+[NSObject(Property) mj_enumerateProperties:] 崩溃 #842
Description
为了排除你自己的问题, 请写一个 Demo
线上日志收集到的崩溃，不是必现
描述bug
json转model崩溃，最近收集到不少类似的崩溃，堆栈的末尾基本上都是这种：
0 libobjc.A.dylib 0x00007fff6a2a76e5 objc_retain + 21
1 MJExtension 0x000000010b001e10 +[NSObject(Property) mj_enumerateProperties:] + 237
2 MJExtension 0x000000010affe954 -[NSObject(MJKeyValue) mj_setKeyValues:context:] + 514
3 MJExtension 0x000000010afffb1e +[NSObject(MJKeyValue) mj_objectWithKeyValues:context:] + 448
4 MJExtension 0x000000010b000004 +[NSObject(MJKeyValue) mj_objectArrayWithKeyValuesArray:context:] + 659
5 MJExtension 0x000000010afff14b __48-[NSObject(MJKeyValue) mj_setKeyValues:context:]_block_invoke + 1804
6 MJExtension 0x000000010b001e10 +[NSObject(Property) mj_enumerateProperties:] + 237
7 MJExtension 0x000000010affe954 -[NSObject(MJKeyValue) mj_setKeyValues:context:] + 514
8 MJExtension 0x000000010afffb1e +[NSObject(MJKeyValue) mj_objectWithKeyValues:context:] + 448
都是不同的类调用 mj_objectWithKeyValues 后崩溃，不是某个单独的类。
运行环境
- macOS
- 涉及到从 10.15 ～ 12.3多个系统版本。
- Xcode 11
下面是一个崩溃的例子。
Incident Identifier: 17A7EEF9-0D28-4CB2-BCA5-A8A919307A51
CrashReporter Key: 4266f94e49333dbf4d60b8498a0f26d7f6a551b6
Hardware Model: MacBookAir7,2
Process: Tiger Trade [446]
Path: /Applications/Tiger Trade.app/Tiger Trade
Identifier: com.itiger.TigerTrade-Mac
Version: 401F0F (7.13.0)
Code Type: X86
Parent Process: ? [1]
Date/Time: 2022-06-15 22:05:39.166 +0800
OS Version: macOS 10.15.5 (19F101)
Report Version: 104
Exception Type: EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_NAME_EXISTS at 0x000000010ca03046
Crashed Thread: 0
Thread 0 Crashed:
0 libobjc.A.dylib 0x00007fff6a2a76e5 objc_retain + 21
1 MJExtension 0x000000010b001e10 +[NSObject(Property) mj_enumerateProperties:] + 237
2 MJExtension 0x000000010affe954 -[NSObject(MJKeyValue) mj_setKeyValues:context:] + 514
3 MJExtension 0x000000010afffb1e +[NSObject(MJKeyValue) mj_objectWithKeyValues:context:] + 448
4 MJExtension 0x000000010b000004 +[NSObject(MJKeyValue) mj_objectArrayWithKeyValuesArray:context:] + 659
5 MJExtension 0x000000010afff14b __48-[NSObject(MJKeyValue) mj_setKeyValues:context:]_block_invoke + 1804
6 MJExtension 0x000000010b001e10 +[NSObject(Property) mj_enumerateProperties:] + 237
7 MJExtension 0x000000010affe954 -[NSObject(MJKeyValue) mj_setKeyValues:context:] + 514
8 MJExtension 0x000000010afffb1e +[NSObject(MJKeyValue) mj_objectWithKeyValues:context:] + 448
9 Tiger Trade 0x0000000109b8bbf3 0x1098d4000 + 2849779 +[TBStockDayTrendModel trendModelWithKeyValues:security:] (in Tiger Trade) (TBStockTrendModel.m:316)
10 Tiger Trade 0x0000000109b8b698 0x1098d4000 + 2848408 +[TBStockTrendModel trendModelWithKeyValues:security:] (in Tiger Trade) (TBStockTrendModel.m:0)
11 Tiger Trade 0x000000010992616a 0x1098d4000 + 336234 __61-[TBTrendChartWork doRequestFullTrendDataWithRequest:isLoop:]_block_invoke (in Tiger Trade) (TBTrendChartWork.m:788)
