Crash on one specific Unity scene in iOS build - TexturesMetal::AddCreatedTexture - ios

I am having a crash only on one specific scene in my AR Foundation Unity build with the following error.
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000020
VM Region Info: 0x20 is not in any region. Bytes before following region: 4362387424
REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL
UNUSED SPACE AT START
__TEXT 10404c000-104050000 [ 16K] r-x/r-x SM=COW ...lycoroTestApp
Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [5380]
Triggered by Thread: 28
Thread 28 name:
Thread 28 Crashed:
0 libobjc.A.dylib 0x0000000195ac5ac0 objc_retain + 16 (objc-object.h:636)
1 UnityFramework 0x00000001066d5320 TexturesMetal::AddCreatedTexture(TextureID, id, bool) + 32 (TexturesMetal.mm:481)
2 UnityFramework 0x0000000106634828 GfxDeviceWorker::RunCommand(ThreadedStreamBuffer&) + 21972 (GfxDeviceWorker.cpp:0)
3 UnityFramework 0x00000001066aa2ec GfxDeviceWorkerAutoreleasePoolProxy + 68 (GfxDeviceMetal.mm:5242)
4 UnityFramework 0x0000000106636bd0 GfxDeviceWorker::RunExt(ThreadedStreamBuffer&) + 92 (GfxDeviceWorker.cpp:389)
5 UnityFramework 0x0000000106636b68 GfxDeviceWorker::Run() + 156 (GfxDeviceWorker.cpp:373)
6 UnityFramework 0x000000010662ef70 GfxDeviceWorker::RunGfxDeviceWorker(void*) + 12 (GfxDeviceWorker.cpp:352)
7 UnityFramework 0x00000001062289f8 Thread::RunThreadWrapper(void*) + 496 (Thread.cpp:81)
8 libsystem_pthread.dylib 0x00000001c9777c74 _pthread_start + 288 (pthread.c:887)
9 libsystem_pthread.dylib 0x00000001c977c878 thread_start + 8
At first I thought it was because I was missing the Environmental Probe manager in that scene (no). Then I thought perhaps it was because I was using a specific shader that didn't use a _MainTex. But I use that shader no problem in other working scenes.
And then I built the scene with only a simple primitive and my UI and still received this error. After that crash the scene did open successfully, but obviously the problem is still there. The UI is the exact same as the other working scenes.
I can't find out much about this specific error: TexturesMetal::AddCreatedTexture - only that there may be this bug with GLES3 and PVRTC textures - but they aren't present in the most recent build.
https://issuetracker.unity3d.com/issues/ios-crash-in-uploadtexture-at-texturesmeta-dot-mm-or-drawbufferranges-at-gfxdevicegles-dot-cpp-using-atlas-with-pvrtc-compress
The scene works perfectly in Android - it only crashes in iOS.
Any ideas? Full report below.
I ran a Product>Analysis in Xcode and it gave me this warning:
/Users/xcodeclub/Downloads/Eliot Silver/Classes/UI/UnityView.mm:200:5: nil returned from a method that is expected to return a non-null value
For this bit of Code in UnityView.mm:
static Class UnityRenderingView_LayerClassMTL(id self_, SEL _cmd)
{
return NSClassFromString(#"CAMetalLayer");
}
static Class UnityRenderingView_LayerClassNULL(id self_, SEL _cmd)
{
return NSClassFromString(#"CALayer");
}
#implementation UnityRenderingView
(Class)layerClass
{
return nil;
}
(void)InitializeForAPI:(UnityRenderingAPI)api
{
IMP layerClassImpl = api == apiMetal ? (IMP)UnityRenderingView_LayerClassMTL : (IMP)UnityRenderingView_LayerClassNULL;
class_replaceMethod(object_getClass([UnityRenderingView class]), #Selector(layerClass), layerClassImpl, UIView_LayerClass_Enc);
}
#End

