Facebook-ios-sdk: FB SDK crash at FBSDKSwizzler
Checklist
- [x] installed the newest FB sdk 7.1.1
- [x] I've searched for existing GitHub issues
- [x] I've looked for existing answers on Stack Overflow, the Facebook Developer Community Forum and the Facebook Developers Group
- [x] I've read the Code of Conduct
- [x] This issue is not security related and can safely be disclosed publicly on GitHub
Environment
Describe your dev environment here, giving as many details as possible. If you have them, make sure to include:
- Xcode Version:
Version 11.6 - Swift Version:
4.1.0(if issue is Swift related) - Installation Platform & Verison:
[Cocoapods]version1.6.1
Goals
What do you want to achieve?
Fix this crash or find a way to avoid it through server configuration
Expected Results
What do you expect to happen?
No crash
Actual Results
What actually happened? Can you provide a stack trace?
Incident Identifier: 8F677896-DCD4-4AAF-97AD-0BA9185F0978
Hardware Model: iPhone5,2
Process: xxxxxPH [1976]
Path: /private/var/containers/Bundle/Application/7B78063A-C692-4ECC-824A-17DE16F8073A/xxxxxPH.app/xxxxxPH
Identifier: com.beeasy.xxxxx.ph
Version: 2.60.4 (2.60.4)
Code Type: ARM (Native)
Role: Foreground
Parent Process: launchd [1]
Coalition: com.beeasy.xxxxx.ph [761]
Date/Time: 2020-09-03 11:36:00.2964 +0800
Launch Time: 2020-09-03 11:33:50.0000 +0800
OS Version: iPhone OS 10.3.4 (14G61)
Report Version: 104
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x00000040
Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [0]
Triggered by Thread: 0
Thread 0 name:
Thread 0 Crashed:
0 libobjc.A.dylib 0x1ae9521e allocateBuckets(unsigned short) + 24 (objc-runtime-new.h:45)
1 libobjc.A.dylib 0x1ae953c6 cache_t::reallocate(unsigned short, unsigned short) + 30 (objc-cache.mm:452)
2 libobjc.A.dylib 0x1ae9583e cache_fill + 290 (objc-cache.mm:560)
3 libobjc.A.dylib 0x1ae9ecf6 lookUpImpOrForward + 398 (objc-runtime-new.mm:4792)
4 libobjc.A.dylib 0x1ae9eb64 _class_lookupMethodAndLoadCache3 + 26 (objc-runtime-new.mm:4804)
5 libobjc.A.dylib 0x1aea51ae _objc_msgSend_uncached + 14
6 CoreFoundation 0x1bc0ff2c objectIsKindOfNSException + 34 (NSException.m:46)
7 CoreFoundation 0x1bc0faca __exceptionPreprocess + 14 (NSException.m:159)
8 libobjc.A.dylib 0x1ae97066 objc_exception_throw + 38 (objc-exception.mm:521)
9 Foundation 0x1c53a038 _NSOutOfMemoryErrorHandler + 60 (NSPlatform.m:297)
10 CoreFoundation 0x1bbe25cc __CFStringChangeSizeMultiple + 1364 (CFString.c:968)
11 CoreFoundation 0x1bbe04d0 __CFStringAppendBytes + 400 (CFString.c:1101)
12 CoreFoundation 0x1bbdc508 __CFStringAppendFormatCore + 10888 (CFString.c:5567)
13 CoreFoundation 0x1bbd9a66 _CFStringCreateWithFormatAndArgumentsAux2 + 188 (CFString.c:1878)
14 Foundation 0x1c468378 -[NSPlaceholderString initWithFormat:locale:arguments:] + 144 (NSString.m:2061)
15 Foundation 0x1c468274 +[NSString stringWithFormat:] + 60 (NSString.m:198)
16 xxxxxPH 0x013c77a0 +[FBSDKSwizzler object:ofClass:isCallingSelector:] + 96
17 xxxxxPH 0x013c8192 fb_findSwizzle + 94
18 xxxxxPH 0x013c7b92 fb_swizzledMethod_2 + 24
19 xxxxxPH 0x02bdf2dc -[RCTTextView didMoveToWindow] + 42