12 libdispatch.dylib 0x00007fff6b4016c4 _dispatch_call_block_and_release + 12
13 libdispatch.dylib 0x00007fff6b402658 _dispatch_client_callout + 8
14 libdispatch.dylib 0x00007fff6b40dcab _dispatch_main_queue_callback_4CF + 936
15 CoreFoundation 0x00007fff320a4f11 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 9
16 CoreFoundation 0x00007fff32064d17 __CFRunLoopRun + 2028
17 CoreFoundation 0x00007fff32063ece CFRunLoopRunSpecific + 462
18 HIToolbox 0x00007fff30ce4abd RunCurrentEventLoopInMode + 292
19 HIToolbox 0x00007fff30ce47d5 ReceiveNextEventCommon + 584
20 HIToolbox 0x00007fff30ce4579 _BlockUntilNextEventMatchingListInModeWithFilter + 64
21 AppKit 0x00007fff2f32c829 _DPSNextEvent + 883
22 AppKit 0x00007fff2f32b070 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1352
23 AppKit 0x00007fff2f31cd7e -[NSApplication run] + 658
24 AppKit 0x00007fff2f2eeb86 NSApplicationMain + 777
25 libdyld.dylib 0x00007fff6b45bcc9 start + 1
Thread 1:
0 libsystem_kernel.dylib 0x00007fff6b59f756 __semwait_signal + 10
1 libsystem_c.dylib 0x00007fff6b522d52 sleep + 41
2 KSCrash 0x000000010aef8440 monitorCachedData + 753
3 libsystem_pthread.dylib 0x00007fff6b660109 _pthread_start + 148
4 libsystem_pthread.dylib 0x00007fff6b65bb8b thread_start + 15
Thread 2 name: KSCrash Exception Handler (Secondary)
Thread 2:
0 libsystem_kernel.dylib 0x00007fff6b59cdfa mach_msg_trap + 10
1 KSCrash 0x000000010aeff895 handleExceptions + 179
2 libsystem_pthread.dylib 0x00007fff6b660109 _pthread_start + 148
3 libsystem_pthread.dylib 0x00007fff6b65bb8b thread_start + 15
Thread 3 name: KSCrash Exception Handler (Primary)
Thread 3:
0 (null) 0x0000000000000000 0x0 + 0
Thread 4 name: com.apple.NSEventThread
Thread 4:
0 libsystem_kernel.dylib 0x00007fff6b59cdfa mach_msg_trap + 10
1 CoreFoundation 0x00007fff32065f85 __CFRunLoopServiceMachPort + 247
2 CoreFoundation 0x00007fff32064a52 __CFRunLoopRun + 1319
3 CoreFoundation 0x00007fff32063ece CFRunLoopRunSpecific + 462
4 AppKit 0x00007fff2f4ce144 _NSEventThread + 132
5 libsystem_pthread.dylib 0x00007fff6b660109 _pthread_start + 148
6 libsystem_pthread.dylib 0x00007fff6b65bb8b thread_start + 15
Thread 5 name: com.apple.NSURLConnectionLoader
Thread 5:
0 libsystem_kernel.dylib 0x00007fff6b59cdfa mach_msg_trap + 10
1 CoreFoundation 0x00007fff32065f85 __CFRunLoopServiceMachPort + 247
2 CoreFoundation 0x00007fff32064a52 __CFRunLoopRun + 1319
3 CoreFoundation 0x00007fff32063ece CFRunLoopRunSpecific + 462
4 CFNetwork 0x00007fff308f002a CFHTTPMessageGetTypeID + 82234
5 Foundation 0x00007fff346f47a2 __NSThread__start__ + 1064
6 libsystem_pthread.dylib 0x00007fff6b660109 _pthread_start + 148
7 libsystem_pthread.dylib 0x00007fff6b65bb8b thread_start + 15
Thread 6 name: com.apple.CFStream.LegacyThread
Thread 6:
0 libsystem_malloc.dylib 0x00007fff6b613fdd default_zone_calloc + 49
1 libsystem_malloc.dylib 0x00007fff6b613f59 malloc_zone_calloc + 99
2 libsystem_malloc.dylib 0x00007fff6b613ed9 calloc + 24
