Puzzling crash on iOS 16.0

Date/Time: 2022-06-10 06:57:07.9651 +0800 Launch Time: 2022-06-09 17:42:25.7993 +0800 OS Version: iPhone OS 16.0 (20A5283p) Release Type: Beta Baseband Version: 2.04.00 Report Version: 104

Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000058 Exception Codes: 0x0000000000000001, 0x0000000000000058 VM Region Info: 0x58 is not in any region. Bytes before following region: 206997290920 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL UNUSED SPACE AT START --->
commpage (reserved) 3032000000-7000000000 [255.2G] ---/--- SM=NUL ...(unallocated) Termination Reason: SIGNAL 11 Segmentation fault: 11 Terminating Process: exc handler [7705]

Triggered by Thread: 53

Thread 53 name: Thread 53 Crashed: 0 libdispatch.dylib 0x0000000186f68554 dispatch_source_set_timer + 32 (source.c:1389) 1 PrivacyAccounting 0x000000020f05632c -[PACoalescingIntervalTracker coalesce:] + 420 (PACoalescingIntervalTracker.m:101) 2 PrivacyAccounting 0x000000020f04af30 __22-[PAAccessLogger log:]_block_invoke + 360 (PAAccessLogger.m:209) 3 libdispatch.dylib 0x0000000186f621cc _dispatch_block_async_invoke2 + 148 (queue.c:555) 4 libdispatch.dylib 0x0000000186f530f4 _dispatch_client_callout + 20 (object.m:560) 5 libdispatch.dylib 0x0000000186f5a7ac _dispatch_lane_serial_drain + 672 (inline_internal.h:2631) 6 libdispatch.dylib 0x0000000186f5b32c _dispatch_lane_invoke + 436 (queue.c:3939) 7 libdispatch.dylib 0x0000000186f65ebc _dispatch_workloop_worker_thread + 652 (queue.c:6766) 8 libsystem_pthread.dylib 0x00000001fe9190a8 _pthread_wqthread + 288 (pthread.c:2599) 9 libsystem_pthread.dylib 0x00000001fe918e48 start_wqthread + 8

It is even more puzzling because you tell nothing about the code itself…

You have a segmentation fault. That could come from many reasons:

  • some view defined without setting frame
  • Did you first try the usual option-clean build folder ?

Could also be a problem similar to this one

  • https ://github .com/xmartlabs/Eureka/issues/2057
  • where self in some extension or some code was confusing the compiler ? See also detail
  • https ://github .com/xmartlabs/Eureka/pull/2061

May have a look here for more ideas. https://developer.apple.com/forums/thread/665184

Supplementary information in the second reply.

As the above log, we received a batch of crash logs of our App, which all have the following common features:

  • On iOS 16.0
  • Crash threads all have these calls:

0 libdispatch.dylib dispatch_source_set_timer + 32 (source.c:1389)

1 PrivacyAccounting -[PACoalescingIntervalTracker coalesce:] + 420 (PACoalescingIntervalTracker.m:101)

2 PrivacyAccounting __22-[PAAccessLogger log:]_block_invoke + 360 (PAAccessLogger.m:209)

  • Different logs, but all crashed from accessing 0x58.

Is it only iOS 16 (which is beta, so that is not uncommon) ?

Do you use external framework (as FireBase) ? If so, have a look here: https://developer.apple.com/forums/thread/665276

Could you find which part of code causes the crash ? Or at least when it occurs ? At launch ? During some authentication ?

If so, try to build a minimum app that shows the issue and file a bug report.

i have encounter similar problem on this 16-beta version

Pthread id: 647490 Thread 38 Crashed: 0 libdispatch.dylib 0x00000001c97d4554 _dispatch_source_set_runloop_timer_4CF + 32 1 PrivacyAccounting 0x00000002510ee32c -[PACoalescingIntervalTracker coalesce:] + 420 2 PrivacyAccounting 0x00000002510ee32c -[PACoalescingIntervalTracker coalesce:] + 420 3 PrivacyAccounting 0x00000002510e2f30 __22-[PAAccessLogger log:]_block_invoke + 360 4 libdispatch.dylib 0x00000001c97ce1cc _dispatch_block_async_invoke2 + 148 5 libdispatch.dylib 0x00000001c97bf0f4 _dispatch_client_callout + 20 6 libdispatch.dylib 0x00000001c97c67ac _dispatch_lane_serial_drain + 672 7 libdispatch.dylib 0x00000001c97c732c _dispatch_lane_invoke + 436 8 libdispatch.dylib 0x00000001c97d1ebc _dispatch_workloop_worker_thread + 652 9 libsystem_pthread.dylib 0x00000002409b10a8 _pthread_wqthread + 288