Related

UIMenuController crashes on macOS Monterey

My iOS app uses UIMenuController to show the Copy/Paste context menu. When I launch the app on macOS 12.0 and control-click (right click) with the mouse or the trackpad, the app crashes upon showing the menu with this crash log:
Application Specific Information:
*** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason:
'*** -[__NSDictionaryM setObject:forKey:]: object cannot be nil (key: title)'
Last Exception Backtrace:
0 CoreFoundation 0x1be758118 __exceptionPreprocess + 220
1 libobjc.A.dylib 0x1be4a9808 objc_exception_throw + 60
2 CoreFoundation 0x1be828464 -[__NSCFString characterAtIndex:].cold.1 + 0
3 CoreFoundation 0x1be835270 -[__NSDictionaryM setObject:forKey:].cold.3 + 0
4 CoreFoundation 0x1be691590 -[__NSDictionaryM setObject:forKey:] + 904
5 UIKitCore 0x1e5b85998 -[_UIMenuBarItem properties] + 124
6 UIKitMacHelper 0x1d3bc7058 UINSNSMenuItemFromUINSMenuItem + 96
7 UIKitMacHelper 0x1d3bc6d60 _insertUINSMenuItemsIntoNSMenu + 844
8 UIKitMacHelper 0x1d3bc67c0 UINSNSMenuFromUINSMenu + 152
9 UIKitMacHelper 0x1d3bc6690 -[UINSMenuController _createNSMenu:forContextMenu:] + 92
10 UIKitMacHelper 0x1d3c3505c -[UINSMenuController _prepareToShowContextMenu:activityItemsConfiguration:] + 144
11 UIKitMacHelper 0x1d3c349c0 -[UINSMenuController showContextMenu:inWindow:atLocationInWindow:activityItemsConfiguration:] + 312
12 libdispatch.dylib 0x1be44ce60 _dispatch_call_block_and_release + 32
13 libdispatch.dylib 0x1be44ebac _dispatch_client_callout + 20
14 libdispatch.dylib 0x1be45d0ac _dispatch_main_queue_callback_4CF + 944
15 CoreFoundation 0x1be719e60 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 16
I tried the same with several iOS apps from other developers and all of them crash on macOS when I right-click with the mouse.
Has anyone found a workaround?
It's possible to fix this by swizzling the properties method on the private _UIMenuBarItem class. Obviously this comes with the usual disclaimer that this might get you rejected by Apple (but in practice that doesn't seem to cause rejections that often).
Here's the fix: The basic idea is to wrap the original method call in a #try/#catch block. The crash happens because the original implementation sometimes tries to insert a nil value for the title key into an NSDictionary. This workaround catches that exception and then returns a dummy dictionary to satisfy the caller.
UIMenuBarItemMontereyCrashFix.h
#import <Foundation/Foundation.h>
NS_ASSUME_NONNULL_BEGIN
/// Helper class to apply a fix to prevent a crash on macOS Monterey when a user right-clicks in a text field
#interface UIMenuBarItemMontereyCrashFix : NSObject
/// Apply the crash fix. It will only be applied the first time it's called, subsequent calls are no-ops.
/// It will only have an effect when called on macOS Monterey or later.
+ (void)applyCrashFixIfNeeded;
#end
NS_ASSUME_NONNULL_END
UIMenuBarItemMontereyCrashFix.m
#import "UIMenuBarItemMontereyCrashFix.h"
#import <objc/runtime.h>
static BOOL hasCrashFixBeenApplied = NO;
#implementation UIMenuBarItemMontereyCrashFix
/// Apply the crash fix. It will only be applied the first time it's called, subsequent calls are no-ops.
+ (void)applyCrashFixIfNeeded
{
if (#available(macOS 12.0, *)) {} else {
// Bail if we are not running on Monterey
return;
}
if (!hasCrashFixBeenApplied) {
Class UnderscoreUIMenuBarItem = NSClassFromString(#"_UIMenuBarItem");
SEL selector = sel_getUid("properties");
Method method = class_getInstanceMethod(UnderscoreUIMenuBarItem, selector);
IMP original = method_getImplementation(method);
// The crash happens because in some instances the original implementation
// tries to insert `nil` as a value for the key `title` into a dictionary.
// This is how the fix works:
// We wrap the original implementation call in a #try/#catch block. When the
// exception happens, we catch it, and then return a dummy dictionary to
// satisfy the caller. The dummy has `isEnabled` set to NO, and `isHidden` set
// to YES.
IMP override = imp_implementationWithBlock(^id(id me) {
#try {
id res = ((id (*)(id))original)(me);
return res;
}
#catch(NSException *exception) {
return #{
#"allowsAutomaticKeyEquivalentLocalization" : #0,
#"allowsAutomaticKeyEquivalentMirroring" : #0,
#"defaultCommand" : #0,
#"identifier":#"com.apple.menu.application",
#"imageAlwaysVisible" : #0,
#"isAlternate" : #0,
#"isEnabled" : #0,
#"isHidden" : #1,
#"isSeparatorItem" : #0,
#"keyEquivalent" : #"",
#"keyEquivalentModifiers" : #0,
#"remainsVisibleWhenDisabled" : #0,
#"state" : #0,
#"title" : #""
};
}
});
method_setImplementation(method, override);
hasCrashFixBeenApplied = YES;
}
}
#end
Remember to add UIMenuBarItemMontereyCrashFix.h to your bridging header so you can call it from Swift. Then simply call UIMenuBarItemMontereyCrashFix.applyIfNeeded() somewhere during your app's startup sequence (for example in your AppDelegate).