3 libdispatch.dylib 0x00007fff6b42c60d _dispatch_continuation_alloc_from_heap + 72
4 libdispatch.dylib 0x00007fff6b40594a dispatch_channel_async + 231
5 CoreFoundation 0x00007fff320e2468 _cfstream_shared_signalEventSync + 357
6 CoreFoundation 0x00007fff32065de2 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
7 CoreFoundation 0x00007fff32065d81 __CFRunLoopDoSource0 + 103
8 CoreFoundation 0x00007fff32065b9b __CFRunLoopDoSources0 + 209
9 CoreFoundation 0x00007fff320648ca __CFRunLoopRun + 927
10 CoreFoundation 0x00007fff32063ece CFRunLoopRunSpecific + 462
11 CoreFoundation 0x00007fff320e1fd0 _legacyStreamRunLoop_workThread + 251
12 libsystem_pthread.dylib 0x00007fff6b660109 _pthread_start + 148
13 libsystem_pthread.dylib 0x00007fff6b65bb8b thread_start + 15
Thread 7 name: com.apple.CFSocket.private
Thread 7:
0 libsystem_kernel.dylib 0x00007fff6b5a50fe select$DARWIN_EXTSN + 10
1 libsystem_pthread.dylib 0x00007fff6b660109 _pthread_start + 148
2 libsystem_pthread.dylib 0x00007fff6b65bb8b thread_start + 15
Thread 8 name: JavaScriptCore bmalloc scavenger
Thread 8:
0 libsystem_kernel.dylib 0x00007fff6b59f882 __psynch_cvwait + 10
1 libc++.1.dylib 0x00007fff6872f623 std::__1::condition_variable::__do_timed_wait(std::__1::unique_lock<std::__1::mutex>&, std::__1::chrono::time_point<std::__1::chrono::system_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 93
2 JavaScriptCore 0x00007fff36864be5 bmalloc::Scavenger::threadRunLoop() + 741
3 JavaScriptCore 0x00007fff368645f9 bmalloc::Scavenger::threadEntryPoint(bmalloc::Scavenger*) + 9
4 JavaScriptCore 0x00007fff36866cd7 void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void (*)(bmalloc::Scavenger*), bmalloc::Scavenger*> >(void*) + 39
5 libsystem_pthread.dylib 0x00007fff6b660109 _pthread_start + 148
6 libsystem_pthread.dylib 0x00007fff6b65bb8b thread_start + 15
Thread 9 name: com.apple.coreanimation.render-server
Thread 9:
0 libsystem_kernel.dylib 0x00007fff6b59cdfa mach_msg_trap + 10
1 QuartzCore 0x00007fff3db71f7e CA::Render::Server::server_thread(void*) + 496
2 QuartzCore 0x00007fff3db71d87 thread_fun(void*) + 25
3 libsystem_pthread.dylib 0x00007fff6b660109 _pthread_start + 148
4 libsystem_pthread.dylib 0x00007fff6b65bb8b thread_start + 15
Thread 10 name: CVDisplayLink
Thread 10:
0 libsystem_kernel.dylib 0x00007fff6b59f882 __psynch_cvwait + 10
1 CoreVideo 0x00007fff33ff6d2b CVDisplayLink::waitUntil(unsigned long long) + 229
2 CoreVideo 0x00007fff33ff6238 CVDisplayLink::runIOThread() + 482
3 libsystem_pthread.dylib 0x00007fff6b660109 _pthread_start + 148
4 libsystem_pthread.dylib 0x00007fff6b65bb8b thread_start + 15
Thread 11:
0 libsystem_kernel.dylib 0x00007fff6b59e4ce __workq_kernreturn + 10
1 libsystem_pthread.dylib 0x00007fff6b65bb77 start_wqthread + 15
Thread 12:
0 libsystem_kernel.dylib 0x00007fff6b59e4ce __workq_kernreturn + 10
1 libsystem_pthread.dylib 0x00007fff6b65bb77 start_wqthread + 15
Thread 13:
0 libsystem_kernel.dylib 0x00007fff6b59e4ce __workq_kernreturn + 10
1 libsystem_pthread.dylib 0x00007fff6b65bb77 start_wqthread + 15
Thread 14:
0 libsystem_kernel.dylib 0x00007fff6b59e4ce __workq_kernreturn + 10
1 libsystem_pthread.dylib 0x00007fff6b65bb77 start_wqthread + 15
Thread 15:
0 libsystem_kernel.dylib 0x00007fff6b59e4ce __workq_kernreturn + 10
1 libsystem_pthread.dylib 0x00007fff6b65bb77 start_wqthread + 15
Thread 16:
0 libsystem_kernel.dylib 0x00007fff6b59e4ce __workq_kernreturn + 10
1 libsystem_pthread.dylib 0x00007fff6b65bb77 start_wqthread + 15
Thread 17:
0 libsystem_kernel.dylib 0x00007fff6b59e4ce __workq_kernreturn + 10
1 libsystem_pthread.dylib 0x00007fff6b65bb77 start_wqthread + 15
Thread 18:
0 libsystem_kernel.dylib 0x00007fff6b59e4ce __workq_kernreturn + 10
1 libsystem_pthread.dylib 0x00007fff6b65bb77 start_wqthread + 15
Thread 0 crashed with X86_64 Thread State:
rax: 0x00007ffffffffff8 rbx: 0x0000600003f31200 rcx: 0x0100000000000000 rdx: 0x041dffff89a1ba29
rdi: 0x8000600001f9e790 rsi: 0x00007fff756f6add rbp: 0x00007ffee6329af0 rsp: 0x00007ffee63297e8
r8: 0x0000000000000010 r9: 0x00000000000007fb r10: 0x00007fff89a1d328 r11: 0x00007fff3202ba74
r12: 0x0000000000000001 r13: 0x00007fff6a2a76d0 r14: 0x8000600001f9e790 r15: 0x0000000000000001
rip: 0x00007fff6a2a76e5 rflags: 0x0000000000010246 cs: 0x000000000000002b fs: 0x0000000000000000
gs: 0x0000000000000000
Binary Images: *
Extra Information:
Stack Dump (0x00007ffee6329798-0x00007ffee6329888):
00782A6AFF7F0000E09732E6FE7F000085CCFF0A01000000189C32E6FE7F000060DA1D01006000000100000000000000189C32E6FE7F00000000000000000000E1546F75FF7F0000F09A32E6FE7F000051ECFF0A0100000001000000000000000040EE0A010000000042EE0A010000000000000000000000FFFFFFFFFFFFFFFF58BD2C010060000090F43232FF7F00000000000000000000000000000000000000000000000000000000000000000000000000000000000000205F92FF7F000020000000000000000040EE0A010000000100000000000000909832E6FE7F00005740616BFF7F000020548E89FF7F0000
Notable Addresses:
{
"r10": {
"address": 140735502471976,
"class": "__NSSingleObjectArrayI",
"type": "objc_class"
},
"rip": {
"address": 140734974555877,
"class": "NSString",
"type": "objc_object",
"value": ""
},
"rsi": {
"address": 140735163624157,
"class": "NSDate",
"type": "objc_object",
"value": 6.95324e-310
},
"stack@0x7ffee63297a8": {
"address": 4479503493,
"class": "NSString",
"type": "objc_object",
"value": "eeeilBXs"
},
"stack@0x7ffee6329878": {
"address": 140734994923607,
"class": "NSNumber",
"type": "objc_object",
"value": 5.49746e+11
}
}
Application Stats:
{
"active_time_since_last_crash": 37246.2,
"active_time_since_launch": 37246.2,
"application_active": true,
"application_in_foreground": true,
"background_time_since_last_crash": 0,
"background_time_since_launch": 0,
"launches_since_last_crash": 2,
"sessions_since_last_crash": 2,
"sessions_since_launch": 1
}
CrashDoctor Diagnosis: Attempted to dereference garbage pointer 0x10ca03046.