Same crash here on the release version of iOS 16.0 (20A362)

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000058
Exception Codes: 0x0000000000000001, 0x0000000000000058
VM Region Info: 0x58 is not in any region.  Bytes before following region: 4374265768
      REGION TYPE                 START - END      [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      UNUSED SPACE AT START
--->  
      __TEXT                   104ba0000-107bc0000 [ 48.1M] r-x/r-x SM=COW  ...p/godlike_iOS
Termination Reason: SIGNAL 11 Segmentation fault: 11
Terminating Process: exc handler [1841]

Thread 0 name:   Dispatch queue: */file=89)
Thread 0:
0   libobjc.A.dylib               	       0x19a141cc4 objc_msgSend + 196
1   CoreData                      	       0x1a84d7940 -[NSXPCStore executeFetchRequest:withContext:error:] + 463
2   CoreData                      	       0x1a84730b0 -[NSXPCStore executeRequest:withContext:error:] + 143
3   CoreData                      	       0x1a859cb6c __65-[NSPersistentStoreCoordinator executeRequest:withContext:error:]_block_invoke.551 + 4183
4   CoreData                      	       0x1a84685f4 -[NSPersistentStoreCoordinator _routeHeavyweightBlock:] + 263
5   CoreData                      	       0x1a842ca8c -[NSPersistentStoreCoordinator executeRequest:withContext:error:] + 1079
6   CoreData                      	       0x1a841fd30 -[NSManagedObjectContext executeFetchRequest:error:] + 687
7   PhotoLibraryServices          	       0x1b59fa0b8 -[PLManagedObjectContext _pl_executeFetchRequest:error:] + 255
8   PhotoLibraryServices          	       0x1b5859688 -[PLManagedObjectContext executeFetchRequest:error:] + 87
9   Photos                        	       0x1b5596a00 __98-[PHPhotoLibrary fetchDictionariesByPHClassForOIDs:propertyHint:includeTrash:overrideWithPHClass:]_block_invoke + 467
10  PhotoLibraryServices          	       0x1b59f9e94 __53-[PLManagedObjectContext _directPerformBlockAndWait:]_block_invoke + 47
11  CoreData                      	       0x1a8489c20 developerSubmittedBlockToNSManagedObjectContextPerform + 155
12  libdispatch.dylib             	       0x1a8205fdc _dispatch_client_callout + 19
13  libdispatch.dylib             	       0x1a8215574 _dispatch_lane_barrier_sync_invoke_and_complete + 55
14  CoreData                      	       0x1a84897a8 -[NSManagedObjectContext performBlockAndWait:] + 263
15  PhotoLibraryServices          	       0x1b59f9e48 -[PLManagedObjectContext _directPerformBlockAndWait:] + 143
16  PhotoLibraryServices          	       0x1b59f94e8 -[PLManagedObjectContext performBlockAndWait:] + 195
17  Photos                        	       0x1b55b0574 -[PHPhotoLibrary fetchDictionariesByPHClassForOIDs:propertyHint:includeTrash:overrideWithPHClass:] + 579
18  Photos                        	       0x1b55af24c -[PHPhotoLibrary fetchPHObjectsForOIDs:propertyHint:includeTrash:overrideResultsWithClass:] + 135
19  Photos                        	       0x1b55af040 -[PHBatchFetchingArray _phObjectsForOIDs:] + 415
20  Photos                        	       0x1b55aedcc -[PHBatchFetchingArray _fetchObjectsInBatchNumber:] + 435
21  Photos                        	       0x1b55aeb74 __67-[PHBatchFetchingArray _batchForBatchNumber:shouldUpdateLastBatch:]_block_invoke + 47
22  PhotoLibraryServicesCore      	       0x1b5fe1658 __27-[PLLazyObject objectValue]_block_invoke + 83
23  PhotoLibraryServicesCore      	       0x1b5fda3fc PLResultWithUnfairLock + 55
24  PhotoLibraryServicesCore      	       0x1b5fd0fcc -[PLLazyObject objectValue] + 103
25  Photos                        	       0x1b559c544 -[PHBatchFetchingArray _batchForBatchNumber:shouldUpdateLastBatch:] + 443
26  Photos                        	       0x1b559c288 -[PHBatchFetchingArray _phObjectAtIndex:] + 59
27  Photos                        	       0x1b559f8c8 -[PHBatchFetchingArray _populateObjectBuffer:range:] + 87
28  Photos                        	       0x1b559f850 -[PHBatchFetchingArray countByEnumeratingWithState:objects:count:] + 91
29  Photos                        	       0x1b559f688 -[PHFetchResult countByEnumeratingWithState:objects:count:] + 59
30  App                   	               0x107636230 -[PhotoPickerManager getCameraRollAlbumContentImage:contentVideo:ascending:completion:] + 535 
31  App                   	               0x1078ee31c __100-[ShowPhotoPickerManager innerShowPhotoPickerInController:pickerConfig:isFromPublish:finishBlock:]_block_invoke + 235 
32  libdispatch.dylib             	       0x1a82044b4 _dispatch_call_block_and_release + 31
33  libdispatch.dylib             	       0x1a8205fdc _dispatch_client_callout + 19
34  libdispatch.dylib             	       0x1a82147f4 _dispatch_main_queue_drain + 927
35  libdispatch.dylib             	       0x1a8214444 _dispatch_main_queue_callback_4CF + 43
36  CoreFoundation                	       0x1a0e1aa08 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 15
37  CoreFoundation                	       0x1a0dfc368 __CFRunLoopRun + 2035
38  CoreFoundation                	       0x1a0e011e4 CFRunLoopRunSpecific + 611
39  GraphicsServices              	       0x1d9c21368 GSEventRunModal + 163
40  UIKitCore                     	       0x1a32b0d88 -[UIApplication _run] + 887
41  UIKitCore                     	       0x1a32b09ec UIApplicationMain + 339
42  App                   	               0x107bc1740 main + 215 (main.m:49)
43  dyld                          	       0x1bf125948 start + 2503

