af5da23237> /usr/lib/libz.1.dylib
0x90554000 - 0x90604fff  edu.mit.Kerberos 6.0.12 (6.0.12) <9a85ee3fd8fb95d4537725b035297fe7> /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos
0x90952000 - 0x90965fff  com.apple.LangAnalysis 1.6.4 (1.6.4) <c184bb5b2859e82c5740a6fdb1e3d0bc> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis
0x90966000 - 0x90edaff7  com.apple.CoreGraphics 1.351.21 (???) <44bbf8c3a4e8bc97e8b3e35737001742> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
0x90f46000 - 0x90f49fff  com.apple.help 1.1 (36) <7106d6e074a3b9835ebf1e6cc6c822ce> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framework/Versions/A/Help
0x90f4a000 - 0x90f50ffb  com.apple.backup.framework 1.0 (1.0) /System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup
0x90f51000 - 0x916c6fff  com.apple.AppKit 6.5.2 (949.26) <8d6ce96921254cbc787b9fe0526bef42> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
0x91707000 - 0x91709ffd  libRadiance.dylib ??? (???) <3d70fcb7557347829c96c9753074b3f1> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib
0x9170a000 - 0x91733ffb  com.apple.shortcut 1 (1.0) <032016a45147a2f3f191ce70187587c9> /System/Library/PrivateFrameworks/Shortcut.framework/Versions/A/Shortcut
0x9183b000 - 0x91984ffb  com.apple.ImageIO.framework 2.0.1 (2.0.1) <ea98d04f3ecfec65edfafe3796d6d442> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/ImageIO
0x91985000 - 0x91986fff  libffi.dylib ??? (???) <11b77dbce4aa0f0b66d40014230abd1d> /usr/lib/libffi.dylib
0x9278f000 - 0x927baff7  libauto.dylib ??? (???) <b3a3a4b0f09653bd6d58f1847922b533> /usr/lib/libauto.dylib
0x927bb000 - 0x927f0fff  com.apple.AE 402.2 (402.2) <0b15a08da8ec38b74fb9dd6e579ed25f> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE
0x927f1000 - 0x9281bff7  libssl.0.9.7.dylib ??? (???) <5dac2e94552ad76696c35bd6886f5a92> /usr/lib/libssl.0.9.7.dylib
0x929bd000 - 0x92a6dfff  com.apple.QD 3.11.52 (???) <f33191c288897dd4d2e2c4b87bcc09b4> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD
0x92a6e000 - 0x92ae9fff  com.apple.SearchKit 1.2.0 (1.2.0) <1b448fbae02460eae76ee1c6883f45d6> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit
0x92aea000 - 0x92b02ffb  com.apple.DictionaryServices 1.0.0 (1.0.0) <fe37191e732eeb66189185cd000a210b> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices
0x92b03000 - 0x92b92ffb  com.apple.DesktopServices 1.4.5 (1.4.5) <b6bd34467a57cc899612152caac2a789> /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv
0x92b93000 - 0x92bf3fff  com.apple.CoreText 2.0.1 (???) <2ecbcac842c4864bdd3de0a68e4d2f2c> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreText.framework/Versions/A/CoreText
0x92c21000 - 0x92c23fff  com.apple.CrashReporterSupport 10.5.0 (156) <906c8d99acdeb122551a99cd930bf32f> /System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport
0x92c24000 - 0x92f5dff3  com.apple.HIToolbox 1.5.2 (???) <687d476c6a3809efaba68bc11dc894c1> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
0x92f5e000 - 0x92f77fff  com.apple.CoreVideo 1.5.0 (1.5.0) <aebfdc3d092810ff35a8e92b8f966010> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo
0x92f78000 - 0x92fbeff9  com.apple.securityinterface 3.0 (32532) <82a438eff282dd1dc1f803dfd91b5f38> /System/Library/Frameworks/SecurityInterface.framework/Versions/A/SecurityInterface
