==10887==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200047b670 at pc 0x00010f18f7d0 bp 0x7ff7bbc33b40 sp 0x7ff7bbc332e8 READ of size 1 at 0x60200047b670 thread T0 #0 0x10f18f7cf in wrap_strcmp+0x32f (libclang_rt.asan_iossim_dynamic.dylib:x86_64+0x187cf) #1 0x7ff800111b32 in bsearch+0x38 (libsystem_c.dylib:x86_64+0x5cb32) #2 0x7ff808ec0d22 in CGPDFDictionaryGetUnresolvedObject+0x2e (CoreGraphics:x86_64+0x405d22) #3 0x7ff808ec0d6a in CGPDFDictionaryGetObject+0x25 (CoreGraphics:x86_64+0x405d6a) #4 0x7ff808ec0f57 in CGPDFDictionaryGetArray+0x25 (CoreGraphics:x86_64+0x405f57) #5 0x7ff808ec115b in CGPDFDictionaryGetNumbers+0x28 (CoreGraphics:x86_64+0x40615b) #6 0x7ff808ec10a4 in CGPDFDictionaryGetRect+0x27 (CoreGraphics:x86_64+0x4060a4) #7 0x7ff808d1735f in get_page_box+0x4e (CoreGraphics:x86_64+0x25c35f) #8 0x7ff808d171ba in pdf_page_get_box_rect+0x8e (CoreGraphics:x86_64+0x25c1ba) #9 0x7ff808b2ee35 in CGPDFPageGetBoxRect+0x74 (CoreGraphics:x86_64+0x73e35) #10 0x11da5fdd9 in better_pdf_transform+0x6e (PrintKitUI:x86_64+0x3fdd9) #11 0x11da60abb in getPageImageForPage+0x834 (PrintKitUI:x86_64+0x40abb) #12 0x11da8d48e in -[UIPrintPreviewPageFetcher _drawPageContextIntoImage:]+0x1b7 (PrintKitUI:x86_64+0x6d48e) #13 0x11da8ca2a in -[UIPrintPreviewPageFetcher sheetImageForItemAt:]+0xaf (PrintKitUI:x86_64+0x6ca2a) #14 0x11da4f668 in -[UIPrintPreviewViewController collectionView:cellForItemAtIndexPath:]+0xa5 (PrintKitUI:x86_64+0x2f668) #15 0x12aa9cc24 in -[UICollectionView _createPreparedCellForItemAtIndexPath:withLayoutAttributes:applyAttributes:isFocused:notify:]+0x4ed (UIKitCore:x86_64+0x33bc24) #16 0x12aa9c6bf in -[UICollectionView _preparedCellForItemAtIndexPath:withLayoutAttributes:applyAttributes:isFocused:notify:]+0x2dd (UIKitCore:x86_64+0x33b6bf) #17 0x12aac253d in __114-[UICollectionView _createAndAppendViewAnimationsForInsertsInCurrentUpdate:appearingAnimations:newSubviewManager:]_block_invoke+0x240 (UIKitCore:x86_64+0x36153d) #18 0x12aac222c in -[UICollectionView _createAndAppendViewAnimationsForInsertsInCurrentUpdate:appearingAnimations:newSubviewManager:]+0x933 (UIKitCore:x86_64+0x36122c) #19 0x12aac0755 in -[UICollectionView _viewAnimationsForCurrentUpdateWithCollectionViewAnimator:]+0x122 (UIKitCore:x86_64+0x35f755) #20 0x12aaca4a3 in __102-[UICollectionView _updateWithItems:tentativelyForReordering:propertyAnimator:collectionViewAnimator:]_block_invoke.2323+0xf9 (UIKitCore:x86_64+0x3694a3) #21 0x12bbc79ee in +[UIView(Animation) performWithoutAnimation:]+0x53 (UIKitCore:x86_64+0x14669ee) #22 0x12aac93a6 in -[UICollectionView _updateWithItems:tentativelyForReordering:propertyAnimator:collectionViewAnimator:]+0x802 (UIKitCore:x86_64+0x3683a6) #23 0x12aabfa1e in -[UICollectionView _endItemAnimationsWithInvalidationContext:tentativelyForReordering:animator:collectionViewAnimator:]+0x3807 (UIKitCore:x86_64+0x35ea1e) #24 0x12aabb3b8 in -[UICollectionView _updateRowsAtIndexPaths:updateAction:updates:]+0x1eb (UIKitCore:x86_64+0x35a3b8) #25 0x12aabb542 in -[UICollectionView reloadItemsAtIndexPaths:]+0x3d (UIKitCore:x86_64+0x35a542) #26 0x11da4fef4 in -[UIPrintPreviewViewController reloadVisibleItems:]+0x1a6 (PrintKitUI:x86_64+0x2fef4) #27 0x11da4e1cf in __63-[UIPrintPreviewViewController updatePdfURL:options:completed:]_block_invoke_2+0x36 (PrintKitUI:x86_64+0x2e1cf) #28 0x7ff800c1d5c9 in __NSBLOCKOPERATION_IS_CALLING_OUT_TO_A_BLOCK__+0x6 (Foundation:x86_64+0x51f5c9) #29 0x7ff800c1d4c1 in -[NSBlockOperation main]+0x61 (Foundation:x86_64+0x51f4c1) #30 0x7ff800c204e8 in __NSOPERATION_IS_INVOKING_MAIN__+0x10 (Foundation:x86_64+0x5224e8) #31 0x7ff800c1c727 in -[NSOperation start]+0x30d (Foundation:x86_64+0x51e727) #32 0x7ff800c20e35 in __NSOPERATIONQUEUE_IS_STARTING_AN_OPERATION__+0x10 (Foundation:x86_64+0x522e35) #33 0x7ff800c20981 in __NSOQSchedule_f+0xb5 (Foundation:x86_64+0x522981) #34 0x11d71ef5a in _dispatch_client_callout+0x7 (libdispatch.dylib:x86_64+0x4f5a) #35 0x11d7228d1 in _dispatch_block_invoke_direct+0x1ef (libdispatch.dylib:x86_64+0x88d1) #36 0x10f1bbeca in __wrap_dispatch_async_block_invoke+0xca (libclang_rt.asan_iossim_dynamic.dylib:x86_64+0x44eca) #37 0x11d71dd17 in _dispatch_call_block_and_release+0xb (libdispatch.dylib:x86_64+0x3d17) #38 0x11d71ef5a in _dispatch_client_callout+0x7 (libdispatch.dylib:x86_64+0x4f5a) #39 0x11d72fd54 in _dispatch_main_queue_drain+0x5b6 (libdispatch.dylib:x86_64+0x15d54) #40 0x11d72f78f in _dispatch_main_queue_callback_4CF+0x1e (libdispatch.dylib:x86_64+0x1578f) #41 0x7ff800387b1e in __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__+0x8 (CoreFoundation:x86_64+0x84b1e) #42 0x7ff800382435 in __CFRunLoopRun+0x9b1 (CoreFoundation:x86_64+0x7f435) #43 0x7ff8003816a6 in CFRunLoopRunSpecific+0x22f (CoreFoundation:x86_64+0x7e6a6) #44 0x7ff809cb1289 in GSEventRunModal+0x8a (GraphicsServices:x86_64+0x3289) #45 0x12b5a2ad2 in -[UIApplication _run]+0x3e1 (UIKitCore:x86_64+0xe41ad2) #46 0x12b5a79ee in UIApplicationMain+0x7a (UIKitCore:x86_64+0xe469ee) #47 0x105707d2b in main main.m:28 #48 0x10edc42be () #49 0x11df6730f () 0x60200047b670 is located 0 bytes inside of 10-byte region [0x60200047b670,0x60200047b67a) freed by thread T40 here: #0 0x10f1bcdd9 in wrap_free+0xa9 (libclang_rt.asan_iossim_dynamic.dylib:x86_64+0x45dd9) #1 0x7ff808ec0c84 in CGPDFDictionaryFinalize+0x34 (CoreGraphics:x86_64+0x405c84) #2 0x7ff800389a8a in _CFRelease+0x14c (CoreFoundation:x86_64+0x86a8a) #3 0x7ff808d2f7ed in pdf_xref_release+0xd4 (CoreGraphics:x86_64+0x2747ed) #4 0x7ff808e3851c in pdf_reader_release+0x2f (CoreGraphics:x86_64+0x37d51c) #5 0x7ff800389a8a in _CFRelease+0x14c (CoreFoundation:x86_64+0x86a8a) #6 0x7ff808b75429 in CGPDFDocumentFinalize(void const*)+0x79 (CoreGraphics:x86_64+0xba429) #7 0x7ff800389a8a in _CFRelease+0x14c (CoreFoundation:x86_64+0x86a8a) #8 0x11da8ec85 in __61-[UIPrintPreviewPageFetcher updatePdfURL:options:completion:]_block_invoke+0x684 (PrintKitUI:x86_64+0x6ec85) #9 0x7ff800c1d5c9 in __NSBLOCKOPERATION_IS_CALLING_OUT_TO_A_BLOCK__+0x6 (Foundation:x86_64+0x51f5c9) #10 0x7ff800c1d4c1 in -[NSBlockOperation main]+0x61 (Foundation:x86_64+0x51f4c1) #11 0x7ff800c204e8 in __NSOPERATION_IS_INVOKING_MAIN__+0x10 (Foundation:x86_64+0x5224e8) #12 0x7ff800c1c727 in -[NSOperation start]+0x30d (Foundation:x86_64+0x51e727) #13 0x7ff800c20e35 in __NSOPERATIONQUEUE_IS_STARTING_AN_OPERATION__+0x10 (Foundation:x86_64+0x522e35) #14 0x7ff800c20981 in __NSOQSchedule_f+0xb5 (Foundation:x86_64+0x522981) #15 0x11d71ef5a in _dispatch_client_callout+0x7 (libdispatch.dylib:x86_64+0x4f5a) #16 0x11d7228d1 in _dispatch_block_invoke_direct+0x1ef (libdispatch.dylib:x86_64+0x88d1) #17 0x10f1bbeca in __wrap_dispatch_async_block_invoke+0xca (libclang_rt.asan_iossim_dynamic.dylib:x86_64+0x44eca) #18 0x11d71dd17 in _dispatch_call_block_and_release+0xb (libdispatch.dylib:x86_64+0x3d17) #19 0x11d71ef5a in _dispatch_client_callout+0x7 (libdispatch.dylib:x86_64+0x4f5a) #20 0x11d722163 in _dispatch_continuation_pop+0x343 (libdispatch.dylib:x86_64+0x8163) #21 0x11d720f26 in _dispatch_async_redirect_invoke+0x3e4 (libdispatch.dylib:x86_64+0x6f26) #22 0x11d733e76 in _dispatch_root_queue_drain+0x19d (libdispatch.dylib:x86_64+0x19e76) #23 0x11d734b16 in _dispatch_worker_thread2+0x115 (libdispatch.dylib:x86_64+0x1ab16) #24 0x7ff836172c9c in _pthread_wqthread+0xff (libsystem_pthread.dylib:x86_64+0x2c9c) #25 0x7ff836171c66 in start_wqthread+0xe (libsystem_pthread.dylib:x86_64+0x1c66) previously allocated by thread T44 here: #0 0x10f1bcc90 in wrap_malloc+0xa0 (libclang_rt.asan_iossim_dynamic.dylib:x86_64+0x45c90) #1 0x10f18f2ca in wrap_strndup+0x6a (libclang_rt.asan_iossim_dynamic.dylib:x86_64+0x182ca) #2 0x7ff808b591bd in pdf_lexer_scan+0x1379 (CoreGraphics:x86_64+0x9e1bd) #3 0x7ff808cab0e0 in pdf_object_scanner_read_compound_object+0x48 (CoreGraphics:x86_64+0x1f00e0) #4 0x7ff808cab61f in pdf_object_scanner_read_indirect_object+0x7c (CoreGraphics:x86_64+0x1f061f) #5 0x7ff808d2fb3e in pdf_xref_resolve+0x275 (CoreGraphics:x86_64+0x274b3e) #6 0x7ff808c5fc69 in CGPDFArrayGetObject+0x51 (CoreGraphics:x86_64+0x1a4c69) #7 0x7ff808c5fe8e in CGPDFArrayGetDictionary+0x18 (CoreGraphics:x86_64+0x1a4e8e) #8 0x7ff808e38bc5 in add_pages+0xe6 (CoreGraphics:x86_64+0x37dbc5) #9 0x7ff808e38bd8 in add_pages+0xf9 (CoreGraphics:x86_64+0x37dbd8) #10 0x7ff808f3dbb7 in pdf_document_get_page_dictionary+0x1e0 (CoreGraphics:x86_64+0x482bb7) #11 0x7ff808b2e921 in CGPDFPageCreate2+0xdc (CoreGraphics:x86_64+0x73921) #12 0x7ff808b750b8 in CGPDFDocumentGetPage+0x8f (CoreGraphics:x86_64+0xba0b8) #13 0x7ff808b74f0b in CGPDFDocumentCreateWithProvider+0x30b (CoreGraphics:x86_64+0xb9f0b) #14 0x7ff808b756a6 in CGPDFDocumentCreateWithURL+0x26 (CoreGraphics:x86_64+0xba6a6) #15 0x11da8e676 in __61-[UIPrintPreviewPageFetcher updatePdfURL:options:completion:]_block_invoke+0x75 (PrintKitUI:x86_64+0x6e676) #16 0x7ff800c1d5c9 in __NSBLOCKOPERATION_IS_CALLING_OUT_TO_A_BLOCK__+0x6 (Foundation:x86_64+0x51f5c9) #17 0x7ff800c1d4c1 in -[NSBlockOperation main]+0x61 (Foundation:x86_64+0x51f4c1) #18 0x7ff800c204e8 in __NSOPERATION_IS_INVOKING_MAIN__+0x10 (Foundation:x86_64+0x5224e8) #19 0x7ff800c1c727 in -[NSOperation start]+0x30d (Foundation:x86_64+0x51e727) #20 0x7ff800c20e35 in __NSOPERATIONQUEUE_IS_STARTING_AN_OPERATION__+0x10 (Foundation:x86_64+0x522e35) #21 0x7ff800c20981 in __NSOQSchedule_f+0xb5 (Foundation:x86_64+0x522981) #22 0x11d71ef5a in _dispatch_client_callout+0x7 (libdispatch.dylib:x86_64+0x4f5a) #23 0x11d7228d1 in _dispatch_block_invoke_direct+0x1ef (libdispatch.dylib:x86_64+0x88d1) #24 0x10f1bbeca in __wrap_dispatch_async_block_invoke+0xca (libclang_rt.asan_iossim_dynamic.dylib:x86_64+0x44eca) #25 0x11d71dd17 in _dispatch_call_block_and_release+0xb (libdispatch.dylib:x86_64+0x3d17) #26 0x11d71ef5a in _dispatch_client_callout+0x7 (libdispatch.dylib:x86_64+0x4f5a) #27 0x11d722163 in _dispatch_continuation_pop+0x343 (libdispatch.dylib:x86_64+0x8163) #28 0x11d720f26 in _dispatch_async_redirect_invoke+0x3e4 (libdispatch.dylib:x86_64+0x6f26) #29 0x11d733e76 in _dispatch_root_queue_drain+0x19d (libdispatch.dylib:x86_64+0x19e76) Thread T40 created by T0 here: Thread T44 created by T43 here: Thread T43 created by T10 here: Thread T10 created by T2 here: #0 0x10f1b6edc in wrap_pthread_create+0x5c (libclang_rt.asan_iossim_dynamic.dylib:x86_64+0x3fedc) #1 0x12a743714 in __LoggerStart_block_invoke LoggerClient.m:509 #2 0x11d71ef5a in _dispatch_client_callout+0x7 (libdispatch.dylib:x86_64+0x4f5a) #3 0x11d7205b4 in _dispatch_once_callout+0x41 (libdispatch.dylib:x86_64+0x65b4) #4 0x12a7436ec in LoggerStart LoggerClient.m:505 #5 0x110fd836c in __28-[DDLog lt_addLogger:level:]_block_invoke_2 DDLog.m:706 #6 0x10f1bbeca in __wrap_dispatch_async_block_invoke+0xca (libclang_rt.asan_iossim_dynamic.dylib:x86_64+0x44eca) #7 0x11d71dd17 in _dispatch_call_block_and_release+0xb (libdispatch.dylib:x86_64+0x3d17) #8 0x11d71ef5a in _dispatch_client_callout+0x7 (libdispatch.dylib:x86_64+0x4f5a) #9 0x11d726d40 in _dispatch_lane_serial_drain+0x427 (libdispatch.dylib:x86_64+0xcd40) #10 0x11d727b1a in _dispatch_lane_invoke+0x1b8 (libdispatch.dylib:x86_64+0xdb1a) #11 0x11d735f12 in _dispatch_workloop_worker_thread+0x3be (libdispatch.dylib:x86_64+0x1bf12) #12 0x7ff836172ce2 in _pthread_wqthread+0x145 (libsystem_pthread.dylib:x86_64+0x2ce2) #13 0x7ff836171c66 in start_wqthread+0xe (libsystem_pthread.dylib:x86_64+0x1c66) Thread T2 created by T0 here: SUMMARY: AddressSanitizer: heap-use-after-free (libclang_rt.asan_iossim_dynamic.dylib:x86_64+0x187cf) in wrap_strcmp+0x32f Shadow bytes around the buggy address: 0x0c05394b7670: fa fa fa fa fa fa fa fa fa fa fd fd fa fa fd fd 0x0c05394b7680: fa fa fd fa fa fa fa fa fa fa fd fa fa fa fa fa 0x0c05394b7690: fa fa fa fa fa fa fd fd fa fa fd fa fa fa 04 fa 0x0c05394b76a0: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fa fa 0x0c05394b76b0: fa fa fd fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c05394b76c0: fa fa fd fd fa fa fa fa fa fa fd fa fa fa[fd]fd 0x0c05394b76d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c05394b76e0: fa fa fa fa fa fa fa fa fa fa fd fa fa fa fa fa 0x0c05394b76f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c05394b7700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fd fa 0x0c05394b7710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==10887==ABORTING