SIGABRT inside GCD with iOS 6.1 - ios

Question

We're having a weird crash inside libdispatch internal functions and after hours and hour of research we have no clue about what's happening.
The crash trace is:
Incident Identifier: 7A5CBCD8-28A3-4AC5-937A-D5BA69A64B67
CrashReporter Key: [TODO]
Hardware Model: iPhone5,2
Process: Memoir Dev [6973]
Path: /Users/USER/Memoir Dev.app/Memoir Dev
Identifier: com.veri.memoir-enterprise
Version: 0.9.191
Code Type: ARM
Parent Process: launchd [1]
Date/Time: 2013-03-03 20:55:42 +0000
OS Version: iPhone OS 6.1.2 (10B146)
Report Version: 104
Exception Type: SIGABRT
Exception Codes: #0 at 0x3ae66350
Crashed Thread: 1
Thread 0:
0 libsystem_kernel.dylib 0x3ae55e30 _mach_msg_trap + 20
1 CoreFoundation 0x000972bb __CFRunLoopServiceMachPort + 131
2 CoreFoundation 0x00095fdb __CFRunLoopRun + 819
3 CoreFoundation 0x32bc823d _CFRunLoopRunSpecific + 357
4 CoreFoundation 0x32bc80c9 _CFRunLoopRunInMode + 105
5 GraphicsServices 0x367a633b _GSEventRunModal + 75
6 UIKit 0x34ae42b9 _UIApplicationMain + 1121
7 Memoir Dev 0x0002a0d7 main (main.m:20)
Thread 1 Crashed:
0 libsystem_kernel.dylib 0x3ae66350 ___pthread_kill + 8
1 libsystem_c.dylib 0x3ae1936b _abort + 95
2 libsystem_c.dylib 0x3adb212d _free + 361
3 libdispatch.dylib 0x000088d1 _dispatch_kevent_register + 169
4 libdispatch.dylib 0x00007e91 _dispatch_source_kevent_register + 33
5 libdispatch.dylib 0x00008957 _dispatch_timer_list_update + 27
6 libdispatch.dylib 0x00006b81 _dispatch_mgr_invoke + 389
7 libdispatch.dylib 0x00002378 _dispatch_mgr_thread + 36
Thread 2:
0 libsystem_kernel.dylib 0x3ae55e30 _mach_msg_trap + 20
[...]
A bit of background about our code and scenario:
We're using extensively NSOperations and GCD to upload data to our server
The crash seems to happen when the app is uploading in background, within the 10 minutes limit
The crash started to happen around feb/9 using iOS 6.1 (10B143), just few days after we upgrade from 6.0.2 to 6.1
Until now we can reproduce it in iOS 6.1.2 (10B146) but don't in 6.0.1 (10A523)
Regarding SIGABRT exception type, it seems someone is calling 'abort' function (indeed, it's 'free' called by 'dispatch_kevent_register')
Does any of you know if there's any known issue inside GCD in iOS 6.1 and later?

Answer 1

This is free() aborting due to heap corruption in the process.
The dispatch manager thread being the one to hit the abort() is likely incidental (the backtrace indicates it woke up to asynchronously install a new dispatch timer source and malloc detected the corruption at that time).
You may want to try running with GuardMalloc (see Diagnostics tab in XCode scheme editor), it is more likely to give you a crashpoint when the corruption actually occurs.
Alternatively the various malloc debug environment variables may help track down the culprit, c.f. ENVIRONMENT in malloc(3)