Debug/reproduce EXC_BAD_ACCESS crash in CA::release_objects - ios

I use Crashlytics to track crashes and I am seeing some crashes with the stack trace below:
Crashed: com.apple.main-thread
EXC_BAD_ACCESS KERN_INVALID_ADDRESS at 0xf8560b1c
Thread : Crashed: com.apple.main-thread
0 libobjc.A.dylib 0x37a20b66 objc_msgSend + 5
1 CoreFoundation 0x2d5f8e8d CFRelease + 560
2 QuartzCore 0x2fad2965 CA::release_objects(X::List<void const*>*) + 16
3 QuartzCore 0x2fad7dcf -[CAAnimation dealloc] + 54
4 libobjc.A.dylib 0x37a30b0b objc_object::sidetable_release(bool) + 174
5 CoreFoundation 0x2d5f8e8d CFRelease + 560
6 QuartzCore 0x2fada419 CA::Layer::run_animation_callbacks(void*) + 240
7 libdispatch.dylib 0x37f0a0af _dispatch_client_callout + 22
8 libdispatch.dylib 0x37f0c9a9 _dispatch_main_queue_callback_4CF + 268
9 CoreFoundation 0x2d6935b1 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 8
10 CoreFoundation 0x2d691e7d __CFRunLoopRun + 1308
11 CoreFoundation 0x2d5fc471 CFRunLoopRunSpecific + 524
12 CoreFoundation 0x2d5fc253 CFRunLoopRunInMode + 106
13 GraphicsServices 0x323362eb GSEventRunModal + 138
14 UIKit 0x2feb1845 UIApplicationMain + 1136
It looks like CFRelease is being called on some object twice. The problem is I have no idea which animation is causing the crash. The logs aren't very helpful as the crash happens in different places. How do I go about debugging/reproducing this crash or at the very least logging something so that I know what object is being released twice.

Related

Coredata crash on iOS 16, over-release in -[_PFManagedObjectReferenceQueue _processReferenceQueue:]

We are experiencing a weird issue on iOS16. There is no code change, it works fine on lower OS versions.
The stacktrace is:
The first case
Crashed: com.apple.main-thread
EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x00000000e5bde410
0
libobjc.A.dylib
objc_release_x21 + 16
1
CoreData
-[_PFManagedObjectReferenceQueue _processReferenceQueue:] + 1020
2
CoreData
-[NSManagedObjectContext _processRecentChanges:] + 112
3
CoreData
_performRunLoopAction + 412
4
CoreFoundation
__CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 36
5
CoreFoundation
__CFRunLoopDoObservers + 532
6
CoreFoundation
__CFRunLoopRun + 1048
7
CoreFoundation
CFRunLoopRunSpecific + 612
8
GraphicsServices
GSEventRunModal + 164
9
UIKitCore
-[UIApplication _run] + 888
10
UIKitCore
UIApplicationMain + 340
The second case, I believe this stacktrace has the same root cause as the previous one (same trend, same UI page, only happens on iOS 16).
Crashed: com.apple.main-thread
EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x0033003200390070
0
libobjc.A.dylib
objc_msgSend + 32
1
CoreFoundation
-[__NSArrayM dealloc] + 188
2
MyApplication
MyClass.m - Line 361
-[MyClass loadMessages:] + 361
3
MyApplication
MyClass.m - Line 125
__74-[MyClass requestRecentMessagesAndDiscardExistingMessagesCompletion:]_block_invoke + 125
4
libdispatch.dylib
_dispatch_call_block_and_release + 32
5
libdispatch.dylib
_dispatch_client_callout + 20
6
libdispatch.dylib
_dispatch_main_queue_drain + 928
7
libdispatch.dylib
_dispatch_main_queue_callback_4CF + 44
8
CoreFoundation
__CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 16
9
CoreFoundation
__CFRunLoopRun + 2036
10
CoreFoundation
CFRunLoopRunSpecific + 612
11
GraphicsServices
GSEventRunModal + 164
12
UIKitCore
-[UIApplication _run] + 888
13
UIKitCore
UIApplicationMain + 340
MyClass.m is an Objective-C class, it has a property:
#property (nonatomic, strong) NSArray<Message *> *messages; // Message is NSManagedObject
In the second stacktrace, frame -[OurClass loadMessages:] + 361, the messages array is deallocated:
self.messages = [[NSArray alloc] init...];
So my guess is, somehow the messages are over-released. If the messages are released in MyClass before, then the crash happens as the first stacktrace, otherwise it happens as the second stacktrace.
I've turned on -com.apple.CoreData.ConcurrencyDebug 1 to try to debug this, but no luck.
Any help would be much appreciated. Thanks in advance!

-[WKSyntheticTapGestureRecognizer setState:] crash

We have encountered the crash : -[WKSyntheticTapGestureRecognizer setState:] in our app.I am also attaching crash report for the reference:
Crashed: com.apple.main-thread
0 libobjc.A.dylib 0x1540 objc_msgSend + 32
1 WebKit 0x4a6bd8 -[WKSyntheticTapGestureRecognizer setState:] + 100
2 UIKitCore 0x2bb320 -[UITapRecognizer tooSlow:] + 76
3 Foundation 0x365fc __NSFireDelayedPerform + 460
4 CoreFoundation 0xae318 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 32
5 CoreFoundation 0x32cf0 __CFRunLoopDoTimer + 1076
6 CoreFoundation 0x2d4ec __CFRunLoopDoTimers + 328
7 CoreFoundation 0xbd08 __CFRunLoopRun + 1944
8 CoreFoundation 0x1f468 CFRunLoopRunSpecific + 600
9 GraphicsServices 0x138c GSEventRunModal + 164
10 UIKitCore 0x51a088 -[UIApplication _run] + 1100
11 UIKitCore 0x298958 UIApplicationMain + 2092
12 Adoddle Field Plus 0x1238f0 main + 17 (main.mm:17)
13 ??? 0x10817daa4 (Missing)
KERN_INVALID_ADDRESS at 0x0000000000000010
Like WKSyntheticTapGesturestabilizer has been released and is still accessing its member variables