20 UIKit 0x20e3eba0 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 1424 (UIView.m:12537)
21 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
22 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
23 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
24 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
25 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
26 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
27 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
28 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
29 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
30 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
31 UIKit 0x20e61346 -[UIScrollView _didMoveFromWindow:toWindow:] + 68 (UIScrollView.m:1731)
32 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
33 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
34 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
35 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
36 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
37 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
38 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
39 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
40 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
41 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
42 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
43 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
44 UIKit 0x20e3e8a8 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664 (UIView.m:12481)
45 UIKit 0x20e3dee4 __45-[UIView(Hierarchy) _postMovedFromSuperview:]_block_invoke + 124 (UIView.m:9478)
46 Foundation 0x1c4ae982 -[NSISEngine withBehaviors:performModifications:] + 262 (NSISEngine.m:1973)
47 UIKit 0x20e3dd8c -[UIView(Hierarchy) _postMovedFromSuperview:] + 742 (UIView.m:358)
48 UIKit 0x20e4927e -[UIView(Internal) _addSubview:positioned:relativeTo:] + 1640 (UIView.m:13256)
49 UIKit 0x20e48c02 -[UIView(Hierarchy) addSubview:] + 730 (UIView.m:9004)
50 UIKit 0x210a73c8 __53-[_UINavigationParallaxTransition animateTransition:]_block_invoke_2 + 1674 (_UINavigationParallaxTransition.m:249)
51 UIKit 0x20e4f5c2 +[UIView(Animation) performWithoutAnimation:] + 84 (UIView.m:11409)
52 UIKit 0x21019848 __53-[_UINavigationParallaxTransition animateTransition:]_block_invoke + 188 (_UINavigationParallaxTransition.m:176)
53 UIKit 0x211281da +[UIView(Internal) _performBlockDelayingTriggeringResponderEvents:] + 200 (UIView.m:12805)
54 UIKit 0x210193fe -[_UINavigationParallaxTransition animateTransition:] + 990 (_UINavigationParallaxTransition.m:174)
55 UIKit 0x20fd742a -[UINavigationController _startCustomTransition:] + 3560 (UINavigationController.m:1900)
56 UIKit 0x20ef48f4 -[UINavigationController _startDeferredTransitionIfNeeded:] + 652 (UINavigationController.m:4977)
57 UIKit 0x20ef458c -[UINavigationController __viewWillLayoutSubviews] + 50 (UINavigationController.m:5224)
58 UIKit 0x20ef450c -[UILayoutContainerView layoutSubviews] + 196 (UILayoutContainerView.m:86)
59 UIKit 0x20e3f482 -[UIView(CALayerDelegate) layoutSublayersOfLayer:] + 1224 (UIView.m:14232)
60 QuartzCore 0x1ea97cb6 -[CALayer layoutSublayers] + 126 (CALayer.mm:8937)
