iOS崩溃日志-没有应用程序代码

Question

We are getting a crash on a device, with a weird crash log that does not contain any of our application's code in it. Any idea what could be causing this?

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x00000000e0000010
Triggered by Thread:  5

Thread 0:
0   libsystem_kernel.dylib          0x3a773a50 mach_msg_trap + 20
1   libsystem_kernel.dylib          0x3a773849 mach_msg + 37
2   CoreFoundation                  0x2f5c6625 __CFRunLoopServiceMachPort + 153
3   CoreFoundation                  0x2f5c4d8b __CFRunLoopRun + 859
4   CoreFoundation                  0x2f52f765 CFRunLoopRunSpecific + 521
5   CoreFoundation                  0x2f52f547 CFRunLoopRunInMode + 103
6   GraphicsServices                0x344666cf GSEventRunModal + 135
7   UIKit                           0x31e8e88d UIApplicationMain + 1133
8   MyApp                   0x0002ae4b main (main.m:15)
9   MyApp                   0x0001ff44 start + 36

Thread 1:
0   libsystem_kernel.dylib          0x3a773804 kevent64 + 24
1   libdispatch.dylib               0x3a6c2051 _dispatch_mgr_invoke + 229
2   libdispatch.dylib               0x3a6bc2df _dispatch_mgr_thread + 35

Thread 2 name:  com.apple.NSURLConnectionLoader
Thread 2:
0   libsystem_kernel.dylib          0x3a773a50 mach_msg_trap + 20
1   libsystem_kernel.dylib          0x3a773849 mach_msg + 37
2   CoreFoundation                  0x2f5c6625 __CFRunLoopServiceMachPort + 153
3   CoreFoundation                  0x2f5c4d45 __CFRunLoopRun + 789
4   CoreFoundation                  0x2f52f765 CFRunLoopRunSpecific + 521
5   CoreFoundation                  0x2f52f547 CFRunLoopRunInMode + 103
6   Foundation                      0x2ff6f23d +[NSURLConnection(Loader) _resourceLoadLoop:] + 317
7   Foundation                      0x2ffe4a0b __NSThread__main__ + 1059
8   libsystem_pthread.dylib         0x3a7ed957 _pthread_body + 139
9   libsystem_pthread.dylib         0x3a7ed8c7 _pthread_start + 99
10  libsystem_pthread.dylib         0x3a7ebae4 thread_start + 4

Thread 3:
0   libsystem_kernel.dylib          0x3a786c70 __workq_kernreturn + 8
1   libsystem_pthread.dylib         0x3a7ebc1f _pthread_wqthread + 307
2   libsystem_pthread.dylib         0x3a7ebad8 start_wqthread + 4

Thread 4 name:  com.apple.CFSocket.private
Thread 4:
0   libsystem_kernel.dylib          0x3a786434 __select + 20
1   CoreFoundation                  0x2f5ca51f __CFSocketManager + 483
2   libsystem_pthread.dylib         0x3a7ed957 _pthread_body + 139
3   libsystem_pthread.dylib         0x3a7ed8c7 _pthread_start + 99
4   libsystem_pthread.dylib         0x3a7ebae4 thread_start + 4

Thread 5 Crashed:
0   libobjc.A.dylib                 0x3a1e066b objc_release + 11
1   libobjc.A.dylib                 0x3a1e10cf (anonymous namespace)::AutoreleasePoolPage::pop(void*) + 355
2   libobjc.A.dylib                 0x3a1e1b49 (anonymous namespace)::AutoreleasePoolPage::tls_dealloc(void*) + 37
3   libsystem_pthread.dylib         0x3a7ec6cf _pthread_tsd_cleanup + 163
4   libsystem_pthread.dylib         0x3a7ec44f _pthread_exit + 83
5   libsystem_pthread.dylib         0x3a7ed1b5 pthread_exit + 25
6   Foundation                      0x2ff386ff +[NSThread exit] + 7
7   Foundation                      0x2ffe4a29 __NSThread__main__ + 1089
8   libsystem_pthread.dylib         0x3a7ed957 _pthread_body + 139
9   libsystem_pthread.dylib         0x3a7ed8c7 _pthread_start + 99
10  libsystem_pthread.dylib         0x3a7ebae4 thread_start + 4

Thread 6:
0   libsystem_kernel.dylib          0x3a786c70 __workq_kernreturn + 8
1   libsystem_pthread.dylib         0x3a7ebc1f _pthread_wqthread + 307
2   libsystem_pthread.dylib         0x3a7ebad8 start_wqthread + 4

Thread 7:
0   libsystem_kernel.dylib          0x3a786c70 __workq_kernreturn + 8
1   libsystem_pthread.dylib         0x3a7ebc1f _pthread_wqthread + 307
2   libsystem_pthread.dylib         0x3a7ebad8 start_wqthread + 4

Thread 5 crashed with ARM Thread State (32-bit):
    r0: 0x156ba550    r1: 0xe0000000      r2: 0x00000001      r3: 0x15b9d028
    r4: 0x15b9d000    r5: 0x0679d0a4      r6: 0xa3a3a3a3      r7: 0x0679cd5c
    r8: 0x15b9d028    r9: 0x9a001683     r10: 0x00000000     r11: 0x3c473a30
    ip: 0x3a96f7b0    sp: 0x0679cb2c      lr: 0x3a1e10d3      pc: 0x3a1e066a
  cpsr: 0x20000030

We ran a check for Zombie objects but could not find any. Help much appreciated.

Answer 1

We were able to reproduce the issue and discovered that this is a memory issue on iPad Airs. We found that, for some reason, iOS on these iPad Air is trying to free up invalid memory addresses, or addresses that were previously freed up. We are now able to replicate on demand on iPad Airs, but do not see the same issue on other iPads.