UICollectionView crash on performBatchUpdates

I can't figure out what's the reason of this crash?
Incident Identifier: BF4459C1-B97D-448E-AAE0-4DA6A1E4731C
CrashReporter Key: E725A626-A25C-4923-8383-0BC7ECA7DADE
Hardware Model: iPhone6,1
Process: SampleProject [480]
Path: /var/containers/Bundle/Application/458F9694-4BDA-4207-8C90-C2192520F8E2/SampleProject.app/SampleProject
Identifier: com.mydomain.SampleProject
Version: 1.3.0 (1.3.0.36)
Code Type: ARM-64
Parent Process: ??? [1]
Date/Time: 2017-05-17T04:11:03Z
Launch Time: 2017-05-17T04:06:51Z
OS Version: iPhone OS 10.3.1 (14E304)
Report Version: 104
Exception Type: SIGSEGV
Exception Codes: SEGV_ACCERR at 0xfffffffffffffff8
Crashed Thread: 0
Application Specific Information:
Selector name found in current argument registers: _setLayoutAttributes:atGlobalItemIndex:
Thread 0 Crashed:
0 UIKit 0x000000018de7d38c -[UICollectionViewData _setLayoutAttributes:atGlobalItemIndex:] + 80
1 UIKit 0x000000018de7ac94 __45-[UICollectionViewData validateLayoutInRect:]_block_invoke + 1892
2 UIKit 0x000000018de79f68 -[UICollectionViewData validateLayoutInRect:] + 1492
3 UIKit 0x000000018de8023c -[UICollectionViewData layoutAttributesForElementsInRect:] + 264
4 UIKit 0x000000018de7dbc0 -[UICollectionView _updateVisibleCellsNow:] + 548
5 UIKit 0x000000018dfea058 -[UICollectionView _setupCellAnimations] + 28
6 UIKit 0x000000018dff459c -[UICollectionView _beginUpdates] + 44
7 UIKit 0x000000018e72c8c0 -[UICollectionView _performBatchUpdates:completion:invalidationContext:tentativelyForReordering:animator:] + 256
8 UIKit 0x000000018e72c79c -[UICollectionView _performBatchUpdates:completion:invalidationContext:tentativelyForReordering:] + 92
9 UIKit 0x000000018e72c720 -[UICollectionView _performBatchUpdates:completion:invalidationContext:] + 80
10 UIKit 0x000000018dff4558 -[UICollectionView performBatchUpdates:completion:] + 60
11 SampleProject 0x000000010002a4b8 -[InvitesDataSource didDeleteDataAtIndexes:loadDataAtIndexes:] (InvitesDataSource.m:50)
12 SampleProject 0x0000000100092f58 -[DialogsController _didReceiveOldestInvites:] (DialogsController.m:311)
13 SampleProject 0x0000000100092500 -[DialogsController _didReceiveOldestDialogs:ofType:] (DialogsController.m:248)
14 SampleProject 0x000000010004aad8 -[DialogsController(Notifications) dialogListDidReceived:] (DialogsController+Notifications.m:94)
Piece of code mentioned in crashlog is quite peaceful:
- (void)didDeleteDataAtIndexes:(NSIndexSet *)deleted loadDataAtIndexes:(NSIndexSet *)loaded {
[self.collectionView performBatchUpdates:^{
[deleted enumerateIndexesUsingBlock:^(NSUInteger idx, BOOL *stop) {
[self.collectionView deleteItemsAtIndexPaths:[self _indexPathsForIndex:idx]];
}];
[loaded enumerateIndexesUsingBlock:^(NSUInteger idx, BOOL *stop) {
[self.collectionView insertItemsAtIndexPaths:[self _indexPathsForIndex:idx]];
}];
} completion:^(BOOL finished) {
[self.collectionView reloadData];
}];
}
This may be happening because you do need to also make sure with collectionViews to delete and insert sections. when you try to insert an item in a section that doesn't exist you will get this crash.
Preform Batch updates doesn't know that you meant to add section X+1 when you insert an item at X+1, X. without you already having added that section in.
make sure to use insert and delete section:
https://developer.apple.com/documentation/uikit/uicollectionview/1618090-insertsections
https://developer.apple.com/documentation/uikit/uicollectionview/1618102-deletesections
To insert, delete, or move a single section or item, you must follow these steps:
Update the data in your data source object.
Call the appropriate method of the collection view to insert or delete the section or item.
It is critical that you update your data source before notifying the collection view of any changes. The collection view methods assume that your data source contains the currently correct data. If it does not, the collection view might receive the wrong set of items from your data source or ask for items that are not there and crash your app.

App crashing when launching from AppStore or TestFlight but working fine elseways

My application update has been rejected. Into the rejection message, they wrote "Application crashes at launch". I then tried my application but couldn't make it crash. So I used TestFlight and noticed that when I was launched my app from TestFlight or AppStore, it was crashing at launch. But if I launch my app normally, it does work without any crashes. The thing is this bug occurred since iOS 10 update. Now my application on store also crashes when launched from AppStore while it was working fine 2 weeks go.
Apple sent me a crash log:
Incident Identifier: 001969F1-F275-4AC3-AFE1-E0426957B702
CrashReporter Key: 5ad9695e945a7d5eb5d61fd18d1c3989ccd155b4
Hardware Model: xxx
Process: MyApp [400]
Path: /private/var/containers/Bundle/Application/644423A4-EFE7-41B1-99D9-47B46338A6E2/MyApp.app/MyApp
Identifier: com.MyApp.com
Version: 20160527 (2.7.9)
Code Type: ARM-64 (Native)
Role: Foreground
Parent Process: launchd [1]
Coalition: com.MyApp.com [451]
Date/Time: 2016-09-22 11:19:22.6893 -0700
Launch Time: 2016-09-22 11:19:22.4164 -0700
OS Version: iPhone OS 10.0.1 (14A403)
Report Version: 104
Exception Type: EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000001, 0x000000010008a864
Termination Signal: Trace/BPT trap: 5
Termination Reason: Namespace SIGNAL, Code 0x5
Terminating Process: exc handler [0]
Triggered by Thread: 0
Filtered syslog:
None found
Thread 0 name: Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0 MyApp 0x1000efd3c specialized AppDelegate.application(UIApplication, didFinishLaunchingWithOptions : [NSObject : AnyObject]?) -> Bool (AppDelegate.swift:218)
1 MyApp 0x1000ed310 #objc AppDelegate.application(UIApplication, didFinishLaunchingWithOptions : [NSObject : AnyObject]?) -> Bool (AppDelegate.swift)
2 UIKit 0x19888c42c <redacted> + 400
3 UIKit 0x198a9cb70 <redacted> + 3524
4 UIKit 0x198aa28e0 <redacted> + 1656
5 UIKit 0x198ab7080 <redacted> + 48
6 UIKit 0x198a9f8c4 <redacted> + 168
7 FrontBoardServices 0x1945798bc <redacted> + 36
8 FrontBoardServices 0x194579728 <redacted> + 176
9 FrontBoardServices 0x194579ad0 <redacted> + 56
10 CoreFoundation 0x192986278 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24
11 CoreFoundation 0x192985bc0 __CFRunLoopDoSources0 + 524
12 CoreFoundation 0x1929837c0 __CFRunLoopRun + 804
13 CoreFoundation 0x1928b2048 CFRunLoopRunSpecific + 444
14 UIKit 0x1988855dc <redacted> + 608
15 UIKit 0x198880360 UIApplicationMain + 208
16 MyApp 0x1000ee818 main (AppDelegate.swift:58)
17 libdispatch.dylib 0x1918945b8 (Missing)
There is 4 others threads but this one is the one crashing so I did not copy the rest. I did some research and even though I did notice my crash log wasn't fully translated (for some strange reason since I have all dsyms but whatever), I did manage to understand that I was crashing on line 217 (tell me if I'm wrong). I know that SIGTRAP are most of time NSExceptions being thrown. The line itself is:
let api = MyAppAPI.instance
The instance is a singleton. My guess is that something into the instance creation is failing. Here is the code:
static var instance: MyAppAPI = {
return Singleton.instance
}()
class MyAppAPI: Manager {
struct Singleton {
static var configuration: NSURLSessionConfiguration = {
var configuration = NSURLSessionConfiguration.defaultSessionConfiguration()
let version = NSBundle.mainBundle().objectForInfoDictionaryKey("CFBundleShortVersionString") as? String ?? ""
configuration.HTTPAdditionalHeaders = [
"Accept": "application/vnd.MyApp.api+json, application/json;q=0.9",
"User-Agent": "MyApp iOS/\(version)",
"X-API-Version": "1.0.1"
]
return configuration
}()
static var instance = MyAppAPI(configuration: configuration)
static var baseURL : NSURL! = nil
}
I'm so desperate about this error, I did try a few things that did not work out. Am I looking into the right place ? Is there anyone with a solution ? Any kind of help would be greatly appreciated. I'm willing to gift anyone that can find me the solution or help me find the solution !
I found the solution of my problem.
As expected it was coming from func application(application: UIApplication, didFinishLaunchingWithOptions launchOptions: [NSObject: AnyObject]?) -> Bool
Inside the function I had let userInfo = launchOpts[UIApplicationLaunchOptionsRemoteNotificationKey] as! NSDictionary.
I changed it to let userInfo = launchOpts[UIApplicationLaunchOptionsRemoteNotificationKey] as? NSDictionary and then checked if userInfo != nil to make all the code running userInfointo the bracket.
If it helps anyone or if anyone is struggling with this issue, check all yours ! and swap these to ? if needed (on didFinishLaunchingWithOptions) since launching from TestFlight/AppStore seems to have different options than from installed application (just a guess, not pro enough to claim it).

Segfault from NSLog?

I'm seeing a segfault from using NSLog and specifically, it is on a 64 bit device, with a SEGV_ACCERR. I'm new to iOS, so i'm a little confused.
Here's the stack trace:
Exception Type: SIGSEGV
Exception Codes: SEGV_ACCERR at 0x108074000
Crashed Thread: 0
Thread 0 Crashed:
0 libsystem_platform.dylib 0x00000001826ea31c _platform_memmove + 300
1 libsystem_asl.dylib 0x00000001825289a4 asl_string_append_no_encoding_len + 92
2 libsystem_asl.dylib 0x0000000182522fc8 asl_string_new + 108
3 libsystem_asl.dylib 0x0000000182522df4 asl_msg_to_string_raw + 68
4 libsystem_asl.dylib 0x00000001825228dc _asl_send_message + 828
5 libsystem_asl.dylib 0x00000001825224fc asl_send + 8
6 CoreFoundation 0x0000000182a6fa1c __CFLogCString + 568
7 CoreFoundation 0x0000000182a6f7ac _CFLogvEx2 + 300
8 CoreFoundation 0x0000000182a6fc14 _CFLogvEx3 + 152
9 Foundation 0x0000000183435dd8 _NSLogv + 128
10 Foundation 0x000000018336ae04 NSLog + 28
Here is the code that calls this:
NSString *truncated = [NSString stringWithUTF8String:buffer];
// Using original NSLog to print.
#undef NSLog
NSLog(#"%#", truncated);
and it crashes from my NSLog call.
where buffer is just a char buffer.
My questions specifically are:
Is it even possible to crash from using Apple's provided NSLog? Or is my stack trace wrong?
What does SEG_ACCERR even mean in this context?
How could i go about finding if this was caused by a bad memory issue or not?
Is something blowing up with the asl file under multiple threads?
How should i approach debugging this?
Any help would be greatly appreciated! Thanks!
You say that buffer is a char buffer. If that is the case, you should initialize the string like this
NSString *truncated = [[NSString alloc] initWithBytes:buffer
length:len NSUTF8StringEncoding];
where len is the length of the characters in the buffer.

