iOS CoreFoundation crash with EXC_BAD_ACCESS

Note that the crashed threads all contain something like this:

Code Block  
2 … performQueueDequeue + 508 …
3 … __NSThreadPerformPerform + 112 …
4 … __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 28 …

However, the crashes all have different immediate causes. This suggests that something is deeply broken with the NSThread perform subsystem (as used, for example, by -performSelectorInBackground:withObject:). My experience is that this subsystem is very robust, suggesting that it’s just colateral damage from some other failure in your process. The most likely cause of that is memory corruption, so my advice is that you engage the standard memory debugging tools to see if they flag any memory errors.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

I tried to use Address Sanitizer (Xcode 12.4 (12D4e)), but I get this error。

Code Block 
==985==ERROR: AddressSanitizer failed to allocate 0xffffffffff9fc000 (-6307840) bytes at address 2db624000 (errno: 22)
==985==ReserveShadowMemoryRange failed while trying to map 0xffffffffff9fc000 bytes. Perhaps you're using ulimit -v

I run ulimit -v on the terminal. show unlimited

I follow this link ASAN_OPTIONS environment variable .

1. Please set the ASAN_OPTIONS environment variable with value verbosity=3 (you can do this in Xcode's scheme editor) and launch your app with ASan in Xcode with debugger attached. Setting the environment variable will cause ASan to print out more information about what it's doing when the app starts. When ASan crashes the debugger should still be attached. In the debugger console type bt all and press enter. This should print the stacktrace of the all the running threads in the program. Please attach the entire output to the report.

result:

Code Block 
==994==AddressSanitizer: libc interceptors initialized
==994==FindDynamicShadowStart, space_size = 0x00005b003fff
|| `[0x0002db020000, 0x0002d7ffffff]` || HighMem  ||
|| `[0x0002db624000, 0x0002db01ffff]` || HighShadow ||
|| `[0x0002d0024000, 0x0002db623fff]` || ShadowGap ||
|| `[0x000280020000, 0x0002d0023fff]` || LowShadow ||
|| `[0x000000000000, 0x00028001ffff]` || LowMem   ||
MemToShadow(shadow): 0x0002d0024000 0x0002da0247ff 0x0002db6e4800 0x0002db623fff
redzone=16
max_redzone=2048
quarantine_size_mb=16M
thread_local_quarantine_size_kb=64K
malloc_context_size=30
SHADOW_SCALE: 3
SHADOW_GRANULARITY: 8
SHADOW_OFFSET: 0x280020000
==994==ERROR: AddressSanitizer failed to allocate 0xffffffffff9fc000 (-6307840) bytes at address 2db624000 (errno: 22)
==994==ReserveShadowMemoryRange failed while trying to map 0xffffffffff9fc000 bytes. Perhaps you're using ulimit -v

Code Block 
(lldb) bt all
* thread #1, stop reason = signal SIGABRT
 * frame #0: 0x00000001b5e6484c libsystem_kernel.dylib`__pthread_kill + 8
  frame #1: 0x00000001d26c29e8 libsystem_pthread.dylib`pthread_kill + 212
  frame #2: 0x0000000192c7b8f4 libsystem_c.dylib`abort + 100
  frame #3: 0x0000000108d268c8 libclang_rt.asan_ios_dynamic.dylib`__sanitizer::Abort() + 64
  frame #4: 0x0000000108d12918 libclang_rt.asan_ios_dynamic.dylib`__asan::ReserveShadowMemoryRange(unsigned long, unsigned long, char const*) + 244
  frame #5: 0x0000000108d129d4 libclang_rt.asan_ios_dynamic.dylib`__asan::InitializeShadowMemory() + 188
  frame #6: 0x0000000108d11e7c libclang_rt.asan_ios_dynamic.dylib`__asan::AsanInitInternal() + 336
  frame #7: 0x0000000108d09144 libclang_rt.asan_ios_dynamic.dylib`wrap_malloc_default_zone + 60
  frame #8: 0x0000000199325814 libsystem_malloc.dylib`__malloc_init + 600
  frame #9: 0x00000001b88d3868 libSystem.B.dylib`libSystem_initializer + 176
  frame #10: 0x0000000108bf8810 dyld`ImageLoaderMachO::doModInitFunctions(ImageLoader::LinkContext const&) + 424
  frame #11: 0x0000000108bf8bd8 dyld`ImageLoaderMachO::doInitialization(ImageLoader::LinkContext const&) + 52
  frame #12: 0x0000000108bf3600 dyld`ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 536
  frame #13: 0x0000000108bf356c dyld`ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 388
  frame #14: 0x0000000108bf356c dyld`ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 388
  frame #15: 0x0000000108bf1878 dyld`ImageLoader::processInitializers(ImageLoader::LinkContext const&, unsigned int, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 184
  frame #16: 0x0000000108bf1940 dyld`ImageLoader::runInitializers(ImageLoader::LinkContext const&, ImageLoader::InitializerTimingList&) + 92
  frame #17: 0x0000000108be2688 dyld`dyld::initializeMainExecutable() + 136
  frame #18: 0x0000000108be7928 dyld`dyld::_main(macho_header const*, unsigned long, int, char const, char const, char const**, unsigned long*) + 5216
  frame #19: 0x0000000108be1208 dyld`dyldbootstrap::start(dyld3::MachOLoaded const*, int, char const**, dyld3::MachOLoaded const*, unsigned long*) + 396
  frame #20: 0x0000000108be1038 dyld`_dyld_start + 56

What's the problem? Can't AddressSanitizer be used on physical iOS devices?

Can't AddressSanitizer be used on physical iOS devices?

ASan is working for me on a real device. Specifically:

• Xcode 12.4

• macOS 11.2.3

• iOS 14.4.2

I created a new iOS app project and wired up a button to this code:

Code Block  
@IBAction
private func testAction(_ sender: Any) {
    let p = UnsafeMutablePointer<Int>.allocate(capacity: 1)
    p.deallocate()
    p.pointee += 1
}

I then enabled ASan via Product > Scheme > Edit Scheme > Diagnostics > Address Sanitizer. When I run the app on my device and tap the button, ASan kvetches as follows:

Code Block  
==1749==ERROR: AddressSanitizer: heap-use-after-free on address 0x0001092abc10 at pc 0x0001048e1690 bp 0x00016b520c90 sp 0x00016b520c88
… 242 more lines of backtraces and other info …

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"