Thread 16 name:   Dispatch queue: com.apple.privacyaccounting.PAAccessLogger
Thread 16 Crashed:
0   libdispatch.dylib             	       0x1a821b4a8 _dispatch_source_set_runloop_timer_4CF + 32
1   PrivacyAccounting             	       0x1bf2b41e8 -[PACoalescingIntervalTracker coalesce:] + 423
2   PrivacyAccounting             	       0x1bf2b41e8 -[PACoalescingIntervalTracker coalesce:] + 423
3   PrivacyAccounting             	       0x1bf2a8d34 __22-[PAAccessLogger log:]_block_invoke + 359
4   libdispatch.dylib             	       0x1a8215114 _dispatch_block_async_invoke2 + 147
5   libdispatch.dylib             	       0x1a8205fdc _dispatch_client_callout + 19
6   libdispatch.dylib             	       0x1a820d694 _dispatch_lane_serial_drain + 671
7   libdispatch.dylib             	       0x1a820e214 _dispatch_lane_invoke + 435
8   libdispatch.dylib             	       0x1a8218e10 _dispatch_workloop_worker_thread + 651
9   libsystem_pthread.dylib       	       0x1ed6a8df8 _pthread_wqthread + 287
10  libsystem_pthread.dylib       	       0x1ed6a8b98 start_wqthread + 7

Main thread is enumerating PHAssetResult when crashed.

  PHFetchResult<PHAssetCollection *> *smartAlbums = [PHAssetCollection fetchAssetCollectionsWithType:PHAssetCollectionTypeSmartAlbum subtype:PHAssetCollectionSubtypeAlbumRegular options:nil];
  for (PHAssetCollection *collection in smartAlbums) { // Stuck at this line.
     /// ...
  }

we have encountered this crash too. from the sensors we could see the crash scenario is users choosing the photos from gallery. but we could not reproduce it either.

Crashed: com.apple.privacyaccounting.PAAccessLogger
0  libdispatch.dylib              0x194a8 dispatch_source_set_timer + 32
1  libdispatch.dylib              0x194a8 _dispatch_source_set_runloop_timer_4CF + 32
2  PrivacyAccounting              0xf1e8 -[PACoalescingIntervalTracker coalesce:] + 424
3  PrivacyAccounting              0x3d34 __22-[PAAccessLogger log:]_block_invoke + 360
4  libdispatch.dylib              0x13114 _dispatch_block_async_invoke2 + 148
5  libdispatch.dylib              0x3fdc _dispatch_client_callout + 20
6  libdispatch.dylib              0xb694 _dispatch_lane_serial_drain + 672
7  libdispatch.dylib              0xc214 _dispatch_lane_invoke + 436
8  libdispatch.dylib              0x16e10 _dispatch_workloop_worker_thread + 652
9  libsystem_pthread.dylib        0xdf8 _pthread_wqthread + 288
10 libsystem_pthread.dylib        0xb98 start_wqthread + 8

