Issue 109000 - [Mac OS X] crash when removing entries in toolbar
Summary: [Mac OS X] crash when removing entries in toolbar
Status: CONFIRMED
Alias: None
Product: porting
Classification: Code
Component: MacOSX (show other issues)
Version: DEV300m68
Hardware: Mac Mac OS X 10.4
: P2 Trivial (vote)
Target Milestone: ---
Assignee: AOO issues mailing list
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-02-05 23:19 UTC by eric.bachard
Modified: 2013-01-29 21:43 UTC (History)
2 users (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: ---
Developer Difficulty: ---


Attachments
simple patch , to fix the crashes (504 bytes, patch)
2010-02-05 23:22 UTC, eric.bachard
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this issue.
Description eric.bachard 2010-02-05 23:19:29 UTC
crash fully repeatable on Mac OS X 10.4.11  Intel 

crash fully reproductible :  try to remove several entries on the toolbars 

Stack with stripped libs : 

Thread 0 Crashed:
0   libobjc.A.dylib          	0x90a5a092 _objc_search_builtins + 24
1   libobjc.A.dylib          	0x90a59fd6 __sel_registerName + 38
2   libobjc.A.dylib          	0x90a59e9d fixupSelectorsInMethodList + 131
3   libobjc.A.dylib          	0x90a59621 _class_lookupMethodAndLoadCache + 233
4   libobjc.A.dylib          	0x90a59506 objc_msgSend + 86
5   com.apple.CoreFoundation 	0x90824fbc __CFDictionaryDeallocate + 460
6   com.apple.CoreFoundation 	0x9080e109 _CFRelease + 188
7   com.apple.Foundation     	0x927db8af NSPopAutoreleasePool + 530
8   libvclmxi.dylib          	0x024ce0db ReleasePoolHolder::~ReleasePoolHolder [in-charge]() + 39 
(salinst.cxx:671)
9   libvclmxi.dylib          	0x023a2f30 AquaSalInstance::Yield(bool, bool) + 1546 (salinst.cxx:805)

-> I added symbols in libvcl, sfx2 and framework, and finally, gdb leads me regularly to :

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x0b8395bb
0x90a59eb5 in fixupSelectorsInMethodList ()

with the stack :

(gdb) bt
#0  0x90a59eb5 in fixupSelectorsInMethodList ()
#1  0x90a59621 in _class_lookupMethodAndLoadCache ()
#2  0x90a59506 in objc_msgSend ()
#3  0x90824fbc in __CFDictionaryDeallocate ()
#4  0x9080e109 in _CFRelease ()

After some tries, I think I found the real cause : an extra release in ReleasePoolHolder::~ReleasePoolHolder  ( vcl/aqua/salinst.cxx line around 679 )

Remonving the [pool release]  fixed all the crashes, but maybe introduces a leak ..
 
@pl : I'll attach a patch, but I'm not sure the patch occurs elsewhere than Tiger ( not Leopard on my 
machines)
Comment 1 eric.bachard 2010-02-05 23:21:26 UTC
Crash reproduced with OOO320_m12, DEV300_m68 too 
Comment 2 eric.bachard 2010-02-05 23:22:10 UTC
Created attachment 67666 [details]
simple patch , to fix the crashes
Comment 3 eric.bachard 2010-02-05 23:22:39 UTC
Raising prio to 2, because crash


Comment 4 eric.bachard 2010-02-05 23:24:09 UTC
Not sure all Mac OS X are concerned : changing for 10.4 only
Comment 5 eric.bachard 2010-02-05 23:27:25 UTC
Adjusting summary
Comment 6 eric.bachard 2010-02-05 23:41:22 UTC
@pl : s/the patch occurs/the crash occurs/
Comment 7 eric.bachard 2010-02-06 00:19:49 UTC
The patch does not fix the crash, who occurs when I quit the application, means some refcount is wrong 
somewhere (yet on Mac OS X10.4, no idea with the other versions of Mac OS X.)
Comment 8 philipp.lohmann 2010-02-12 14:27:52 UTC
Sorry, I have not been able to reproduce the crash, on MacOSX 10.4 or 10.6. I
removed some buttons from the "Standard" toolbar in writer. No crash.

Is there something else I need to do to see this crash ?
Comment 9 eric.bachard 2010-02-13 09:32:01 UTC
Hi Philipp,

To reproduce the crash I use to open an empty Draw document. 

Steps to reproduce :  simply uncheck several entries in the "Line" toolbar (sorry I only have the "Ligne et 
remplissage" name  at hand).

Expected:  the unchecked icons must no longer appear in the toolbar
Seen : crashes. 

Fully reproduceable

Once back at home (in two days), I'll try with 3.2.0rc5, to see whether I can reproduce (was the case 
with 3.2.0rc4). Last, I got 10.4.11 installed