Crash in macOS Content Filter System Extension

Hi,

One of our customers is seeing a crash in our Content Filter in our network system extension. We're kind of at a loss for the cause of this as only one specific person is running into this and we're not at all in the stacktrace, out of the hundreds of others deployed with our extension.

It would be greatly appreciated if we could have any help in diagnosing this issue. Attached is the crash report, and below is the crashing stacktrace. If this crash log is not sufficient, I have many more from the customer that I can attatch here.

Thread 4 Crashed::  Dispatch queue: NEFilterExtensionProviderContext queue
0   libsystem_kernel.dylib        	       0x18cd4e600 __pthread_kill + 8
1   libsystem_pthread.dylib       	       0x18cd86f70 pthread_kill + 288
2   libsystem_c.dylib             	       0x18cc93908 abort + 128
3   libc++abi.dylib               	       0x18cd3d44c abort_message + 132
4   libc++abi.dylib               	       0x18cd2ba40 demangling_terminate_handler() + 348
5   libobjc.A.dylib               	       0x18c9d13e4 _objc_terminate() + 156
6   libc++abi.dylib               	       0x18cd3c710 std::__terminate(void (*)()) + 16
7   libc++abi.dylib               	       0x18cd3c6b4 std::terminate() + 108
8   libdispatch.dylib             	       0x18cbd466c _dispatch_client_callout + 40
9   libdispatch.dylib             	       0x18cbdbc60 _dispatch_lane_serial_drain + 744
10  libdispatch.dylib             	       0x18cbdc79c _dispatch_lane_invoke + 432
11  libdispatch.dylib             	       0x18cbe77e8 _dispatch_root_queue_drain_deferred_wlh + 288
12  libdispatch.dylib             	       0x18cbe7034 _dispatch_workloop_worker_thread + 540
13  libsystem_pthread.dylib       	       0x18cd833d8 _pthread_wqthread + 288
14  libsystem_pthread.dylib       	       0x18cd820f0 start_wqthread + 8
Answered by DTS Engineer in 817061022

Looking through the stack crawl provided a couple of things stand out demangling_terminate_handler(), _dispatch_client_callout, and abort. There's also a call to abort_message so you might be able to find something in other logs. This looks like an unhandled exception in your code. demangling is something you usually see in C++ code. I'd look for unhandled C++ exceptions in your code (or libraries your code is calling).

Looking through the stack crawl provided a couple of things stand out demangling_terminate_handler(), _dispatch_client_callout, and abort. There's also a call to abort_message so you might be able to find something in other logs. This looks like an unhandled exception in your code. demangling is something you usually see in C++ code. I'd look for unhandled C++ exceptions in your code (or libraries your code is calling).

I'd look for unhandled C++ exceptions in your code (or libraries your code is calling).

Exactly.

This crash report indicates that your process crashed due to an unhandled language exception. Normally that’d result in a Last Exception Backtrace section in the crash report. However, if the exception was thrown by C++ code, that’s not generated [1].

Unfortunately that makes it hard to debug. The fact that this is on the NEFilterExtensionProviderContext queue suggests that the exception is being thrown by code in your NEFilterProvider subclass, most likely in one of the methods, like -handleNewFlow:, that you implement by overriding. I recommend that you add a top-level trycatch block to each of those methods to catch the exception before it ‘escapes’ your code.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] A source of ongoing annoyance. See the various posts on this thread.

Crash in macOS Content Filter System Extension
 
 
Q