iOS CloudDocsLibrary crash (probably KVO crash)

Question

Has anyone else experienced a crash (EXC_BAD_ACCESS) with the following stack trace:

0 Object_isClass
22 UIApplicationMain
23 main
24 start

If I click on UIApplicationMain in the stack trace then I get the following:

UIKitCore`UIApplicationMain:
0x21a6ef8a4 <+0>:   stp    x24, x23, [sp, #-0x40]!
0x21a6ef8a8 <+4>:   stp    x22, x21, [sp, #0x10]
0x21a6ef8ac <+8>:   stp    x20, x19, [sp, #0x20]
0x21a6ef8b0 <+12>:  stp    x29, x30, [sp, #0x30]
0x21a6ef8b4 <+16>:  add    x29, sp, #0x30            ; =0x30 
0x21a6ef8b8 <+20>:  mov    x20, x3
0x21a6ef8bc <+24>:  mov    x21, x1
0x21a6ef8c0 <+28>:  mov    x22, x0
0x21a6ef8c4 <+32>:  mov    x0, x2
0x21a6ef8c8 <+36>:  bl     0x21ac17b68               ; symbol stub for: -[_UICloudSharingActivity _activitySupportsPromiseURLs]
0x21a6ef8cc <+40>:  mov    x19, x0
0x21a6ef8d0 <+44>:  mov    x0, x20
0x21a6ef8d4 <+48>:  bl     0x21ac17b68               ; symbol stub for: -[_UICloudSharingActivity _activitySupportsPromiseURLs]
0x21a6ef8d8 <+52>:  mov    x20, x0
0x21a6ef8dc <+56>:  mov    w0, #0x168
0x21a6ef8e0 <+60>:  movk   w0, #0x2b87, lsl #16
0x21a6ef8e4 <+64>:  mov    w1, #0x32
0x21a6ef8e8 <+68>:  mov    x2, #0x0
0x21a6ef8ec <+72>:  mov    x3, #0x0
0x21a6ef8f0 <+76>:  mov    x4, #0x0
0x21a6ef8f4 <+80>:  bl     0x21ac1779c               ; symbol stub for: __66-[UICloudSharingController _deleteShareAfterDismissalWithoutSave:]_block_invoke_2
0x21a6ef8f8 <+84>:  orr    w0, wzr, #0x3
0x21a6ef8fc <+88>:  orr    w1, wzr, #0x3
0x21a6ef900 <+92>:  mov    x2, #-0x1
0x21a6ef904 <+96>:  orr    x4, xzr, #0x8000000000000000
0x21a6ef908 <+100>: mov    w3, #0x0
0x21a6ef90c <+104>: bl     0x21ac175c8               ; symbol stub for: -[UIWebView webView:decidePolicyForNewWindowAction:request:newFrameName:decisionListener:]
0x21a6ef910 <+108>: adrp   x23, 52595
0x21a6ef914 <+112>: ldr    w8, [x23, #0x364]
0x21a6ef918 <+116>: cbz    w8, 0x21a6ef9a0           ; <+252>
0x21a6ef91c <+120>: lsr    w8, w8, #8
0x21a6ef920 <+124>: cmp    w8, #0x201                ; =0x201 
0x21a6ef924 <+128>: b.lo   0x21a6ef950               ; <+172>
0x21a6ef928 <+132>: bl     0x21ac17a48               ; symbol stub for: -[_UIShareParticipantDetails detailText]
0x21a6ef92c <+136>: mov    x23, x0
0x21a6ef930 <+140>: mov    x0, x22
0x21a6ef934 <+144>: mov    x1, x21
0x21a6ef938 <+148>: mov    x2, x19
0x21a6ef93c <+152>: mov    x3, x20
0x21a6ef940 <+156>: bl     0x21a6ef9d0               ; _UIApplicationMainPreparations
0x21a6ef944 <+160>: mov    x0, x23
0x21a6ef948 <+164>: bl     0x21ac17a3c               ; symbol stub for: -[_UIShareParticipantDetails setParticipantID:]
0x21a6ef94c <+168>: b      0x21a6ef964               ; <+192>
0x21a6ef950 <+172>: mov    x0, x22
0x21a6ef954 <+176>: mov    x1, x21
0x21a6ef958 <+180>: mov    x2, x19
0x21a6ef95c <+184>: mov    x3, x20
0x21a6ef960 <+188>: bl     0x21a6ef9d0               ; _UIApplicationMainPreparations