How to debug EXC_BAD_ACCESS in Apple's Accelerator code?

On sporadic occasions I'm getting an EXC_BAD_ACCESS (SIGSEV) in one of Apple's Accelerator framework methods, vDSP_fft2d_zip. The crash report gave the following for Thread 10. Again, most of the time this works like a champ. Any ideas on how to find the cause and fix it?
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x412f2740
Triggered by Thread: 10
. . .
Thread 10 Crashed:
0 libvDSP.dylib 0x2ddfcdb4 ___lldb_unnamed_function431$$libvDSP.dylib + 68
1 libvDSP.dylib 0x2ddfab66 ___lldb_unnamed_function427$$libvDSP.dylib + 562
2 libvDSP.dylib 0x2ddfa8ee vDSP_fft2d_zop + 434
3 libvDSP.dylib 0x2ddfa732 vDSP_fft2d_zip + 18
4 ASSIST for iPad 0x000ac32e -[Processor setupFilterForBubbleSizeMM:rectWidth:rectImageWidth:dataFilled:dataUnfilled:] (Processor.mm:813)
5 ASSIST for iPad 0x000af4d2 -[Processor runConvolutionProcessOnImage:aveImage:] (Processor.mm:1835)
6 ASSIST for iPad 0x000ac5f6 -[Processor processAnswers] (Processor.mm:869)
7 ASSIST for iPad 0x000ae9cc -[Processor process] (Processor.mm:1644)
8 ASSIST for iPad 0x000d7744 -[ReallTimeScanner processImage:] (ReallTimeScanner.mm:1046)
9 Foundation 0x2f296c82 __NSThread__main__ + 1058
10 libsystem_pthread.dylib 0x396b6c1a _pthread_body + 138
11 libsystem_pthread.dylib 0x396b6b8a _pthread_start + 98
12 libsystem_pthread.dylib 0x396b4c8c thread_start + 4
The relevant code looks like this:
#define FFT_SIZE 512
#define FFT_POWER 9
dataFilledIn->imagp=(float *) malloc(sizeof(float)*FFT_SIZE*FFT_SIZE);
dataFilledIn->realp=(float *) malloc(sizeof(float)*FFT_SIZE*FFT_SIZE);
dataUnfilledIn->imagp=(float *) malloc(sizeof(float)*FFT_SIZE*FFT_SIZE);
dataUnfilledIn->realp=(float *) malloc(sizeof(float)*FFT_SIZE*FFT_SIZE);
memset(dataFilledIn->imagp, 0, sizeof(float)*FFT_SIZE*FFT_SIZE);
memset(dataFilledIn->realp, 0, sizeof(float)*FFT_SIZE*FFT_SIZE);
memset(dataUnfilledIn->imagp, 0, sizeof(float)*FFT_SIZE*FFT_SIZE);
memset(dataUnfilledIn->realp, 0, sizeof(float)*FFT_SIZE*FFT_SIZE);
for(float y=0; y<FFT_SIZE; y+=0.25)
{
for(float x=0; x<FFT_SIZE; x+=0.25)
{
dataFilledIn->realp[(int)y*FFT_SIZE+(int)x] += 0.0625;
dataUnfilledIn->realp[(int)y*FFT_SIZE+(int)x] -= 0.0625;
}
}
vDSP_fft2d_zip(setup, dataFilledIn, 1, 0, FFT_POWER, FFT_POWER, kFFTDirection_Forward);
Answering my own question here: Be sure that the very first parameter sent in (type FFTSetup) to vDSP_fft2d_zip() is initialized correctly, and you should use this call
vDSP_destroy_fftsetup(setup);
to clean it up. I was initializing the setup var properly, like this
setup = vDSP_create_fftsetup(FFT_POWER, kFFTRadix2);
and then cleaning it up, but then was not initializing it again before subsequent calls to vDSP_fft2d_zip(). Unfortunately it only rarely caused a crash, which made it seem like the frequent calls to vDSP_fft2d_zip(setup, . . .) were working when they weren't. The crashes were sporadic making the real cause hard to trace.
There are some articles in Raywenderlich may help you:
Objectively Speaking: A Crash Course in Objective C for iOS 6
Objectively Speaking 2: A Crash Course in Objective C for iOS 6

Resources