How to identify the state of an iOS App while crash occurs

With following crash log stack. Can I say that App was in Foreground state when crash occurred. because I can see UIKit calls.. What should one look to identified various state of App. like Suspended / Background / Foreground
**
#0
Crashed: com.apple.main-thread
EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x00000000f158936c
**
Crashed: com.apple.main-thread
0 libobjc.A.dylib 0x3a72c626 objc_msgSend + 5
1 CoreFoundation 0x2feae16b +[__NSArrayI __new:::] + 58
2 CoreFoundation 0x2feab945 -[__NSPlaceholderArray initWithObjects:count:] + 172
3 CoreFoundation 0x2feb5341 +[NSArray arrayWithObjects:count:] + 44
4 CoreFoundation 0x2feeb1bb -[NSDictionary allKeys] + 174
5 UIKit 0x3292430f -[UITouchesEvent _cloneEvent] + 342
6 UIKit 0x32786df9 _UIGestureRecognizerUpdate + 5240
7 CoreFoundation 0x2ff3d255 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 20
8 CoreFoundation 0x2ff3abf9 __CFRunLoopDoObservers + 284
9 CoreFoundation 0x2ff3af3b __CFRunLoopRun + 730
10 CoreFoundation 0x2fea5ebf CFRunLoopRunSpecific + 522
11 CoreFoundation 0x2fea5ca3 CFRunLoopRunInMode + 106
12 GraphicsServices 0x34dab663 GSEventRunModal + 138
13 UIKit 0x327f214d UIApplicationMain + 1136
14 MyApp 0xff6bf main (main.m:16)
15 libdyld.dylib 0x3ac2fab7 start + 2
com.apple.main-thread is the main thread which loads up the UI of the ViewController.
Since the crash is on the main thread then the app is to be running in foreground.
I hope it helps.

Crash at _CFAutoreleasePoolPop

I got a crash from Fabric,the stack is below:
Thread : Crashed: com.apple.main-thread
0 libobjc.A.dylib 6806634868 objc_release + 20
1 libsystem_blocks.dylib 6813456656 _Block_release + 256
2 libobjc.A.dylib 6806640420 (anonymous namespace)::AutoreleasePoolPage::pop(void*) + 564
3 CoreFoundation 6529519172 _CFAutoreleasePoolPop + 28
4 UIKit 6605817924 _wrapRunLoopWithAutoreleasePoolHandler + 76
5 CoreFoundation 6530394704 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 32
6 CoreFoundation 6530382300 __CFRunLoopDoObservers + 360
7 CoreFoundation 6530383292 __CFRunLoopRun + 836
8 CoreFoundation 6529519780 CFRunLoopRunSpecific + 396
9 GraphicsServices 6682260900 GSEventRunModal + 168
10 UIKit 6606283712 UIApplicationMain + 1488
11 Spec 4297532060 main (main.m:15)
12 libdyld.dylib 6813280776 start + 4
I don't know why it would be _Block_release after (anonymous namespace)::AutoreleasePoolPage::pop(void*). Is it possible that a block was added to autoreleasepool?if possible, why the block crashed at release and it not crashed at invoke?
Ok,I had resolve this bug.The reason for the crash was that I had hook the function objectAtIndex for NSMutableArray.And If user switch from background,the app would get a crash -[UIKeyboardLayoutStar release]: message sent to deallocated.
So remove the hook code will resolve this bug.

iOS 7 MapKit Crash: EXC_BAD_ACCESS in [VKRasterOverlayTileSource invalidateRect:level:]

I have an unreproducible crash on iOS 7 only. I'm making heavy use of MKOverlayRenderer to draw shapes on the map. This crash does not happen on iOS 6.
Any ideas of what this might be related to will be useful.
Exception Type: EXC_BAD_ACCESS
Code: KERN_INVALID_ADDRESS at 0x291707628
Stack:
0 libobjc.A.dylib objc_msgSend + 5
1 VectorKit __50-[VKRasterOverlayTileSource invalidateRect:level:]_block_invoke_2 + 38
2 VectorKit -[VKTileKeyMap enumerateKeysAndObjectsUsingBlock:] + 58
3 VectorKit -[VKTilePool enumerateKeysAndObjectsUsingBlock:] + 76
4 VectorKit __50-[VKRasterOverlayTileSource invalidateRect:level:]_block_invoke + 178
5 ... libdispatch.dylib _dispatch_call_block_and_release + 10
6 libdispatch.dylib _dispatch_client_callout + 22
7 libdispatch.dylib _dispatch_main_queue_callback_4CF$VARIANT$mp + 268
8 CoreFoundation __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 8
9 CoreFoundation __CFRunLoopRun + 1300
10 CoreFoundation CFRunLoopRunSpecific + 522
11 CoreFoundation CFRunLoopRunInMode + 106
12 GraphicsServices GSEventRunModal + 138
I found my problem. Might be that it solves yours too... In dealloc, remove all of the MapViews overlays and the crash should be fixed...

Resources