61 QuartzCore 0x1ea8bd76 CA::Layer::layout_if_needed(CA::Transaction*) + 354 (CALayer.mm:8817)
62 QuartzCore 0x1ea8bc04 CA::Layer::layout_and_display_if_needed(CA::Transaction*) + 16 (CALayer.mm:2345)
63 QuartzCore 0x1ea1a838 CA::Context::commit_transaction(CA::Transaction*) + 320 (CAContextInternal.mm:1689)
64 QuartzCore 0x1ea38fda CA::Transaction::commit() + 578 (CATransactionInternal.mm:420)
65 xxxxxPH 0x02d08d6a 0x78000 + 46730602
66 xxxxxPH 0x02d078a6 0x78000 + 46725286
67 xxxxxPH 0x02d076e0 0x78000 + 46724832
68 xxxxxPH 0x02d06442 0x78000 + 46720066
69 xxxxxPH 0x02d07c86 0x78000 + 46726278
70 xxxxxPH 0x02d07ace 0x78000 + 46725838
71 xxxxxPH 0x003a043e -[GANavigator push:bundleName:moduleName:type:props:] + 1268
72 CoreFoundation 0x1bc14354 __invoking___ + 68
73 CoreFoundation 0x1bb382b8 -[NSInvocation invoke] + 300 (NSForwarding.m:2954)
74 CoreFoundation 0x1bb3be86 -[NSInvocation invokeWithTarget:] + 48 (NSForwarding.m:3025)
75 xxxxxPH 0x02bac058 -[RCTModuleMethod invokeWithBridge:module:arguments:] + 488
76 xxxxxPH 0x02bb1c8c facebook::react::invokeInner(RCTBridge*, RCTModuleData*, unsigned int, folly::dynamic const&) + 324
77 xxxxxPH 0x02bb18f2 invocation function for block in facebook::react::RCTNativeModule::invoke(unsigned int, folly::dynamic&&, int) + 138
78 libdispatch.dylib 0x1b2dd796 _dispatch_call_block_and_release + 10 (init.c:963)
79 libdispatch.dylib 0x1b2dd782 _dispatch_client_callout + 22 (init.c:1023)
80 libdispatch.dylib 0x1b2e1d04 _dispatch_main_queue_callback_4CF + 902 (inline_internal.h:2431)
81 CoreFoundation 0x1bbcbd68 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 8 (CFRunLoop.c:1793)
82 CoreFoundation 0x1bbc9e18 __CFRunLoopRun + 848 (CFRunLoop.c:3004)
83 CoreFoundation 0x1bb1d1ae CFRunLoopRunSpecific + 470 (CFRunLoop.c:3113)
84 CoreFoundation 0x1bb1cfd0 CFRunLoopRunInMode + 104 (CFRunLoop.c:3143)
85 GraphicsServices 0x1d2c7b40 GSEventRunModal + 80 (GSEvent.c:2245)
86 UIKit 0x20ea5a52 UIApplicationMain + 150 (UIApplication.m:4089)
87 xxxxxPH 0x00c088d2 0x78000 + 12126418
88 libdyld.dylib 0x1b30a4ea start + 2
Thread 0 crashed with ARM Thread State (32-bit):
r0: 0x00000000 r1: 0x00000048 r2: 0x00000000 r3: 0x00000000
r4: 0x00000008 r5: 0x00000048 r6: 0x00000001 r7: 0x06ebad7c
r8: 0x00000004 r9: 0x00000000 r10: 0x16b2c8a0 r11: 0xffed0e12
ip: 0xfffffff4 sp: 0x06ebad70 lr: 0x1b4176d9 pc: 0x1ae9521e
cpsr: 0x00000030
It looks like this Crash happens when it trying to construct a NSString using +[NSString stringWithFormat:]. The 2nd parameter Class object no longer exists in the memory, and triggering SIGSEGV error.KERN_INVALID_ADDRESS at 0x00000040 the address is a rotated value, in r8 register, the original value is r8: 0x00000004 . Look the assembly code in r8, looks like it stores
argument #2 for method sub_146b2d8, objc_cls_ref_NSString
In [FBSDKSwizzler object:ofClass:addSelector:]
Crashed: com.apple.main-thread
0 libobjc.A.dylib 0x1a9cd21e allocateBuckets(unsigned short) + 23
1 libsystem_malloc.dylib 0x1af4f6d9 calloc + 30
2 libobjc.A.dylib 0x1a9cd3c7 cache_t::reallocate(unsigned short, unsigned short) + 30
3 libobjc.A.dylib 0x1a9cd83f cache_fill + 290
