Race condition crash in -sizeWithFont:constrainedToSize:lineBreakMode:

Originator:futuretap
Number:rdar://12155059 Date Originated:23-Aug-2012 12:37 AM
Status:Duplicate/9961221/Closed Resolved:
Product:iPhone SDK Product Version:6.0 beta 4
Classification:Crash/Hang/Data Loss Reproducible:Unable
 
I use -[NSString(UIStringDrawing) sizeWithFont:constrainedToSize:lineBreakMode:] in a background thread. As far as I understand the rules, this should be OK since this doesn't draw on the screen.

Nevertheless, it just crashed with EXC_BAD_ACCESS in the background thread.

I found that simultaneously a similar operation was going on in the main thread. Is this perhaps not re-entrant?


Back traces:

(lldb) bt
* thread #20: tid = 0x3603, 0x0ba781e0, stop reason = EXC_BAD_ACCESS (code=2, address=0xba781e0)
    frame #0: 0x0ba781e0
    frame #1: 0x05c9c42e WebCore`WebCore::Font::Font(WebCore::FontPlatformData const&, WTF::PassRefPtr<WebCore::FontSelector>) + 142
    frame #2: 0x0583ef3a WebKit`_ZL15rendererForFontP8__GSFont + 218
    frame #3: 0x0583faf8 WebKit`-[NSString(WebStringDrawing) __web_drawInRect:withFont:ellipsis:alignment:letterSpacing:lineSpacing:includeEmoji:truncationRect:measureOnly:renderedStringOut:drawUnderline:] + 152
    frame #4: 0x05841a68 WebKit`-[NSString(WebStringDrawing) __web_drawInRect:withFont:ellipsis:alignment:letterSpacing:lineSpacing:includeEmoji:truncationRect:measureOnly:renderedStringOut:] + 136
    frame #5: 0x05841af1 WebKit`-[NSString(WebStringDrawing) __web_drawInRect:withFont:ellipsis:alignment:letterSpacing:lineSpacing:includeEmoji:truncationRect:measureOnly:] + 129
    frame #6: 0x058421a6 WebKit`-[NSString(WebStringDrawing) _web_drawInRect:withFont:ellipsis:alignment:lineSpacing:includeEmoji:truncationRect:measureOnly:] + 118
    frame #7: 0x0584237c WebKit`-[NSString(WebStringDrawing) _web_sizeInRect:withFont:ellipsis:lineSpacing:] + 108
    frame #8: 0x01bfe39c UIKit`-[NSString(UIStringDrawing) sizeWithFont:constrainedToSize:lineBreakMode:lineSpacing:] + 183
    frame #9: 0x01bfe2e0 UIKit`-[NSString(UIStringDrawing) sizeWithFont:constrainedToSize:lineBreakMode:] + 77
    frame #10: 0x000863e8 WhereToHD`-[NSString(Additions) stringByTruncatingStringWithFont:size:lineBreakMode:truncateReplacementString:appendString:] + 968 at NSString+Additions.m:272
    frame #11: 0x00085eb7 WhereToHD`-[NSString(Additions) stringByTruncatingStringWithFont:width:lineBreakMode:truncateReplacementString:] + 231 at NSString+Additions.m:240
    frame #12: 0x00085d08 WhereToHD`-[NSString(Additions) stringByTruncatingStringWithFont:width:lineBreakMode:truncateReplacementString:alwaysTruncateRegex:] + 120 at NSString+Additions.m:231
    frame #13: 0x0003545d WhereToHD`+[GoogleReviewsDataSource reviewsFromResponse:] + 1677 at GoogleReviewsDataSource.m:148
    frame #14: 0x000311de WhereToHD`-[GoogleDetailDataSource startInThread] + 13454 at GoogleDetailDataSource.m:252
    frame #15: 0x000278f3 WhereToHD`-[FTBackgroundOperation startInThreadWrapper] + 99 at FTBackgroundOperation.m:41
    frame #16: 0x026d1145 Foundation`-[NSThread main] + 76
    frame #17: 0x026d10a4 Foundation`__NSThread__main__ + 1304
    frame #18: 0x90b36ed9 libsystem_c.dylib`_pthread_start + 335


Main Thread:

