Apple Crash Reporter thinks Breakpad is crashing

[GoogleCodeExporter]

After Breakpad picks up my crashes and hands them off to Apple Crash 
Reporter, ReportCrash seems to think that Breakpad has crashed:

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x000000000247c4d0
Crashed Thread:  2
[...]
Thread 2 Crashed:
0   com.google.Chrome.framework     0x004cd9a7 
google_breakpad::ExceptionHandler::WaitForMessage(void*) + 1191 
(exception_handler.cc:609)
1   libSystem.B.dylib               0x91ba1fbd _pthread_start + 345
2   libSystem.B.dylib               0x91ba1e42 thread_start + 34

exception_handler.cc:609 is actually in 
google_breakpad::ExceptionHandler::UninstallHandler(bool):

    previous_ = NULL;

This is in an optimized build, so UninstallHandler is being called by one of 
the sites in WaitForMessage, and the crash might not be happening at 
exactly this line.  (Indeed, there are other things in the UninstallHandler 
that use previous_ before it's set to NULL.)

Is it possible that WaitForMessage is still running after ExceptionHandler 
has been deleted?

This isn't a huge problem for Chrome right now because the stacks that 
Breakpad produces are correct, and it's just Crash Reporter that's 
pinpointing the wrong thing as the crash.  We don't ship with symbols 
anyway, so while there is some potential for confusion, it's really minimal.

Reproduction steps for the above crash are from http://crbug.com/26754 
comment 9 (using a 249-branch Chrome build - 249.12 should work) 
although it probably happens with other crashes.

     3. Test case from bug 26754 comment 9 (affected machines only):
         a. Have lots of bookmarks (import Safari defaults)
         b. Right-click on bookmark bar, and choose "Open All Bookmarks"
        Expect: no crash.

Original issue reported on code.google.com by mark@chromium.org on 30 Nov 2009 at 5:20

[GoogleCodeExporter]

Mark, is this the same thing as the "off-by-one errors" I poorly describe in
https://bugzilla.mozilla.org/show_bug.cgi?id=417601#c1 items 1/1a (which we see 
100%
of the time in Apple crash reports for Camino-with-Breakpad), or something 
completely
different that superficially looks the same?

Original comment by smokey.ardisson@gmail.com on 30 Nov 2009 at 7:43

[GoogleCodeExporter]

Yes, it sounds like the same thing.  Breakpad picks up the "real" crash, but 
then seems 
to crash again itself instead of passing it along to the Apple Crash Reporter.  
ReportCrash then sees Breakpad's crash instead of the crash that Breakpad 
caught.

Original comment by mark@chromium.org on 30 Nov 2009 at 7:49

[GoogleCodeExporter]

Is this the same as issue 334?

Original comment by ted.mielczarek on 30 Nov 2009 at 9:14