4 libobjc.A.dylib 0x1a9d6cf7 lookUpImpOrForward + 398
5 libobjc.A.dylib 0x1a9d6b65 _class_lookupMethodAndLoadCache3 + 26
6 libobjc.A.dylib 0x1a9dd1af _objc_msgSend_uncached + 14
7 CoreFoundation 0x1b747f2d objectIsKindOfNSException + 34
8 CoreFoundation 0x1b747acb __exceptionPreprocess + 14
9 libobjc.A.dylib 0x1a9cf067 objc_exception_throw + 38
10 Foundation 0x1c072039 <redacted> + 60
11 CoreFoundation 0x1b71a5cd __CFStringChangeSizeMultiple + 1364
12 CoreFoundation 0x1b7184d1 __CFStringAppendBytes + 400
13 CoreFoundation 0x1b714509 __CFStringAppendFormatCore + 10888
14 CoreFoundation 0x1b711a67 _CFStringCreateWithFormatAndArgumentsAux2 + 188
15 Foundation 0x1bfa0379 <redacted> + 144
16 Foundation 0x1bfa0275 <redacted> + 60
17 xxxxxx 0x1369ddd +[FBSDKSwizzler object:ofClass:addSelector:] + 336 (FBSDKSwizzler.m:336)
18 xxxxxx 0x136ab1b fb_findSwizzle + 98 (FBSDKSwizzler.m:98)
In +[FBSDKSwizzler object:ofClass:removeSelector:]
Crashed: com.apple.main-thread
0 libobjc.A.dylib 0x1c02521e allocateBuckets(unsigned short) + 23
1 libsystem_malloc.dylib 0x1c5a76d9 calloc + 30
2 libobjc.A.dylib 0x1c0253c7 cache_t::reallocate(unsigned short, unsigned short) + 30
3 libobjc.A.dylib 0x1c02583f cache_fill + 290
4 libobjc.A.dylib 0x1c02ecf7 lookUpImpOrForward + 398
5 libobjc.A.dylib 0x1c02eb65 _class_lookupMethodAndLoadCache3 + 26
6 libobjc.A.dylib 0x1c0351af _objc_msgSend_uncached + 14
7 CoreFoundation 0x1cd9ff2d objectIsKindOfNSException + 34
8 CoreFoundation 0x1cd9facb __exceptionPreprocess + 14
9 libobjc.A.dylib 0x1c027067 objc_exception_throw + 38
10 Foundation 0x1d6ca039
11 CoreFoundation 0x1cd725cd __CFStringChangeSizeMultiple + 1364
12 CoreFoundation 0x1cd704d1 __CFStringAppendBytes + 400
13 CoreFoundation 0x1cd6c509 __CFStringAppendFormatCore + 10888
14 CoreFoundation 0x1cd69a67 _CFStringCreateWithFormatAndArgumentsAux2 + 188
15 Foundation 0x1d5f8379
16 Foundation 0x1d5f8275
17 xxxxxx 0x1421661 +[FBSDKSwizzler object:ofClass:removeSelector:] + 344 (FBSDKSwizzler.m:344)
18 xxxxxx 0x1421c95 fb_swizzledMethod_2 + 115 (FBSDKSwizzler.m:115)
19 UIKit 0x21fceba1 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 1424
20 UIKit 0x21fce8a9 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664
21 UIKit 0x21fce8a9 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664
22 UIKit 0x21fce8a9 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 664
Steps to Reproduce
What are the steps necessary to reproduce this issue?
Can't reproduce it by myself. Looks like it is a memory mismanagement issue.
- All devices report this issue in Firebase are 32-bit device, iPhone5, iPhone5c, iPad4
- 100% iOS 10 system
sueLan
All 9 comments
jesus
deontaem
on 8 Sep 2020
is
deontaem
on 8 Sep 2020
alive
deontaem
on 8 Sep 2020
and
deontaem
on 8 Sep 2020
he
deontaem
on 8 Sep 2020
lives
deontaem
on 8 Sep 2020
in
deontaem
on 8 Sep 2020
me
deontaem
on 8 Sep 2020
This appears to be an issue with react-native. Please open an issue at https://github.com/facebook/react-native
Thanks!
joesus
on 9 Sep 2020
Related issues
liamnichols
路
6Comments
Meilu
路
7Comments
fromkk
路
8Comments
chuganzy
路
3Comments
luciano88
路
5Comments