ios - iPhone 因 tcpConnWorkQueue EXC_BAD_ACCESS 而崩溃

Question

我有以下堆栈跟踪:

Crashed: tcpConnWorkQueue (Not main thread)
EXC_BAD_ACCESS KERN_INVALID_ADDRESS at 0xf000000c
0 libobjc.A.dylib    objc_msgSend + 5
1 CoreFoundation     CFRelease + 560
2 libdispatch.dylib  _dispatch_call_block_and_release + 10
3 libdispatch.dylib  _dispatch_queue_drain + 374
4 libdispatch.dylib  _dispatch_queue_invoke + 42
5 libdispatch.dylib  _dispatch_root_queue_drain + 76
6 libdispatch.dylib  _dispatch_worker_thread2 + 56
7 libsystem_pthread.dylib    _pthread_wqthread + 298

所有其他堆栈看起来与我的代码无关。这个堆栈跟踪是什么意思？我在哪里可以找到我的代码中可能导致类似情况的错误？

主线程堆栈如下所示:

Thread : com.apple.main-thread
0  QuartzCore                     0x2fedef34 CA::Render::Object::unref() const + 35
1  QuartzCore                     0x2fedda73 CA::Context::commit_layer(CA::Layer*, unsigned int, unsigned int, void*) + 142
2  QuartzCore                     0x2fedda73 CA::Context::commit_layer(CA::Layer*, unsigned int, unsigned int, void*) + 142
3  QuartzCore                     0x2fedaa23 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 314
4  QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
5  QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
6  QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
7  QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
8  QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
9  QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
10 QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
11 QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
12 QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
13 QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
14 QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
15 QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
16 QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
17 QuartzCore                     0x2feda9c1 CA::Layer::commit_if_needed(CA::Transaction*, void (*)(CA::Layer*, unsigned int, unsigned int, void*), void*) + 216
18 QuartzCore                     0x2fed8d41 CA::Context::commit_transaction(CA::Transaction*) + 1048
19 QuartzCore                     0x2fed881f CA::Transaction::commit() + 314
20 QuartzCore                     0x2ff2d929 CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 516
21 IOMobileFramebuffer            0x32b5d76d IOMobileFramebufferVsyncNotifyFunc + 104
22 IOKit                          0x2e7b4be5 IODispatchCalloutFromCFMessage + 248
23 CoreFoundation                 0x2da92b81 __CFMachPortPerform + 136
24 CoreFoundation                 0x2da9d777 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 34
25 CoreFoundation                 0x2da9d713 __CFRunLoopDoSource1 + 346
26 CoreFoundation                 0x2da9bedf __CFRunLoopRun + 1406
27 CoreFoundation                 0x2da06471 CFRunLoopRunSpecific + 524
28 CoreFoundation                 0x2da06253 CFRunLoopRunInMode + 106
29 GraphicsServices               0x327402eb GSEventRunModal + 138
30 UIKit                          0x302bb845 UIApplicationMain + 1136

Answer 1

第 1 层的堆栈跟踪显示 CFRelease 已被调用，但根据内核，您的地址 0xf000000c 无效，导致错误访问异常。在最常见的情况下，当消息发送到已释放的对象时会发生这种情况。

这种类型的崩溃通常在对象第一次释放和第二次释放之间有一个时间差。但是，您有在屏幕更新时触发的代码，因为您有一个 0x2ff2d929 CA::Display::DisplayLink::dispatch_items。屏幕更新频繁，因此应经常调用。

您是否在程序的任何地方使用了+ (CADisplayLink *)displayLinkWithTarget:(id)target selector:(SEL)sel？你有任何 - (void)invalidate 调用吗？

可能是用户界面正在从一个用例(比如玩基于显示计时器的屏幕更新的游戏)切换到另一个用例(比如在游戏结束时呈现菜单选项)。当这种切换发生时，代码假设失效，所以你必须取消你的回调，否则当事情没有正确设置时你会得到一个最终的回调(你绘制了一个游戏框架，而实际上是时候显示菜单了)。

当您在启用 Zombies 的情况下运行您的程序时 - 在 Schema 部分中的一个复选框，然后任何已发布的对象都会成为“僵尸” - 它会徘徊等待对该对象进行调用。当任何调用进来时，它知道这是一个编程错误并中止。然后，您可以回顾该对象的分配历史，了解它首次分配和释放的位置，以确定双释放错误。