ios開發(fā) try-catch引起的野指針問題排查

更新時間：2022年09月13日 14:37:05 作者：時光易逝

這篇文章主要為大家介紹了ios開發(fā) try-catch引起的野指針問題排查，有需要的朋友可以借鑒參考下，希望能夠有所幫助，祝大家多多進步，早日升職加薪

1、野指針問題

【EXC_BAD_ACCESS (SIGSEGV) / KERN_INVALID_ADDRESS]

Possible zombie in call: Function: objc_releaseParam 1: 0x157f2a740 Originated at or in a subcall of unknown, cannot find symb

如有以下崩潰棧可以懷疑是在dealloc中直接或間接使用了@try{} @catch{}

2、崩潰棧

  libobjc.A.dylib    _objc_release()         
  CoreFoundation     -[__NSDictionaryI dealloc]()         
  CoreFoundation     -[NSException dealloc]()         
  libobjc.A.dylib    AutoreleasePoolPage::releaseUntil(objc_object**)()         
  libobjc.A.dylib    _objc_autoreleasePoolPop()        
   ......
   ......

3、場景復(fù)現(xiàn)代碼

#import "ViewController.h"
@interface TestExpectionObj : NSObject
@end
@implementation TestExpectionObj
- (void)dealloc {
    @try {
        [self setValue:@"test" forKey:@"testKey"];
    } @catch (NSException *exception) {
        NSLog(@"%@", exception);
    }
}
@end
@implementation ViewController
- (void)viewDidLoad {
    [super viewDidLoad];
    // Do any additional setup after loading the view.
    [TestExpectionObj new];
}
@end

4、問題分析

在dealloc使用try-catch并觸發(fā)catch時，會生成NSException對象，exception結(jié)構(gòu)如下

exception : NSException {
	userInfo: NSDictionary {
		NSTargetObjectUserInfoKey = "<TestExpectionObj: 0x6000038ac3e0>";
	}
}

故exception會強引用TestExpectionObj對象，并且exception一般都是類方法生成會自動加入到AutoreleasePool，所以dealloc執(zhí)行完后TestExpectionObj對象已經(jīng)釋放（因為在dealloc方法中在強引用當(dāng)前對象沒法終止當(dāng)前對象的釋放，引用計數(shù)增加與否已無意義），所以exception.userInfo中的TestExpectionObj對變成野對象。

當(dāng)AutoreleasePool到達(dá)周期釋放時就對調(diào)用release exception & userInfo，字典userInfo釋放時會也會相應(yīng)的釋放key/value，故NSTargetObjectUserInfoKey = "<TestExpectionObj: 0x6000038ac3e0>"又調(diào)用一次release，因為之前已經(jīng)dealloc完畢，所以這次就會觸發(fā)重復(fù)釋放崩潰引起野指針問題，

但如果exception在TestExpectionObj對象的dealloc方法執(zhí)行完之前釋放就不會出現(xiàn)問題。

5、上報可能引起野指針崩潰棧

#import <JRSwizzle/JRSwizzle.h>
@implementation NSException (ExceptionTestSunztObj)
+ (void)load {
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        [self jr_swizzleMethod:NSSelectorFromString(@"dealloc")
                              withMethod:@selector(intercept_dealloc)
                                   error:nil];
    });
}
- (void)intercept_dealloc {
    BOOL isContainDealloc = NO;
    NSMutableString *symblos = [NSMutableString string];
    for (NSString *sym in self.callStackSymbols) {
        [symblos appendFormat:@"%@\n", sym];
        if ([sym containsString:@" dealloc]"]) {
            isContainDealloc = YES;
        }
    }
    // 把 symblos上報給自己的APM平臺
    [APM report:@"ttReportExceptionCallStackSymbols" withValue:symblos];
    [APM report:@"ttReportExceptionReason" withValue:self.reason?:@"NULL"];
    if (isContainDealloc) {
        // 本地log打印，需符號化
       TTLocalLog("NSException:throws:dealloc:ttReport", {
           @"name": self.name?:@"",
           @"reason": self.reason?:@"",
           @"callStackSymbols": symblos
       });
       // 延遲保證數(shù)據(jù)寫完在釋放
       __unsafe_unretained NSException *demoSelf = self;
       dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(1.0 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
           [demoSelf intercept_dealloc];
       });
       return;
    }
    [self intercept_dealloc];
}
@end

注：在dealloc中使用@try{} @catch{}可能會引起難以排查的野指針崩潰

使用@try-@catch后

[<TestExpectionObj 0x600000714220> setValue:forUndefinedKey:]: this class is not key value coding-compliant for the key testKey.
(
  0   CoreFoundation                      0x0000000102a93604 __exceptionPreprocess + 242
  1   libobjc.A.dylib                     0x0000000102943a45 objc_exception_throw + 48
  2   CoreFoundation                      0x0000000102a9329c -[NSException init] + 0
  3   Foundation                          0x00000001034f2354 -[NSObject(NSKeyValueCoding) setValue:forKey:] + 315
  4   ExpectionDemo                       0x00000001023cae52 -[TestExpectionObj dealloc] + 50
  5   libobjc.A.dylib                     0x00000001029417b7 _ZN11objc_object17sidetable_releaseEbb + 177
  6   ExpectionDemo                       0x00000001023caf58 -[ViewController viewDidLoad] + 72
  7   UIKitCore                           0x000000010f3ce3bc -[UIViewController _sendViewDidLoadWithAppearanceProxyObjectTaggingEnabled] + 88
  8   UIKitCore                           0x000000010f3d2dbf -[UIViewController loadViewIfRequired] + 1193
  9   UIKitCore                           0x000000010f3d319a -[UIViewController view] + 27
  10  UIKitCore                           0x000000010fbdb00a -[UIWindow addRootViewControllerViewIfPossible] + 305
  11  UIKitCore                           0x000000010fbda6fe -[UIWindow _updateLayerOrderingAndSetLayerHidden:actionBlock:] + 230
  12  UIKitCore                           0x000000010fbdb6d6 -[UIWindow _setHidden:forced:] + 409
  13  UIKitCore                           0x000000010fbee204 -[UIWindow _mainQueue_makeKeyAndVisible] + 47
  14  UIKitCore                           0x000000010fe605f6 -[UIWindowScene _makeKeyAndVisibleIfNeeded] + 202
  15  UIKitCore                           0x000000010ef0fb8f +[UIScene _sceneForFBSScene:create:withSession:connectionOptions:] + 1591
  16  UIKitCore                           0x000000010fb98fbd -[UIApplication _connectUISceneFromFBSScene:transitionContext:] + 1299
  17  UIKitCore                           0x000000010fb99471 -[UIApplication workspace:didCreateScene:withTransitionContext:completion:] + 301
  18  UIKitCore                           0x000000010f613afe -[UIApplicationSceneClientAgent scene:didInitializeWithEvent:completion:] + 355
  19  FrontBoardServices                  0x0000000107090cdd -[FBSScene _callOutQueue_agent_didCreateWithTransitionContext:completion:] + 415
  20  FrontBoardServices                  0x00000001070bd216 __94-[FBSWorkspaceScenesClient createWithSceneID:groupID:parameters:transitionContext:completion:]_block_invoke.180 + 102
  21  FrontBoardServices                  0x000000010709f0ef -[FBSWorkspace _calloutQueue_executeCalloutFromSource:withBlock:] + 209
  22  FrontBoardServices                  0x00000001070bcdf5 __94-[FBSWorkspaceScenesClient createWithSceneID:groupID:parameters:transitionContext:completion:]_block_invoke + 352
  23  libdispatch.dylib                   0x0000000103c0ba5b _dispatch_client_callout + 8
  24  libdispatch.dylib                   0x0000000103c0e93b _dispatch_block_invoke_direct + 295
  25  FrontBoardServices                  0x00000001070e3da3 __FBSSERIALQUEUE_IS_CALLING_OUT_TO_A_BLOCK__ + 30
  26  FrontBoardServices                  0x00000001070e3c99 -[FBSSerialQueue _targetQueue_performNextIfPossible] + 174
  27  FrontBoardServices                  0x00000001070e3dcb -[FBSSerialQueue _performNextFromRunLoopSource] + 19
  28  CoreFoundation                      0x0000000102a004a7 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
  29  CoreFoundation                      0x0000000102a0039f __CFRunLoopDoSource0 + 180
  30  CoreFoundation                      0x00000001029ff8ce __CFRunLoopDoSources0 + 340
  31  CoreFoundation                      0x00000001029f9f68 __CFRunLoopRun + 871
  32  CoreFoundation                      0x00000001029f9704 CFRunLoopRunSpecific + 562
  33  GraphicsServices                    0x00000001071e3c8e GSEventRunModal + 139
  34  UIKitCore                           0x000000010fb9765a -[UIApplication _run] + 928
  35  UIKitCore                           0x000000010fb9c2b5 UIApplicationMain + 101
  36  ExpectionDemo                       0x00000001023cb1be main + 110
  37  dyld                                0x00000001025e6f21 start_sim + 10
  38  ???                                 0x00000001091ce4fe 0x0 + 4447855870
)

這種崩潰信息使用NSSetUncaughtExceptionHandler()是抓不到的

以上就是ios開發(fā) try-catch引起的野指針問題排查的詳細(xì)內(nèi)容，更多關(guān)于ios開發(fā)try-catch野指針的資料請關(guān)注腳本之家其它相關(guān)文章！

您可能感興趣的文章: