0

I have a legacy app which utilizes Apple's example SimplePing. There is a source file SimplePing.m which contains the next method:

- (void)sendPingWithData:(NSData *)data {
    id<SimplePingDelegate>  strongDelegate;

    ...

    strongDelegate = self.delegate;
    if (...) {
        [strongDelegate simplePing:self didSendPacket:...];
    }

    self.nextSequenceNumber += 1; // CRASH
    if (self.nextSequenceNumber == 0) {
        self.nextSequenceNumberHasWrapped = YES;
    }
}

Crashlytics reports dozens of crashes with stack trace:

Crashed: com.apple.main-thread
EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x00000009de3bbeb8

libobjc.A.dylib objc_msgSend + 16
MyApp  SimplePing.m line 313 -[SimplePing sendPingWithData:]
Foundation __NSFireTimer + 88
CoreFoundation  __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 28
CoreFoundation  __CFRunLoopDoTimer + 856
CoreFoundation  __CFRunLoopDoTimers + 244
CoreFoundation  __CFRunLoopRun + 1484
CoreFoundation  CFRunLoopRunSpecific + 424
GraphicsServices GSEventRunModal + 100
UIKit UIApplicationMain + 208
MyApp main.swift line 10
libdyld.dylib start + 4

I have not managed to reprodice it yet, and I know a little about this app so far. But I have to begin researching it somehow. I looked through realization of delegates (btw, they are in Swift - if it's relevant), bit did not find anything criminal so far.

As I know, EXC_BAD_ACCESS normally fires when one tries to access deallocated memory. In this concrete case it could mean that [strongDelegate simplePing:self didSendPacket:...] has somehow deallocated self. But as self is a strong reference, it just could not happen at all - am I right?

May you guys drop me some probable scenarios on how could it crash with EXC_BAD_ACCESS on that line? The only my idea is that some memory overwrite have happened.

UPDATE I was completely wrong with my assumption "But as self is a strong reference ...". self in nether strong, nor weak. It is just unsafe_unretained, as a smart guy explained: https://stackoverflow.com/a/18011581/674548.

Nick
  • 2,905
  • 8
  • 55
  • 100
  • What is the type of `strongDelegate`? – Ryan Oct 30 '17 at 21:46
  • `self` probably got deallocated. Does the delegate nil out a reference to it in `simplePing:didSendPacket:`? – Kevin Oct 30 '17 at 21:48
  • Please share the crash report – kvr Oct 30 '17 at 21:50
  • @Kevin Yes, implementation of delegate holds a strong reference to SimplePing, and it may (inside `simplePing:self didSendPacket...`) make it nil. But it does not immediately destroy SimplePing. – Nick Oct 30 '17 at 22:22
  • 2
    The evidence here suggests it *does* deallocate immediately. Add a `dealloc` implementation and set a breakpoint there. – Kevin Oct 30 '17 at 22:23
  • Keep in mind that ICMP is blocked on most networks. I'm not sure if that could be having an effect on this, but i felt it worth mentioning. – Nathan F. Oct 30 '17 at 23:11

0 Answers0