0x92fbf000 - 0x9331cff2  com.apple.QuartzCore 1.5.1 (1.5.1) <f364682e96d58c5849cad532f6bf2f91> /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
0x9331d000 - 0x93561ffb  com.apple.Foundation 6.5.4 (677.15) <0cb0eec2a47f915404236f64abf7c384> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x93562000 - 0x93670fff  com.apple.PubSub 1.0.3 (65.1) /System/Library/Frameworks/PubSub.framework/Versions/A/PubSub
0x93671000 - 0x93691ff7  libJPEG.dylib ??? (???) <92341083256fbcd28888a179ebf941ef> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib
0x93692000 - 0x93692ffb  com.apple.installserver.framework 1.0 (8) /System/Library/PrivateFrameworks/InstallServer.framework/Versions/A/InstallServer
0x93693000 - 0x936b2fff  com.apple.vecLib 3.4.2 (vecLib 3.4.2) /System/Library/Frameworks/vecLib.framework/Versions/A/vecLib
0x936b3000 - 0x9384cfe3  libSystem.B.dylib ??? (???) <754231f5e52ed8418f89f1f3369caf58> /usr/lib/libSystem.B.dylib
0x93859000 - 0x938dafff  com.apple.print.framework.PrintCore 5.5.2 (245.1) <df7cf3aa9f046c543b9e27f08860b692> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore
0x938db000 - 0x938dbfff  com.apple.Accelerate 1.4.2 (Accelerate 1.4.2) /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
0x938dc000 - 0x938e7ffb  libgcc_s.1.dylib ??? (???) <ea47fd375407f162c76d14d64ba246cd> /usr/lib/libgcc_s.1.dylib
0x938e8000 - 0x938f5ff3  com.apple.opengl 1.5.6 (1.5.6) <4ec145eba41b94cff1322a041dfdb437> /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL
0x938f6000 - 0x9398cff3  com.apple.LaunchServices 286.5 (286.5) <1a1a73b91deacb172d15745ec73e5959> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices
0x9398d000 - 0x939ceffb  libTIFF.dylib ??? (???) <0d0a3107d26786c3708e6a511d5acec9> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib
0x939cf000 - 0x939eaff3  com.apple.DirectoryService.Framework 3.5.1 (3.5.1) <0bd4cfb69d5de8ecff3c61e32837fdf0> /System/Library/Frameworks/DirectoryService.framework/Versions/A/DirectoryService
0x939eb000 - 0x93a06ffb  com.apple.openscripting 1.2.6 (???) <12270fbb14905644f78975f227328a98> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting.framework/Versions/A/OpenScripting
0x93a07000 - 0x93a63ffb  com.apple.HIServices 1.7.0 (???) <48d200891cc9dd795ee547d526c6a45b> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices
0x93a64000 - 0x93aa0fff  libRIP.A.dylib ??? (???) <7bc908a7317a00fe3c659571c50cdd46> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libRIP.A.dylib
0x93aa1000 - 0x93ad6ffb  com.apple.LDAPFramework 1.4.3 (106) <d9a3a16b2d468683b68f714d11196d7b> /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
0x93ad7000 - 0x93b5effb  com.apple.audio.CoreAudio 3.1.0 (3.1) <880a5a35ef1c5158271ee4b305b35626> /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
0x93b5f000 - 0x93b67ffb  libCGATS.A.dylib ??? (???) <f08869e380cd4b55e14714fe723cbc66> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGATS.A.dylib
0x93b68000 - 0x93b7bffb  com.apple.speech.synthesis.framework 3.6.59 (3.6.59) <7c299626d6167de473e85327699cdb9c> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis
0x93b7c000 - 0x93b93ffb  com.apple.ImageCapture 4.0 (5.0.0) /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture.framework/Versions/A/ImageCapture
0x93bb0000 - 0x93c6afff  libcrypto.0.9.7.dylib ??? (???) <4ea3d7e9a1c28ac7b17ed80873fe6598> /usr/lib/libcrypto.0.9.7.dylib
0x93d90000 - 0x93ddbffb  com.apple.Metadata 10.5.2 (398.7) <f0c3c28205af67a29a2ed728ee297648> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata
0x93ddc000 - 0x93f01ffb  com.apple.CoreFoundation 6.5.1 (476.10) <e71eaa358523eae0e45280bca8a90e98> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x93fd0000 - 0x93fd4ffe  libGIF.dylib ??? (???) <d6e2a570359313a39c6783c2ecfee608> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib
0x93fd5000 - 0x93fe5fff  libsasl2.2.dylib ??? (???) <18935d5e775962f4728b91189b092d45> /usr/lib/libsasl2.2.dylib
0x93fe6000 - 0x94104ff7  com.apple.audio.toolbox.AudioToolbox 1.5.1 (1.5.1) /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
0x94105000 - 0x9417fffd  com.apple.CFNetwork 221.5 (221.5) <ef2672379d6fcb1470dc9361ce68e7f7> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
0x94180000 - 0x94188fff  libbsm.dylib ??? (???) <c1fca3cbe3b1c21e9b31bc89b920f34c> /usr/lib/libbsm.dylib
0x94189000 - 0x941d0fff  com.apple.NavigationServices 3.5.1 (161) <b245f17b2b2902e1f9eeaaa6773f8126> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/NavigationServices.framework/Versions/A/NavigationServices
0x942c8000 - 0x942d1fff  com.apple.DiskArbitration 2.2.1 (2.2.1) <a389b4c2badce39540f24402f7df35e7> /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
0x942d2000 - 0x944b5ffb  com.apple.security 5.0.2 (33001) <5e841904ba22d381672679180d4b0f4a> /System/Library/Frameworks/Security.framework/Versions/A/Security
0x944b6000 - 0x948ebffa  libGLProgrammability.dylib ??? (???) <6d71574167a838789ab0ee27f92af626> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLProgrammability.dylib
0x948ec000 - 0x948ecff8  com.apple.Cocoa 6.5 (???) <e9a4f1c636d00893db0494c4040176ba> /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa
0x948ed000 - 0x948f4ffb  com.apple.print.framework.Print 218.0.2 (220.1) <c7e0e618d5867ae227403ae385aacd82> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framework/Versions/A/Print
0x948f5000 - 0x948f6ff8  com.apple.ApplicationServices 34 (34) <6aa5ee485bb2e656531b3505932b845f> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
0x948f7000 - 0x94eb1fff  libBLAS.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib
0x94eb2000 - 0x94f08fff  libGLU.dylib ??? (???) /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib
0x94faa000 - 0x950f2ff3  libicucore.A.dylib ??? (???) <250daed2fb2e6bf114480e2e4da0728b> /usr/lib/libicucore.A.dylib
0x950f3000 - 0x951dcfff  libxml2.2.dylib ??? (???) <271fc4d25f101b60a8e7514d1c32a91c> /usr/lib/libxml2.2.dylib
0x953b3000 - 0x95438fff  libsqlite3.0.dylib ??? (???) <f2a33fe2663eab9c7f4806d2cf05b4ee> /usr/lib/libsqlite3.0.dylib
0x95439000 - 0x95458fff  libresolv.9.dylib ??? (???) <181fb3defd2942f00201507cfa4efdb5> /usr/lib/libresolv.9.dylib
0x95459000 - 0x95459ffa  com.apple.CoreServices 32 (32) <42b6dda539f7411606187335d9eae0c5> /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
0x95586000 - 0x9558bff6  libmathCommon.A.dylib ??? (???) /usr/lib/system/libmathCommon.A.dylib
0x95592000 - 0x9559dfff  com.apple.speech.recognition.framework 3.7.24 (3.7.24) <ae3dc890a43a9269388301f6b59d3091> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition
0x9559f000 - 0x955acfff  libCSync.A.dylib ??? (???) <e7073e93982e6872ed72e5873b791462> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib
0x95639000 - 0x95639fff  com.apple.audio.units.AudioUnit 1.5 (1.5) /System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit
0x9563a000 - 0x9569fffb  com.apple.ISSupport 1.6 (34) /System/Library/PrivateFrameworks/ISSupport.framework/Versions/A/ISSupport
0x956a0000 - 0x956d8fff  com.apple.SystemConfiguration 1.9.1 (1.9.1) <50bc5b4d50a2e1f7743e729381467537> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
0x956d9000 - 0x956f4ffb  libPng.dylib ??? (???) <c51ec88c87a3f0a646471165e16acd43> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
0x956f5000 - 0x95733ff7  libtidy.A.dylib ??? (???) <5ed7eaf2c53383f5bf92fa2b8cd9d16d> /usr/lib/libtidy.A.dylib
0x95734000 - 0x957befff  libvMisc.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib
0x957bf000 - 0x958d3ffa  com.apple.vImage 3.0 (3.0) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage
0x9593a000 - 0x9596bfff  com.apple.coreui 1.1 (61) /System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI
0x95c98000 - 0x95d5dffb  com.apple.CoreData 100.1 (186) <9cf54cb19b18e53ee22edb7ababa6e6c> /System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
0x95d5e000 - 0x96087fe7  libLAPACK.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib
0x9615b000 - 0x96182fff  libxslt.1.dylib ??? (???) <3700d04090629deddb436aa2d516c56d> /usr/lib/libxslt.1.dylib
0x96183000 - 0x9618afff  com.apple.CommonPanels 1.2.4 (85) <0d1256175c5512c911ede094d767acfe> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels.framework/Versions/A/CommonPanels
0x9618f000 - 0x96229ff7  com.apple.ApplicationServices.ATS 3.2 (???) <4258842969dc8d4fa37e01a80aa3d409> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS
0x9622a000 - 0x9628cffb  com.apple.htmlrendering 68 (1.1.3) <e852db1c007de975fae2f0c2769c88ef> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HTMLRendering.framework/Versions/A/HTMLRendering
0x96293000 - 0x963feff9  com.apple.AddressBook.framework 4.1 (687.1) <8ba1dd324b1e390989a1d0c952d95cd7> /System/Library/Frameworks/AddressBook.framework/Versions/A/AddressBook
0x963ff000 - 0x9643cffe  com.apple.securityfoundation 3.0 (32989) <ad2dd4c797fa2ba4c656f82936f9fb83> /System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation
0x9643d000 - 0x9673eff7  com.apple.CoreServices.CarbonCore 785.8 (785.8) <d56076bc0fe62dd58002bdd581a3f3c0> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
0x96e21000 - 0x96e40fff  com.apple.Accelerate.vecLib 3.4.2 (vecLib 3.4.2) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib
0x96e41000 - 0x96e50fff  com.apple.DSObjCWrappers.Framework 1.2.1 (1.2.1) <651e2b4d7e19d43f520829f76216f2c2> /System/Library/PrivateFrameworks/DSObjCWrappers.framework/Versions/A/DSObjCWrappers
0x96e84000 - 0x96f67feb  libobjc.A.dylib ??? (???) <23a407d7dac6090562827e97bac3cb86> /usr/lib/libobjc.A.dylib
0xfffec000 - 0xfffeffff  libobjc.A.dylib ??? (???) /usr/lib/libobjc.A.dylib
0xffff8000 - 0xffff9703  libSystem.B.dylib ??? (???) /usr/lib/libSystem.B.dylib

[Mark Rowe (bdash)]

Thanks for the detailed report + test case!

[Mark Rowe (bdash)]

<rdar://problem/5923166>

[Anders Carlsson]

I just tried this with r34728 and could not reproduce the problem. (It was reproducible with r32945 though).