com.apple.main-thread
0  libsystem_platform.dylib       0xbe0 __bzero + 64
1  libsystem_platform.dylib       0xbe0 _platform_bzero + 64
2  ImageIO                        0x1ff8c PNGReadPlugin::copyImageBlockSetStandard(InfoRec*, CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 1200
3  ImageIO                        0x66dc4 PNGReadPlugin::copyImageBlockSet(InfoRec*, CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 44
4  ImageIO                        0x19f98 IIO_Reader::CopyImageBlockSetProc(void*, CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 228
5  ImageIO                        0x15aa8 IIOImageProviderInfo::copyImageBlockSetWithOptions(CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 744
6  ImageIO                        0x1db4c IIOImageProviderInfo::CopyImageBlockSetWithOptions(void*, CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 828
7  ImageIO                        0x6f50 IIOImagePixelDataProvider::getBytesImageProvider(void*, unsigned long) + 500
8  ImageIO                        0x89c28 AppleJPEGWritePlugin::writeOne(IIOImagePixelDataProvider*, IIODictionary*, IIODictionary*, unsigned int) + 1228
9  ImageIO                        0x89198 AppleJPEGWritePlugin::writeAll() + 404
10 ImageIO                        0x6eaa0 IIO_Writer_AppleJPEG::write(void*, void*) + 84
11 ImageIO                        0x3187c IIOImageDestination::finalizeDestination() + 652
12 ImageIO                        0x9978 CGImageDestinationFinalize + 132
13 UIKitCore                      0x42db24 _UIImageJPEGRepresentation + 652
14 HLLDriver-SEA                  0xb453a0 -[UIImage(HLL) base64StringWithQuality:] + 18 (UIImage+HLL.m:18)
15 HLLDriver-SEA                  0xd3e7b4 LMDImagePickerController.imagePickerController(_:didFinishPickingMediaWithInfo:) + 94 (LMDImagePickerController.swift:94)
16 HLLDriver-SEA                  0xd3eafc @objc LMDImagePickerController.imagePickerController(_:didFinishPickingMediaWithInfo:) + 5844112 (<compiler-generated>:5844112)
17 UIKitCore                      0x77a684 -[UIImagePickerController _imagePickerDidCompleteWithInfo:] + 92
18 UIKitCore                      0x77a034 __60-[UIImagePickerController didSelectMediaWithInfoDictionary:]_block_invoke + 44
19 libdispatch.dylib              0x24b4 _dispatch_call_block_and_release + 32
20 libdispatch.dylib              0x3fdc _dispatch_client_callout + 20
21 libdispatch.dylib              0x127f4 _dispatch_main_queue_drain + 928
22 libdispatch.dylib              0x12444 _dispatch_main_queue_callback_4CF + 44
23 CoreFoundation                 0x9aa08 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 16
24 CoreFoundation                 0x7c368 __CFRunLoopRun + 2036
25 CoreFoundation                 0x811e4 CFRunLoopRunSpecific + 612
26 GraphicsServices               0x1368 GSEventRunModal + 164
27 UIKitCore                      0x3a2d88 -[UIApplication _run] + 888
28 UIKitCore                      0x3a29ec UIApplicationMain + 340
29 HLLDriver-SEA                  0x590c main + 36 (main.m:36)
30 ???                            0x1abfc9948 (Missing)

the related code is

public func imagePickerController(
  _ picker: UIImagePickerController,
  didFinishPickingMediaWithInfo info: [UIImagePickerController.InfoKey: Any]
 ) {
  if let block = completeBlock {
   block(picker, info)
  } else {
   if (info[.mediaType] as? String) == "public.image" {
    let image = (info[.originalImage] as? UIImage)?.normalized()
    let base64 =
     image?
     .base64String(withQuality: 1.0)
     .replacingOccurrences(of: "\r\n", with: "") ?? ""
    let js = "\(callBackName)('data:image/jpeg;base64,\(base64)');"
    sourceController?.evaluateJavaScript(jsStr: js) { _, _ in
     picker.dismiss(animated: true, completion: nil)
    }
   }
  }

Rúguǒ nǐ swizzlele NSMutableDictionary de “setObject:ForKeyedSubscript:” Fāngfǎ. - (Void)***_setObject:(Id)obj forKeyedSubscript:(Id)key { if (!Key ||!Obj) return; [self ***_setObject:Obj forKeyedSubscript:Key]; } nàme shānchú “||!Obj” jí kě jiějué!

朗读 244 / 5,000

翻译结果

If you swizzle the "setObject:forKeyedSubscript:" method of NSMutableDictionary.

- (void)***_setObject:(id)obj forKeyedSubscript:(id<NSCopying>)key
{
     if (!key || !obj) return;
     [self ***_setObject:obj forKeyedSubscript:key];
}

Then delete "|| !obj" and it will be solved!

Is there a solution for this now? This only appears on iOS16

Puzzling crash on iOS 16.0
 
 
Q