Comments on: RAOperationQueue, an open-source replacement for NSOperationQueue

By: Mike Ash

Mike Ash — Wed, 03 Dec 2008 04:59:57 +0000

gparker: Thanks for pointing that out. If anyone has a nice patch for GC compatibility, feel free to send it in. It appears that it should be pretty straightforward to fix but I didn’t look all that closely.

By: gparker

gparker — Wed, 03 Dec 2008 03:48:22 +0000

RAOperationQueue is not GC-safe. The problem is RAAtomicListNode, which is a malloc block that is used to store pointers to RAOperation objects. The garbage collector will delete RAOperations even if they’re still in the list.

By: Mike Ash

Mike Ash — Wed, 03 Dec 2008 03:11:11 +0000

dave: That’s just the thing, we aren’t reusing existing NSOperations. You can’t do that. The system takes one-shot NSOperations and, every so often, tries to run one of them twice. Hilarity ensues.

Details here: http://www.mikeash.com/?page=pyblog/dont-use-nsoperationqueue.html

By: dave

dave — Wed, 03 Dec 2008 00:40:43 +0000

You couldn’t just create a new NSOperation’s instead of reusing existing ones to avoid the crash?

By: Steven Fisher

Steven Fisher — Tue, 02 Dec 2008 22:32:02 +0000

Oh, I thought it was something exploitable. I guess I have a poor memory today. Thanks for straightening me out on that. :)

By: Mike Ash

Mike Ash — Tue, 02 Dec 2008 20:52:51 +0000

Steven: The crash is due to an uncaught exception which is thrown by an assertion failure when an NSOperation is executed twice. (They are designed to only execute once.) I really doubt that it’s a security problem but I certainly could be wrong.

Andy: We’ve only been using it on 10.5 but as far as I can see there’s nothing which would prevent it from working on 10.4. I think that the OSAtomicCompareAndSwapPtrBarrier function may not be available on 10.4, but that can easily be replaced with one of the other CAS functions which are.

By: Tim Buchheim

Tim Buchheim — Tue, 02 Dec 2008 20:29:21 +0000

Steve has a good point. Typically the fastest way to get a bug fixed by Apple is to look for some way to exploit the bug to create a security problem. This may or may not be possible in this case, but if someone can find some sort of exploit, then that will get Apple’s attention and will eventually lead to a fix.

By: Andy Mroczkowski

Andy Mroczkowski — Tue, 02 Dec 2008 19:32:08 +0000

Thanks for contributing this to the community?

One question: what is the minimum OS requirement (10.4, 10.5)?

By: Steven Fisher

Steven Fisher — Tue, 02 Dec 2008 19:27:58 +0000

If NSOperationQueue crashes, isn’t it likely it’s executing something it shouldn’t and will be fixed as part of a security update?