(lldb) bt
* thread #1: tid = 0x1f03, 0x0ba781e0, stop reason = EXC_BAD_ACCESS (code=2, address=0xba781e0)
    frame #0: 0x0ba781e0
    frame #1: 0x05c9c42e WebCore`WebCore::Font::Font(WebCore::FontPlatformData const&, WTF::PassRefPtr<WebCore::FontSelector>) + 142
    frame #2: 0x0583ef3a WebKit`_ZL15rendererForFontP8__GSFont + 218
    frame #3: 0x0583e9ac WebKit`-[NSString(WebStringDrawing) __web_drawAtPoint:forWidth:withFont:ellipsis:letterSpacing:includeEmoji:measureOnly:renderedStringOut:drawUnderline:] + 108
    frame #4: 0x0583f9d9 WebKit`-[NSString(WebStringDrawing) __web_drawAtPoint:forWidth:withFont:ellipsis:letterSpacing:includeEmoji:measureOnly:renderedStringOut:] + 121
    frame #5: 0x0583fa52 WebKit`-[NSString(WebStringDrawing) __web_drawAtPoint:forWidth:withFont:ellipsis:letterSpacing:includeEmoji:measureOnly:] + 114
    frame #6: 0x0584212a WebKit`-[NSString(WebStringDrawing) _web_drawAtPoint:forWidth:withFont:ellipsis:letterSpacing:includeEmoji:] + 106
    frame #7: 0x01bfdf1b UIKit`-[NSString(UIStringDrawing) drawAtPoint:forWidth:withFont:lineBreakMode:letterSpacing:includeEmoji:] + 179
    frame #8: 0x01d3052b UIKit`-[UILabel _legacy_drawTextInRect:baselineCalculationOnly:] + 2577
    frame #9: 0x01d30986 UIKit`-[UILabel _drawTextInRect:baselineCalculationOnly:] + 160
    frame #10: 0x01d2f6e9 UIKit`-[UILabel drawTextInRect:] + 548
    frame #11: 0x01d31aa8 UIKit`-[UILabel drawRect:] + 98
    frame #12: 0x01c23ea8 UIKit`-[UIView(CALayerDelegate) drawLayer:inContext:] + 504
    frame #13: 0x01aedb59 QuartzCore`-[CALayer drawInContext:] + 128
    frame #14: 0x01aeda85 QuartzCore`_ZL16backing_callbackP9CGContextPv + 96
    frame #15: 0x019ff843 QuartzCore`CABackingStoreUpdate_ + 2703
    frame #16: 0x01aed956 QuartzCore`CA::Layer::display_() + 1406
    frame #17: 0x01aedad4 QuartzCore`-[CALayer _display] + 33
    frame #18: 0x01aed3d0 QuartzCore`CA::Layer::display() + 152
    frame #19: 0x01aedaae QuartzCore`-[CALayer display] + 33
    frame #20: 0x01ae2216 QuartzCore`CA::Layer::display_if_needed(CA::Transaction*) + 328
    frame #21: 0x01ae2290 QuartzCore`CA::Layer::layout_and_display_if_needed(CA::Transaction*) + 38
    frame #22: 0x01a60268 QuartzCore`CA::Context::commit_transaction(CA::Transaction*) + 324
    frame #23: 0x01a613d3 QuartzCore`CA::Transaction::commit() + 395
    frame #24: 0x01a61a8e QuartzCore`CA::Transaction::observer_callback(__CFRunLoopObserver*, unsigned long, void*) + 96
    frame #25: 0x032110de CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 30
    frame #26: 0x0321101d CoreFoundation`__CFRunLoopDoObservers + 381
    frame #27: 0x031eed82 CoreFoundation`__CFRunLoopRun + 1106
    frame #28: 0x031ee504 CoreFoundation`CFRunLoopRunSpecific + 276
    frame #29: 0x031ee3db CoreFoundation`CFRunLoopRunInMode + 123
    frame #30: 0x03605823 GraphicsServices`GSEventRunModal + 88
    frame #31: 0x036056a8 GraphicsServices`GSEventRun + 104
    frame #32: 0x01bd418c UIKit`UIApplicationMain + 1211
    frame #33: 0x000024c4 WhereToHD`main + 84 at main.m:17

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!