0x21a6ef964 <+192>: adrp   x8, 52595
0x21a6ef968 <+196>: ldr    x0, [x8, #0x328]
0x21a6ef96c <+200>: adrp   x8, 1577
0x21a6ef970 <+204>: add    x1, x8, #0xad5            ; =0xad5 
0x21a6ef974 <+208>: bl     0x21ac17b2c               ; symbol stub for: CloudDocsLibrary
0x21a6ef978 <+212>: mov    x0, x20  <--- Exception bad access code 1
0x21a6ef97c <+216>: bl     0x21ac17b5c               ; symbol stub for: -[_UICloudSharingActivity _documentSharingControllerDidDismiss:]
0x21a6ef980 <+220>: mov    x0, x19
0x21a6ef984 <+224>: bl     0x21ac17b5c               ; symbol stub for: -[_UICloudSharingActivity _documentSharingControllerDidDismiss:]
0x21a6ef988 <+228>: mov    w0, #0x0
0x21a6ef98c <+232>: ldp    x29, x30, [sp, #0x30]
0x21a6ef990 <+236>: ldp    x20, x19, [sp, #0x20]
0x21a6ef994 <+240>: ldp    x22, x21, [sp, #0x10]
0x21a6ef998 <+244>: ldp    x24, x23, [sp], #0x40
0x21a6ef99c <+248>: ret    
0x21a6ef9a0 <+252>: adrp   x8, 52593
0x21a6ef9a4 <+256>: ldr    x8, [x8, #0xf40]
0x21a6ef9a8 <+260>: cmn    x8, #0x1                  ; =0x1 
0x21a6ef9ac <+264>: b.ne   0x21a6ef9b8               ; <+276>
0x21a6ef9b0 <+268>: ldr    w8, [x23, #0x364]
0x21a6ef9b4 <+272>: b      0x21a6ef91c               ; <+120>
0x21a6ef9b8 <+276>: adrp   x0, 52593
0x21a6ef9bc <+280>: add    x0, x0, #0xf40            ; =0xf40 
0x21a6ef9c0 <+284>: adrp   x1, 41868
0x21a6ef9c4 <+288>: add    x1, x1, #0x640            ; =0x640 
0x21a6ef9c8 <+292>: bl     0x21ac17490               ; symbol stub for: -[UIWebView _webView:commitPreview:]
0x21a6ef9cc <+296>: b      0x21a6ef9b0               ; <+268>

Looks like it's crashed trying to do some CloudKit stuff? Which is odd because we don't have any CloudKit things setup...

I've only ever seen this crashing locally with this (when running through Xcode), not in our CI. We recently added some CoreData usage, could that be related in some way?

It seems like the CloudKit stuff might be a red herring and really this is a KVO crash as when I run the 'bt' command in the console I get the backtrace including the following warning: KVO_IS_RETAINING_ALL_OBSERVERS_OF_THIS_OBJECT_IF_IT_CRASHES_AN_OBSERVER_WAS_OVERRELEASED_OR_SMASHED

I've been seeing this issue while trying to track down a KVO crash so that makes some sense... shame there's not more info in the stack!

Answer 1

I still don't really know why this crash was happening but I've managed to get rid of it by changing some of the KVO setup.

To track down the problematic KVO I commented out various bits of KVO code and ran a custom test suite which would always crash within 30 minutes or so. That lead me to some block-based KVO of AVPlayerItem's status property being the culprit.

I remembered seeing a quote from someone very wise along the lines of

"Block-based KVO, it just works (until it doesn't)" - Anon

So I switched the block-based KVO to the old callback style and the crash seems to have disappeared.

sigh