At 23:21 +0200 14/8/09, Hans-Peter Jansen wrote:

Damien, yes, this looks fishy, and I eliminated the fork completely already. Unfortunately, it doesn't change its behavior.

Either you didn't eliminate the fork, or there is more than one fork happening and you've only eliminated one of them. The symptom you're seeing (two icons in the dock) only occurs when two different processes both check in to the application-level process management system. In situations like this I find the following DTrace script to be useful. It shows you exactly which processes get launched, with enough information to work out their parent/child relationships. IMPORTANT: Sort the output by the timestamp. On multi-core machines, DTrace can report things out of order. S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware #! /usr/sbin/dtrace -q -s /* File: QProcSnoop.d Contains: Logs process start and stop. Written by: DTS Copyright: Copyright (c) 2008 Apple Inc. All Rights Reserved. Disclaimer: IMPORTANT: This Apple software is supplied to you by Apple Inc. ("Apple") in consideration of your agreement to the following terms, and your use, installation, modification or redistribution of this Apple software constitutes acceptance of these terms. If you do not agree with these terms, please do not use, install, modify or redistribute this Apple software. In consideration of your agreement to abide by the following terms, and subject to these terms, Apple grants you a personal, non-exclusive license, under Apple's copyrights in this original Apple software (the "Apple Software"), to use, reproduce, modify and redistribute the Apple Software, with or without modifications, in source and/or binary forms; provided that if you redistribute the Apple Software in its entirety and without modifications, you must retain this notice and the following text and disclaimers in all such redistributions of the Apple Software. Neither the name, trademarks, service marks or logos of Apple Inc. may be used to endorse or promote products derived from the Apple Software without specific prior written permission from Apple. Except as expressly stated in this notice, no other rights or licenses, express or implied, are granted by Apple herein, including but not limited to any patent rights that may be infringed by your derivative works or by other works in which the Apple Software may be incorporated. The Apple Software is provided by Apple on an "AS IS" basis. APPLE MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, REGARDING THE APPLE SOFTWARE OR ITS USE AND OPERATION ALONE OR IN COMBINATION WITH YOUR PRODUCTS. IN NO EVENT SHALL APPLE BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ARISING IN ANY WAY OUT OF THE USE, REPRODUCTION, MODIFICATION AND/OR DISTRIBUTION OF THE APPLE SOFTWARE, HOWEVER CAUSED AND WHETHER UNDER THEORY OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, EVEN IF APPLE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* IMPORTANT: To get an accurate timeline of events, you must sort the output of this script by the leading timestamp. Without this some event will be displayed out of order on machines with more than one core (due to the way DTrace is implemented within the kernel). */ /* ***** fork/vfork/spawn ***** */ /* Check for the successful case. */ proc:::create { printf("%u %20s %5d fork %d\n", timestamp, execname, pid, args[0]->pr_pid); } /* Check for the unsuccessful case. */ syscall::fork:return, syscall::vfork:return, syscall::posix_spawn:return / arg0 < 0 / { printf("%u %20s %5d %s FAILED %d\n", timestamp, execname, pid, probefunc, errno); } /* ***** exec ***** */ /* This is a pretty standard sequence for capture execs that allows us to show the old and new names of the process. */ proc:::exec { self->oldName = execname; self->newName = args[0]; } proc:::exec-success / self->oldName != 0 / { printf("%u %20s %5d exec %s\n", timestamp, self->oldName, pid, self->newName); self->oldName = 0; self->newName = 0; } proc:::exec-failure / self->oldName != 0 / { printf("%u %20s %5d exec %s FAILED %d\n", timestamp, self->oldName, pid, self->newName, arg0); self->oldName = 0; self->newName = 0; } /* ***** exit ***** */ /* proc_exit doesn't get the exit status as an argument (it's argument is always CLD_EXITED == 1 on Mac OS X). So we capture the exit status by watching for the process calling exit. We communicate that to the proc_exit by way of gExitStatus. This ensures that we only print a single line of exit information. We need gExitStatusValid because an exit status of 0 is valid. */ int gExitStatusValid[int]; int gExitStatus[int]; syscall::exit:entry { gExitStatusValid[pid] = 1; gExitStatus[pid] = arg0; } proc:::exit / gExitStatusValid[pid] == 0 / { printf("%u %20s %5d exit ?\n", timestamp, execname, pid); } proc:::exit / gExitStatusValid[pid] != 0 / { printf("%u %20s %5d exit %d\n", timestamp, execname, pid, gExitStatus[pid]); gExitStatusValid[pid] = 0; gExitStatus[pid] = 0; }

At 17:46 +0200 17/8/09, Hans-Peter Jansen wrote:

Oh well... What I don't understand is, how both processes could check into process management?

This may tell you... <http://developer.apple.com/technotes/tn2004/tn2124.html#SECPROCESSMANAGER> S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware