Odd Crash in Swift, related to setting sublayers to nil - ios

This is a follow on to this question. In this routine,
func tableView(_ tableView: UITableView, didSelectRowAt indexPath: IndexPath) {
Tracker.track("getting row \(indexPath.row)")
let ptv = tableView as? NovilloTableView
if ptv!.uiType == .textTable {
let gp = Projects.currentProject?.getPaths(type: PaletteView.getCurrentPane())
GitPaths.currentGitPath = gp![indexPath.row]
// NotificationCenter.default.post(name: NNames.updateWebText.nn(), object: nil)
return
}
let svgs = Projects.currentProject!.getPaths(type : PaletteView.getCurrentPane())
var gitPath = svgs[indexPath.row]
Tracker.track("gitpath is \(gitPath)")
var gitPaths = GitPaths.getMediaBoundingBoxes(paths: [gitPath])
guard let pathArrays = gitPath.parseForRegBeziers() else { return }
let rslt = pathArrays.0
let regBeziers = pathArrays.1
gitPath.boundingBox = gitPath.getBoundsParamsForPaths(src: regBeziers.isEmpty ? rslt : regBeziers)
GitPaths.currentGitPath = gitPath
// Tracker.track("sending notification")
NotificationCenter.default.post(name: NNames.updateMedia.nn(), object: nil, userInfo: ["path" : gitPath])
Tracker.track("completed didSelect")
return
}
…the main thread logical path I'm following is the one that ends at the bottom withTracker.track("completed didSelect"). I'm getting a crash if I execute the notification call, that throws this information:
libobjc.A.dylib`objc_msgSend:
0x18002ec00 <+0>: cmp x0, #0x0
0x18002ec04 <+4>: b.le 0x18002ec6c ; <+108>
0x18002ec08 <+8>: ldr x14, [x0]
0x18002ec0c <+12>: and x16, x14, #0x7ffffffffffff8
0x18002ec10 <+16>: mov x15, x16
-> 0x18002ec14 <+20>: ldr x10, [x16, #0x10]
0x18002ec18 <+24>: lsr x11, x10, #48
0x18002ec1c <+28>: and x10, x10, #0xffffffffffff
0x18002ec20 <+32>: and w12, w1, w11
0x18002ec24 <+36>: add x13, x10, x12, lsl #4
0x18002ec28 <+40>: ldp x17, x9, [x13], #-0x10
0x18002ec2c <+44>: cmp x9, x1
0x18002ec30 <+48>: b.ne 0x18002ec3c ; <+60>
0x18002ec34 <+52>: eor x17, x17, x16
0x18002ec38 <+56>: br x17
0x18002ec3c <+60>: cbz x9, 0x18002eea0 ; _objc_msgSend_uncached
0x18002ec40 <+64>: cmp x13, x10
0x18002ec44 <+68>: b.hs 0x18002ec28 ; <+40>
0x18002ec48 <+72>: add x13, x10, w11, uxtw #4
0x18002ec4c <+76>: add x12, x10, x12, lsl #4
0x18002ec50 <+80>: ldp x17, x9, [x13], #-0x10
0x18002ec54 <+84>: cmp x9, x1
0x18002ec58 <+88>: b.eq 0x18002ec34 ; <+52>
0x18002ec5c <+92>: cmp x9, #0x0
0x18002ec60 <+96>: ccmp x13, x12, #0x0, ne
0x18002ec64 <+100>: b.hi 0x18002ec50 ; <+80>
0x18002ec68 <+104>: b 0x18002eea0 ; _objc_msgSend_uncached
0x18002ec6c <+108>: b.eq 0x18002ec90 ; <+144>
0x18002ec70 <+112>: and x10, x0, #0x7
0x18002ec74 <+116>: asr x11, x0, #55
0x18002ec78 <+120>: cmp x10, #0x7
0x18002ec7c <+124>: csel x12, x11, x10, eq
0x18002ec80 <+128>: adrp x10, 232550
0x18002ec84 <+132>: add x10, x10, #0xa00 ; objc_debug_taggedpointer_classes
0x18002ec88 <+136>: ldr x16, [x10, x12, lsl #3]
0x18002ec8c <+140>: b 0x18002ec10 ; <+16>
0x18002ec90 <+144>: mov x1, #0x0
0x18002ec94 <+148>: movi d0, #0000000000000000
0x18002ec98 <+152>: movi d1, #0000000000000000
0x18002ec9c <+156>: movi d2, #0000000000000000
0x18002eca0 <+160>: movi d3, #0000000000000000
0x18002eca4 <+164>: ret
0x18002eca8 <+168>: nop
0x18002ecac <+172>: nop
0x18002ecb0 <+176>: nop
0x18002ecb4 <+180>: nop
0x18002ecb8 <+184>: nop
0x18002ecbc <+188>: nop
According to another post in Stackoverflow, that message has come up when functions that need to be visible to Objective-C aren't marked with #objc, but as you can see, this one is (below).
This wasn't happening at first, and I'm not sure why, but the function called by the Notification is this:
#objc func updateMedia(notification : Notification) {
let path = (notification.userInfo?["path"] ?? GitPaths.currentGitPath!) as? GitPaths
Tracker.track("sublayers: \(mediaDisplay!.layer.sublayers == nil)")
mediaDisplay!.layer.sublayers = nil
mediaDisplay!.mask = nil
// Tracker.track("render beziers for \(path)")
// path!.renderBeziers(tgt: mediaDisplay!, path : path) //, data:["style" : "media"])
// refreshMediaInfo()
// updateSelectedMedia( src : GitPaths.currentGitPath! )
// return
}
I've commented most lines out to see where the crash can be induced, and it's the line mediaDisplay!.layer.sublayers = nil. If I comment this line out, the function executes correctly; if I include it, it will crash, but not as that line executes; the whole function will return, and the crash happens at the end of the function that called the Notification in the first place, which is the one at the top of this post. Tracker.track() is just a way to print messages in a formatted way, and isn't a contributor to this; so basically, after the Notification returns, nothing else happens; if I step through, it gets to the final bracket of the function, before returning control the the user.
I've checked that the object mediaDisplay exists, and it does because it's actually doing what is being asked; when not commented out, the line path!.renderBeziers(tgt: mediaDisplay!, path : path) , uncommented is drawing a bunch of Bezier paths into that view, which as this screenshot taken after the crash shows it does successfully. In other words, the line that causes the crash doesn't stop all the other code that's behind path!.renderBeziers(tgt: mediaDisplay!, path : path) from doing its job, when I uncomment those and run the same thing. The table in the palette is the object that initiates all this, btw.
The view has a big question mark hanging over it; it is a subclass of a WKWebView, which is the big change here. I'm using it here as for regular UIView capability, of acting as a container for a bunch of CAShapeLayers. This is working exactly as it was before, when it was a UIView.
The reason for the change is that I want to be able to display html content in the same view as the CAShapeLayers, as a way of having html interleaved between different drawn elements on the screen; think of text with the dark purple shape behind it and the lighter one in front. In this, I'm following a question I asked which was answered here.
In any case, referring to the container in the next line, where the mask is set to nil does not cause the crash; so it seems to have to do with the layer of the WKWebView, and the sublayers of it. They exist, and I've checked that, but setting them to nil seems to blow this up, in this weird way.
I'm sure I'm missing something; I haven't used WebViews before, so I'm expecting that maybe that's the issue; but it's not intuitive to me what could be going wrong, and I've tried multiple strategies for debugging this. The one that has gotten me the closest to pinpointing the problem is what I've shown here, where I can locate it in the one line; but it seems pretty unproblematic to me...am I missing something obvious?
Thanks in advance for your ideas and insights.

It would appear that #Larme was on the right track: I eventually traced it to the line where the view's layer's sublayers were set to nil. This was the problem. Iterating through the sublayers if present and removing them individually from the parent layer caused the crash to disappear.
The same problem cropped up in a second view, also a WKWebView, where applying the same solution caused a similar crash. In both cases, the error message was entirely unhelpful. In the second case, I simply commented out all the code related to sublayer, and things worked fine. I suspect that this might cause problems at a later stage when I need to update the view with other sublayer information, but I am not in a situation to test that right now.
I'm travelling right now without access to my original project, so sorry for no code to show; but the basic iteration through the layer's sublayers should not be too hard to work out.

Related

What would be the best approach patch-finding the pointer of a certain function on the XNU Kernel?

I am currently working on an iOS Jailbreak for iOS 13.7.
As part of the jailbreak, I need to do a series of patches to the XNU Kernel live in the memory.
Of course, the kernel is protected by kASLR, KPP / KTRR, and other memory watchdogs that would trigger a Kernel Panic if something is modified.
As luck would have it, KTRR (Kernel Text Ready Only Region) can only protect, well, static data that is not supposed to change (i.e. the TEXT section and constants). The variables can still be altered.
I am building a PatchFinder which is supposed to locate a function or a variable in the XNU memory based on tell-tale symbols and I am wondering what would be the most effective approach for this.
I am currently adapting on top of the PatchFinder made publicly available back in the iOS 8 era by in7egal which looks like this:
uint32_t find_cs_enforcement_disable_amfi(uint32_t region, uint8_t* kdata, size_t ksize)
{
// Find a function referencing cs_enforcement_disable_amfi
const uint8_t search_function[] = {0x20, 0x68, 0x40, 0xF4, 0x40, 0x70, 0x20, 0x60, 0x00, 0x20, 0x90, 0xBD};
uint8_t* ptr = memmem(kdata, ksize, search_function, sizeof(search_function));
if(!ptr)
return 0;
// Only LDRB in there should try to dereference cs_enforcement_disable_amfi
uint16_t* ldrb = find_last_insn_matching(region, kdata, ksize, (uint16_t*) ptr, insn_is_ldrb_imm);
if(!ldrb)
return 0;
// Weird, not the right one.
if(insn_ldrb_imm_imm(ldrb) != 0 || insn_ldrb_imm_rt(ldrb) > 12)
return 0;
// See what address that LDRB is dereferencing
return find_pc_rel_value(region, kdata, ksize, ldrb, insn_ldrb_imm_rn(ldrb));
}
I wonder if there is any faster way or a more reliable way to locate the cs_enforcement_disable_amfi.
Once found by the PatchFinder in the XNU Kernel memory, it's used like this:
uint32_t cs_enforcement_disable_amfi = find_cs_enforcement_disable_amfi(kernel_base, kdata, ksize);
printf("cs_enforcement_disable_amfi is at=0x%08x\n",cs_enforcement_disable_amfi);
if (cs_enforcement_disable_amfi){
char patch[] ="\x00\xbf\x00\xbf\x00\xbf\x00\xbf\x00\xbf";
kern_return_t kernret = vm_write(proccessTask, cs_enforcement_disable_amfi+kernel_base, patch, sizeof(patch)-1);
if (kernret == KERN_SUCCESS){
printf("Successfully patched cs_enforcement_disable_amfi\n");
}
}
So the PatchFinder has to be able to reliably return the pointer to cs_enforcement_disable_amfi otherwise I am blindly writing to an invalid (or valid but different) address which almost certainly will trigger memory corruption.
The current code does return a valid pointer to cs_enforcement_disable_amfi most of the time, but randomly panics the kernel about 10-15% of the time which means the address it returns 10-15% of the time is invalid. Not sure how to make it more reliable.
The variable you're looking for doesn't exist anymore.
The bytes in your first snippet make up Thumb instructions, which find this function in AMFI in a 32bit kernelcache:
0x8074ad04 90b5 push {r4, r7, lr}
0x8074ad06 01af add r7, sp, 4
0x8074ad08 0d48 ldr r0, [0x8074ad40]
0x8074ad0a 7844 add r0, pc
0x8074ad0c 0078 ldrb r0, [r0]
0x8074ad0e 0128 cmp r0, 1
0x8074ad10 03d1 bne 0x8074ad1a
0x8074ad12 0020 movs r0, 0
0x8074ad14 00f04efa bl 0x8074b1b4
0x8074ad18 30b9 cbnz r0, 0x8074ad28
0x8074ad1a 7c69 ldr r4, [r7, 0x14]
0x8074ad1c 002c cmp r4, 0
0x8074ad1e 05d0 beq 0x8074ad2c
0x8074ad20 2068 ldr r0, [r4]
0x8074ad22 40f44070 orr r0, r0, 0x300
0x8074ad26 2060 str r0, [r4]
0x8074ad28 0020 movs r0, 0
0x8074ad2a 90bd pop {r4, r7, pc}
Given the magic constant 0x300 and the fact that AMFI's __TEXT_EXEC segment is quite small, we can easily find this in other kernels, including 64bit ones.
This is what it looks like on an iPhone 5s on 8.4:
0xffffff800268d2e4 f44fbea9 stp x20, x19, [sp, -0x20]!
0xffffff800268d2e8 fd7b01a9 stp x29, x30, [sp, 0x10]
0xffffff800268d2ec fd430091 add x29, sp, 0x10
0xffffff800268d2f0 f30307aa mov x19, x7
0xffffff800268d2f4 e8fc1110 adr x8, section.com.apple.driver.AppleMobileFileIntegrity.10.__DATA.__bss
0xffffff800268d2f8 1f2003d5 nop
0xffffff800268d2fc 08054039 ldrb w8, [x8, 1]
0xffffff800268d300 a8000037 tbnz w8, 0, 0xffffff800268d314
0xffffff800268d304 130100b4 cbz x19, 0xffffff800268d324
0xffffff800268d308 680240b9 ldr w8, [x19]
0xffffff800268d30c 08051832 orr w8, w8, 0x300
0xffffff800268d310 680200b9 str w8, [x19]
0xffffff800268d314 00008052 mov w0, 0
0xffffff800268d318 fd7b41a9 ldp x29, x30, [sp, 0x10]
0xffffff800268d31c f44fc2a8 ldp x20, x19, [sp], 0x20
0xffffff800268d320 c0035fd6 ret
But by the time of iOS 11, the variable is gone:
0xfffffff006245d84 f44fbea9 stp x20, x19, [sp, -0x20]!
0xfffffff006245d88 fd7b01a9 stp x29, x30, [sp, 0x10]
0xfffffff006245d8c fd430091 add x29, sp, 0x10
0xfffffff006245d90 f30307aa mov x19, x7
0xfffffff006245d94 130100b4 cbz x19, 0xfffffff006245db4
0xfffffff006245d98 680240b9 ldr w8, [x19]
0xfffffff006245d9c 08051832 orr w8, w8, 0x300
0xfffffff006245da0 680200b9 str w8, [x19]
0xfffffff006245da4 00008052 mov w0, 0
0xfffffff006245da8 fd7b41a9 ldp x29, x30, [sp, 0x10]
0xfffffff006245dac f44fc2a8 ldp x20, x19, [sp], 0x20
0xfffffff006245db0 c0035fd6 ret
Looking at iOS 12.0b1, we can learn the signature of that function:
_vnode_check_exec(ucred*, vnode*, vnode*, label*, label*, label*, componentname*, unsigned int*, void*, unsigned long)
So yeah, finding this function is really easy:
Find AMFI's __TEXT_EXEC segment.
Find an orr wN, wN, 0x300 in it.
But that won't help you unless you defeat kernel integrity.

overreleased while already deallocating (object set to nil) for SCNNodes in iOS SceneKit

Seeking for help for an issue, apologize if it is obvious as I am not experienced. My environment is Xcode 10.1 and Swift.
weak var node = Label(geometry: label, labelType: labelType, index: index)
if node != nil {
transformTextNodeCenter(for: node!) //move pivot to center
node!.scale = SCNVector3(x: parameters.textScaleRatio, y: parameters.textScaleRatio, z: parameters.textScaleRatio) //rescale the textnode
print(node!) //print no.1
print(node!.labelType, node!.index, node!.boundingBox) //print no.2
let textWidth = node!.boundingBox.max.x - node!.boundingBox.min.x //<- This is the line generate error
let textHeight = node!.boundingBox.max.y - node!.boundingBox.min.y
let maxWidth = max(textWidth, recordedWidth)
node!.position = position + SCNVector3(x: extra.x * textWidth, y: extra.y * textWidth, z: extra.z * textWidth)
node!.eulerAngles = eulerAngles
node!.name = String("\(name)\(text)")
self.label[labelArray].append(node!)
//self.label.insert(node)
self.addChildNode(node!)
} else {
print("node == nil")
}
The purpose of the function is to add SCNText into my scene, but there is a possibility my textnode will be deallocated in the middle of function (I put it in a for loop and it runs randomly several loop before crash) see pic. 1
It looks like the node initialed properly as it can pass the if node != nil" statement, and print no.2 as follows
"row 0 (min: __C.SCNVector3(x: 0.7861328, y: 1.2421875, z: 0.0), max: __C.SCNVector3(x: 18.325195, y: 10.211914, z: 0.0))"
This makes me believe I have successfully receive boundingBox of the textnode. But it failed at the next line "let textHeight = node!.boundingBox.max.y - node!.boundingBox.min.y".
When crashed, I try to trace it and it shows the node is nil as pic. 2
& pic. 3.
I read some post on so and follow the instruction to set break point on objc_overrelease_during_dealloc_error, but it leads me to "SCNBoundingVolume.boundingBox.getter"
libswiftSceneKit.dylib(extension in SceneKit):__C.SCNBoundingVolume.boundingBox.getter : (min: __C.SCNVector3, max: __C.SCNVector3):
0x10205167c <+0>: sub sp, sp, #0x30 ; =0x30
0x102051680 <+4>: stp x29, x30, [sp, #0x20]
0x102051684 <+8>: add x29, sp, #0x20 ; =0x20
0x102051688 <+12>: nop
0x10205168c <+16>: ldr x8, #0x29d4 ; (void *)0x000000021e95aa28: SCNVector3Zero
0x102051690 <+20>: ldp w9, w10, [x8]
0x102051694 <+24>: ldr w8, [x8, #0x8]
0x102051698 <+28>: stp w9, w10, [sp, #0x10]
0x10205169c <+32>: str w8, [sp, #0x18]
0x1020516a0 <+36>: stp w9, w10, [sp]
0x1020516a4 <+40>: str w8, [sp, #0x8]
0x1020516a8 <+44>: nop
0x1020516ac <+48>: ldr x1, #0x2e9c ; "getBoundingBoxMin:max:"
0x1020516b0 <+52>: add x2, sp, #0x10 ; =0x10
0x1020516b4 <+56>: mov x3, sp
0x1020516b8 <+60>: mov x0, x20
0x1020516bc <+64>: bl 0x102053310 ; symbol stub for: objc_msgSend
0x1020516c0 <+68>: ldr w1, [sp, #0x18]
0x1020516c4 <+72>: ldr x0, [sp, #0x10]
0x1020516c8 <+76>: ldr w8, [sp]
0x1020516cc <+80>: ldur x2, [sp, #0x4]
0x1020516d0 <+84>: bfi x1, x8, #32, #32
0x1020516d4 <+88>: ldp x29, x30, [sp, #0x20]
0x1020516d8 <+92>: add sp, sp, #0x30 ; =0x30
0x1020516dc <+96>: ret
And I can't find a way to interpret it.
P.S. strong var still result to crash but with different error message "EXC_BAD_ACCESS" as pic4.

Threading and animated controller dismissal crash

I have been scratching my head on this problem for some time now:
The Setup
I have a situation where I have a navigation controller (A) -> controller (B).
(B) is pushed from (A) like so:
func presentPhotoController() {
let photoController = PhotoCaptureController()
let navController = UINavigationController(rootViewController: photoController)
self.present(navController, animated: true, completion: nil)
}
Controller (B) is a camera screen (features an AVCaptureSession). A button allows to go back to (A) when pressed by dismissing (B).
The Issue
When (B) calls self.dismiss(animated: true, completion: nil), everything is working fine.
When (B) calls self.dismiss(animated: false, completion: nil) instead, which I really need it to be, I am getting a nasty crash from within the dispatch queue:
override func observeValue(forKeyPath keyPath: String?, of object: Any?, change: [NSKeyValueChangeKey : Any]?, context: UnsafeMutableRawPointer?) {
if context == &sessionRunningObserveContext {
let newValue = change?[.newKey] as AnyObject?
guard let isSessionRunning = newValue?.boolValue else { return }
DispatchQueue.main.async { [unowned self] in
// Only enable the ability to change camera if the device has more than one camera.
self.cameraButton.isEnabled = isSessionRunning && (self.videoDeviceDiscoverySession.uniqueDevicePositionsCount()) > 1
self.photoButton.isEnabled = isSessionRunning
self.flashButton.isEnabled = isSessionRunning
}
}
else {
super.observeValue(forKeyPath: keyPath, of: object, change: change, context: context)
}
}
Here are the stack traces:
libswiftCore.dylib`_swift_abortRetainUnowned:
0x100dc5598 <+0>: adr x8, #571352 ; gCRAnnotations
0x100dc559c <+4>: nop
0x100dc55a0 <+8>: adr x9, #182131 ; "attempted to retain deallocated object"
0x100dc55a4 <+12>: nop
0x100dc55a8 <+16>: str x9, [x8, #8]
-> 0x100dc55ac <+20>: brk #0x1
and:
libswiftCore.dylib`swift_unknownUnownedLoadStrong:
0x100dd4b04 <+0>: stp x20, x19, [sp, #-32]!
0x100dd4b08 <+4>: stp x29, x30, [sp, #16]
0x100dd4b0c <+8>: add x29, sp, #16 ; =16
0x100dd4b10 <+12>: ldr x19, [x0]
0x100dd4b14 <+16>: cbz x19, 0x100dd4b28 ; <+36>
0x100dd4b18 <+20>: tbnz w19, #0, 0x100dd4b30 ; <+44>
0x100dd4b1c <+24>: mov x0, x19
0x100dd4b20 <+28>: bl 0x100dc555c ; swift_unownedRetainStrong
0x100dd4b24 <+32>: b 0x100dd4b40 ; <+60>
0x100dd4b28 <+36>: movz x19, #0
0x100dd4b2c <+40>: b 0x100dd4b40 ; <+60>
0x100dd4b30 <+44>: and x0, x19, #0xfffffffffffffffe
0x100dd4b34 <+48>: bl 0x100de014c ; symbol stub for: objc_loadWeakRetained
0x100dd4b38 <+52>: mov x19, x0
0x100dd4b3c <+56>: cbz x19, 0x100dd4b50 ; <+76>
0x100dd4b40 <+60>: mov x0, x19
0x100dd4b44 <+64>: ldp x29, x30, [sp, #16]
0x100dd4b48 <+68>: ldp x20, x19, [sp], #32
0x100dd4b4c <+72>: ret
0x100dd4b50 <+76>: movz x0, #0
0x100dd4b54 <+80>: bl 0x100dc5598 ; _swift_abortRetainUnowned
The Solution?
Being new to Swift, the above feel pretty cryptic to me. If I'm guessing correctly, it seems that this crash arises from trying to retain a deallocated object ? What I don't understand is why the controller dismissal animation would change anything to it.
Could someone help me trying to figure out what's going on exactly ?
Many thanks in advance.

HomeKit crashes reason: '-[__NSDate length]: but Bool sent

tl;dr - The code in the question is correct. Reason for crash at another party.
The challenge is to control an Elgato Eve Energy HomeKit enabled outlet.
Up til where the code starts, everything is working OK, so the correct room, accessory and so on is selected. The code does turn off the outlet, but right afterwards the app crashes.
guard let services = accessory?.services else {
print("No Service")
return
}
for service in services {
if service.serviceType == HMServiceTypeOutlet {
for characteristic in service.characteristics {
print(characteristic.characteristicType)
if characteristic.characteristicType == HMCharacteristicTypePowerState {
print(characteristic.metadata!)
dump(characteristic)
// Turning off the outlet
characteristic.writeValue(false, completionHandler: { (error: Error?) -> Void in
if error == nil {
print("Yep")
} else {
print("Nop")
}
})
}
}
}
}
Log
00000023-0000-1000-8000-0026BB765291
00000025-0000-1000-8000-0026BB765291
[%# Format: bool, Manufacturer Description: Power State ]
- <HMCharacteristic: 0x1702c23e0> #0
- super: NSObject
00000026-0000-1000-8000-0026BB765291
E863F10A-079E-48FF-8F27-9C2605A29F52
E863F126-079E-48FF-8F27-9C2605A29F52
E863F10D-079E-48FF-8F27-9C2605A29F52
E863F10C-079E-48FF-8F27-9C2605A29F52
2017-02-07 23:19:59.725340 POS[499:100178] -[__NSDate length]: unrecognized selector sent to instance 0x170007710
2017-02-07 23:19:59.725767 POS[499:100178] *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '-[__NSDate length]: unrecognized selector sent to instance 0x170007710'
*** First throw call stack:
(0x188a291b8 0x18746055c 0x188a30268 0x188a2d270 0x18892680c 0x1895be458 0x1895be350 0x1895be698 0x1006328f8 0x1a249ac8c 0x199674f34 0x19966c588 0x1a249d194 0x101951258 0x101951218 0x10195eaec 0x101954ce0 0x10195f088 0x101960e2c 0x101960b78 0x187abb2a0 0x187abad8c)
libc++abi.dylib: terminating with uncaught exception of type NSException
Sym
2017-02-08 10:17:47.804825 POS[602:171994] -[__NSDate length]: unrecognized selector sent to instance 0x1740169c0
iZettlePayments`-[NSDictionary(Fractionized) dateForKey:]:
0x100973d88 <+0>: stp x22, x21, [sp, #-48]!
0x100973d8c <+4>: stp x20, x19, [sp, #16]
0x100973d90 <+8>: stp x29, x30, [sp, #32]
0x100973d94 <+12>: add x29, sp, #32 ; =32
0x100973d98 <+16>: mov x19, x0
0x100973d9c <+20>: nop
0x100973da0 <+24>: ldr x20, #861056 ; (void *)0x00000001ad8966b8: NSDateFormatter
0x100973da4 <+28>: nop
0x100973da8 <+32>: ldr x21, #851248 ; "izDateFormatterUsingISO8601"
0x100973dac <+36>: mov x0, x2
0x100973db0 <+40>: bl 0x1009e9b54 ; symbol stub for: objc_retain
0x100973db4 <+44>: mov x22, x0
0x100973db8 <+48>: mov x0, x20
0x100973dbc <+52>: mov x1, x21
0x100973dc0 <+56>: bl 0x1009e9b30 ; symbol stub for: objc_msgSend
0x100973dc4 <+60>: mov x29, x29
0x100973dc8 <+64>: bl 0x1009e9b78 ; symbol stub for: objc_retainAutoreleasedReturnValue
0x100973dcc <+68>: mov x20, x0
0x100973dd0 <+72>: nop
0x100973dd4 <+76>: ldr x1, #849044 ; "valueForKey:"
0x100973dd8 <+80>: mov x0, x19
0x100973ddc <+84>: mov x2, x22
0x100973de0 <+88>: bl 0x1009e9b30 ; symbol stub for: objc_msgSend
0x100973de4 <+92>: mov x19, x0
0x100973de8 <+96>: mov x0, x22
0x100973dec <+100>: bl 0x1009e9b48 ; symbol stub for: objc_release
0x100973df0 <+104>: mov x0, x19
0x100973df4 <+108>: bl 0x1009e9b78 ; symbol stub for: objc_retainAutoreleasedReturnValue
0x100973df8 <+112>: mov x19, x0
0x100973dfc <+116>: nop
0x100973e00 <+120>: ldr x1, #851168 ; "dateFromString:"
0x100973e04 <+124>: mov x0, x20
0x100973e08 <+128>: mov x2, x19
0x100973e0c <+132>: bl 0x1009e9b30 ; symbol stub for: objc_msgSend
0x100973e10 <+136>: mov x29, x29
0x100973e14 <+140>: bl 0x1009e9b78 ; symbol stub for: objc_retainAutoreleasedReturnValue
0x100973e18 <+144>: mov x21, x0
0x100973e1c <+148>: mov x0, x19
0x100973e20 <+152>: bl 0x1009e9b48 ; symbol stub for: objc_release
0x100973e24 <+156>: mov x0, x20
0x100973e28 <+160>: bl 0x1009e9b48 ; symbol stub for: objc_release
0x100973e2c <+164>: mov x0, x21
0x100973e30 <+168>: ldp x29, x30, [sp, #32]
0x100973e34 <+172>: ldp x20, x19, [sp, #16]
0x100973e38 <+176>: ldp x22, x21, [sp], #48
0x100973e3c <+180>: b 0x1009e9ac4 ; symbol stub for: objc_autoreleaseReturnValue
Browsing the Elgato Eve services and characteristics, shows the first characteristic in the array is the one holding the name, and the second one is the one I need to manipulate. The printed metadata shows its a bool, and confirms its the Power State, and its both readable and writable, as described in the table linked to before.
Since I write a false to the correct characteristic, the outlet turns off, but a couple of seconds later, the app crashes. I have removed any observers and delegate methods that could interfere. This really baffles me.
Further, the code does not crash on iOS 9, just iOS 10.2, as well as the 10.3 betas
Solution
Sorry guys, after a whole lot of swearing, a bruised toe, and a lot less hair, and 24 hours later, I found the culprit. Im using iZettle, a payment device, and as soon as the libraries was added to the project, it crashed. The guys over at iZettle admitted they had an extension on NSDictionary
#interface NSDictionary (Fractionized)
- (NSDate *)dateForKey:(id)aKey;
#end
This one collides with an extension in HomeKit, so thats the reason for the problem. The result is they have to add a prefix to their extension and compile the libraries again.
While a symbolicated stack trace would help, there is one symbol in your logs that may provide a useful hint: something is trying to ask an NSDate for length. In my experience, this happens when a library expects something to be an NSString and it's about to parse it or print it or what have you.
Perhaps you know where NSDates are being used. It will also help to know if the crash is on the same thread that is executing your above code. Given that you are experiencing a slight delay, it's hard to say if it is related to that code at all! Perhaps elsewhere in your app, you are responding to the device itself giving you a status update, and maybe printing a value that you think is a string but is really a date?

UIWebview: WebThread EXC_BAD_ACCESS

I have a completely simple app: Show a web view with http://tv2.dk
I'am using a storyboard, added the web view and set a property on my controller. To keep things simple i'am not setting a delegate.
In viewDidLoad i call the web view with the url i want to load
[self.webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:#"http://tv2.dk"]]];
Each time the app starts up it crashes due to some error in a web thread worker, see this dump.
libobjc.A.dylib`objc_msgSend:
0x1954f7bc0: cmp x0, #0
0x1954f7bc4: b.le 0x1954f7c30 ; objc_msgSend + 112
0x1954f7bc8: ldr x13, [x0]
0x1954f7bcc: and x9, x13, #0x1fffffff8
0x1954f7bd0: ldp x10, x11, [x9, #16]
0x1954f7bd4: and w12, w1, w11
0x1954f7bd8: add x12, x10, x12, lsl #4
0x1954f7bdc: ldp x16, x17, [x12]
0x1954f7be0: cmp x16, x1
0x1954f7be4: b.ne 0x1954f7bec ; objc_msgSend + 44
0x1954f7be8: br x17
0x1954f7bec: cbz x16, 0x1954f7d80 ; _objc_msgSend_uncached_impcache
0x1954f7bf0: cmp x12, x10
0x1954f7bf4: b.eq 0x1954f7c00 ; objc_msgSend + 64
0x1954f7bf8: ldp x16, x17, [x12, #-16]!
0x1954f7bfc: b 0x1954f7be0 ; objc_msgSend + 32
0x1954f7c00: add x12, x12, w11, uxtw #4
0x1954f7c04: ldp x16, x17, [x12]
0x1954f7c08: cmp x16, x1
0x1954f7c0c: b.ne 0x1954f7c14 ; objc_msgSend + 84
0x1954f7c10: br x17
0x1954f7c14: cbz x16, 0x1954f7d80 ; _objc_msgSend_uncached_impcache
0x1954f7c18: cmp x12, x10
0x1954f7c1c: b.eq 0x1954f7c28 ; objc_msgSend + 104
0x1954f7c20: ldp x16, x17, [x12, #-16]!
0x1954f7c24: b 0x1954f7c08 ; objc_msgSend + 72
0x1954f7c28: mov x2, x9
0x1954f7c2c: b 0x1954e1e70 ; objc_msgSend_corrupt_cache_error
0x1954f7c30: b.eq 0x1954f7c48 ; objc_msgSend + 136
0x1954f7c34: adrp x10, 18278
0x1954f7c38: add x10, x10, #1904
0x1954f7c3c: lsr x11, x0, #60
0x1954f7c40: ldr x9, [x10, x11, lsl #3]
0x1954f7c44: b 0x1954f7bd0 ; objc_msgSend + 16
0x1954f7c48: movz x1, #0
0x1954f7c4c: movi d0, #0000000000000000
0x1954f7c50: movi d1, #0000000000000000
0x1954f7c54: movi d2, #0000000000000000
0x1954f7c58: movi d3, #0000000000000000
0x1954f7c5c: ret
Offending line
0x1954f7bd0: ldp x10, x11, [x9, #16]
Check out the full source code here: https://bitbucket.org/styrken/ios-webview-crash
I have tried running this code on multiple devices etc, crashes on them all.
From #RasmusStyrk 's comment above
I have found out that with using NSZombie's, i got the following crash
message: WebviewCrash[4598:956679] *** -[UIViewAnimationState
release]: message sent to deallocated instance 0x1707c5370. To fix
this i had to turn off animations in UIVIew using [UIView
setAnimationsEnabled:NO]; and now it works. It seems like a bug in
iOS8. –
We also had this where it would randomly crash, and setting [UIView setAnimationsEnabled:NO] is the only thing that has worked to completely alleviate this issue!
Thread EXC_BAD_ACCESS says it all.
UIWebView likes to be called from the main thread. Try putting your code as follows:
dispatch_async(dispatch_get_main_queue(), ^{
//send webview a message
[self.webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:#"http://tv2.dk"]]];
});
In my case, I made the silly mistake to forget adding the WKWebView to the view hierarchy prior to loading a resource.

Resources