Occasional crashing in iOS10

[carlos-saraiva]

Hello,

We currently have an app in production that has an "infinite" scrollable video feed (with a paged scroller so there's only one video per page). Due to some performance issues when scrolling (because of AVPlayer playback starting) we have recently migrated that feed to use Texture (version 2.6 which is the latest CocoaPods version at the time of writing).
It consists of an ASTableNode with paging enabled, where each cell occupies one screen size. Each cell has various subnodes (like an ASVideoNode for video playback, an ASEditableTextNode to show the video description, but nothing I can see out of the ordinary).

It passed our internal testing so we've launched it to production, but once we did we noticed that some iOS 10 devices started having crashes (that we haven't yet been able to reproduce), with the following callstack:

Crashed: com.apple.main-thread
0 libobjc.A.dylib 0x18ca32f30 objc_msgSend + 16
1 UIFoundation 0x193d64a1c -[NSATSTypesetter actionForControlCharacterAtIndex:] + 116
2 UIFoundation 0x193d66fec -[NSATSGlyphStorage setGlyphRange:characterRange:] + 3128
3 UIFoundation 0x193d6294c -[NSATSTypesetter _ctTypesetter] + 276
4 UIFoundation 0x193d6bb14 -[NSATSLineFragment layoutForStartingGlyphAtIndex:characterIndex:minPosition:maxPosition:lineFragmentRect:] + 128
5 UIFoundation 0x193d63534 -[NSATSTypesetter _layoutLineFragmentStartingWithGlyphAtIndex:characterIndex:atPoint:renderingContext:] + 2316
6 UIFoundation 0x193d64af8 -[NSATSTypesetter layoutParagraphAtPoint:] + 160
7 UIFoundation 0x193dbaf08 -[NSTypesetter _layoutGlyphsInLayoutManager:startingAtGlyphIndex:maxNumberOfLineFragments:maxCharacterIndex:nextGlyphIndex:nextCharacterIndex:] + 3012
8 UIFoundation 0x193dbbda4 -[NSTypesetter layoutCharactersInRange:forLayoutManager:maximumNumberOfLineFragments:] + 244
9 UIFoundation 0x193d65558 -[NSATSTypesetter layoutCharactersInRange:forLayoutManager:maximumNumberOfLineFragments:] + 448
10 UIFoundation 0x193d5168c -[NSLayoutManager(NSPrivate) _fillLayoutHoleForCharacterRange:desiredNumberOfLines:isSoft:] + 1116
11 UIFoundation 0x193d57d54 _NSFastFillAllLayoutHolesForGlyphRange + 1416
12 UIFoundation 0x193d887c0 -[NSLayoutManager ensureLayoutForBoundingRect:inTextContainer:] + 220
13 UIKit 0x194858918 __38-[UITextView _visibleRangeWithLayout:]_block_invoke + 112
14 UIFoundation 0x193d8e62c -[NSLayoutManager(TextLocking) coordinateAccess:] + 64
15 UIKit 0x19485885c -[UITextView _visibleRangeWithLayout:] + 144
16 UIKit 0x19485f49c -[_UITextViewRestorableScrollPosition initWithTextView:] + 100
17 UIKit 0x19485f04c +[_UITextViewRestorableScrollPosition restorableScrollPositionForTextView:] + 68
18 UIKit 0x194855704 -[UITextView setContentOffset:] + 80
19 UIKit 0x194144168 -[UIScrollView(UIScrollViewInternal) _adjustContentOffsetIfNecessary] + 60
20 UIKit 0x193f0cd60 -[UIScrollView(UIScrollViewInternal) _stopScrollingNotify:pin:tramplingDragFlags:] + 448
21 UIKit 0x193f0cb60 -[UIScrollView removeFromSuperview] + 40
22 UIKit 0x193e2e14c -[UIView dealloc] + 1176
23 Foundation 0x18ea35a58 -[NSConcretePointerArray replacePointerAtIndex:withPointer:] + 176
24 OurApp 0x1007ce11c -[ASRunLoopQueue processQueue] (ASRunLoopQueue.mm:379)
25 CoreFoundation 0x18df957dc CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION + 32
26 CoreFoundation 0x18df9340c __CFRunLoopDoObservers + 372
27 CoreFoundation 0x18df9389c __CFRunLoopRun + 1024
28 CoreFoundation 0x18dec2048 CFRunLoopRunSpecific + 444
29 GraphicsServices 0x18f945198 GSEventRunModal + 180
30 UIKit 0x193e9b818 -[UIApplication _run] + 684
31 UIKit 0x193e96550 UIApplicationMain + 208
32 OurApp 0x10030b3bc main (main.m:16)

The callstack suggests that a scrollview with text (maybe the ASEditableTextNode) is disappearing and yet doing some layout calculations. However I don't really understand why this is happening, why it's crashing or why it's limited to iOS10 (and only occurs rarely). Since I can't reproduce it, I can't give a crashing example, but was hoping for some pointers to figure out what is going wrong.

Thanks in advance!

[Adlai-Holler]

Interesting! I don't believe we've seen this one before. Could you show the other threads as well bt all?

First guess is that the typesetter is trying to retain the text view, which is illegal since it's deallocating.

In any case, iOS 10 seems to be doing something very silly during text view dealloc, and the workaround could be to set a _deallocating flag in the text view's -dealloc, and then override -setContentOffset: and if (_deallocating) { return; } under iOS 10 to avoid going into that text stuff.

[carlos-saraiva]

Well, for that particular crash report we took the callstack from, the other thread callstacks don't look that interesting, mostly "idle" ones or 3rd party platform ones. The only possibly relevant one is at the end (ASDeallocQueue):

com.apple.uikit.eventfetch-thread
0 libsystem_kernel.dylib 0x18558416c mach_msg_trap + 8
1 libsystem_kernel.dylib 0x185583fdc mach_msg + 72
2 CoreFoundation 0x18657fcec __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x18657d908 __CFRunLoopRun + 1132
4 CoreFoundation 0x1864ac048 CFRunLoopRunSpecific + 444
5 Foundation 0x186fbda8c -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 304
6 Foundation 0x186fde57c -[NSRunLoop(NSRunLoop) runUntilDate:] + 96
7 UIKit 0x18ce06a2c -[UIEventFetcher threadMain] + 136
8 Foundation 0x1870bb47c NSThread__start + 1024
9 libsystem_pthread.dylib 0x185668850 _pthread_body + 240
10 libsystem_pthread.dylib 0x185668760 _pthread_body + 282
11 libsystem_pthread.dylib 0x185665dac thread_start + 4

AVAudioSession Notify Thread
0 libsystem_kernel.dylib 0x18558416c mach_msg_trap + 8
1 libsystem_kernel.dylib 0x185583fdc mach_msg + 72
2 CoreFoundation 0x18657fcec __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x18657d908 __CFRunLoopRun + 1132
4 CoreFoundation 0x1864ac048 CFRunLoopRunSpecific + 444
5 AVFAudio 0x19f788fe8 GenericRunLoopThread::Entry(void*) + 164
6 AVFAudio 0x19f7aef14 CAPThread::Entry(CAPThread*) + 84
7 libsystem_pthread.dylib 0x185668850 _pthread_body + 240
8 libsystem_pthread.dylib 0x185668760 _pthread_body + 282
9 libsystem_pthread.dylib 0x185665dac thread_start + 4

com.twitter.crashlytics.ios.MachExceptionServer
0 OurApp 0x1009d9e1c CLSProcessRecordAllThreads + 4304789020
1 OurApp 0x1009d9e1c CLSProcessRecordAllThreads + 4304789020
2 OurApp 0x1009d9cd8 CLSProcessRecordAllThreads + 4304788696
3 OurApp 0x1009c91b4 CLSHandler + 4304720308
4 OurApp 0x1009c3e64 CLSMachExceptionServer + 4304698980
5 libsystem_pthread.dylib 0x185668850 _pthread_body + 240
6 libsystem_pthread.dylib 0x185668760 _pthread_body + 282
7 libsystem_pthread.dylib 0x185665dac thread_start + 4

com.apple.NSURLConnectionLoader
0 libsystem_kernel.dylib 0x18558416c mach_msg_trap + 8
1 libsystem_kernel.dylib 0x185583fdc mach_msg + 72
2 CoreFoundation 0x18657fcec __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x18657d908 __CFRunLoopRun + 1132
4 CoreFoundation 0x1864ac048 CFRunLoopRunSpecific + 444
5 CFNetwork 0x186c9dfd0 +[NSURLConnection(Loader) _resourceLoadLoop:] + 336
6 Foundation 0x1870bb47c NSThread__start + 1024
7 libsystem_pthread.dylib 0x185668850 _pthread_body + 240
8 libsystem_pthread.dylib 0x185668760 _pthread_body + 282
9 libsystem_pthread.dylib 0x185665dac thread_start + 4

com.apple.CoreMotion.MotionThread
0 libsystem_kernel.dylib 0x18558416c mach_msg_trap + 8
1 libsystem_kernel.dylib 0x185583fdc mach_msg + 72
2 CoreFoundation 0x18657fcec __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x18657d908 __CFRunLoopRun + 1132
4 CoreFoundation 0x1864ac048 CFRunLoopRunSpecific + 444
5 CoreFoundation 0x1864f98d4 CFRunLoopRun + 112
6 CoreMotion 0x18d2ff738 (null) + 187376
7 libsystem_pthread.dylib 0x185668850 _pthread_body + 240
8 libsystem_pthread.dylib 0x185668760 _pthread_body + 282
9 libsystem_pthread.dylib 0x185665dac thread_start + 4

Thread (several of these with the exact callstack)
0 libsystem_kernel.dylib 0x1855a2a88 __workq_kernreturn + 8
1 libsystem_pthread.dylib 0x18566635c _pthread_wqthread + 1452
2 libsystem_pthread.dylib 0x185665da4 start_wqthread + 4

Thread
0 libsystem_kernel.dylib 0x1855a1e1c __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1856679c0 _pthread_cond_wait + 640
2 libc++.1.dylib 0x184f913ec std::__1::condition_variable::wait(std::__1::unique_lockstd::__1::mutex&) + 56
3 JavaScriptCore 0x18ad57548 void std::__1::condition_variable_any::wait<std::__1::unique_lockbmalloc::Mutex >(std::__1::unique_lockbmalloc::Mutex&) + 112
4 JavaScriptCore 0x18ad574bc bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::)()>::threadRunLoop() + 168
5 JavaScriptCore 0x18ad5739c std::__1::__shared_ptr_emplace<std::__1::mutex, std::__1::allocatorstd::__1::mutex >::~__shared_ptr_emplace() + 10
6 JavaScriptCore 0x18ad5764c void std::__1::__thread_proxy<std::__1::tuple<void ()(bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::)()>), bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::)()>> >(void) + 92
7 libsystem_pthread.dylib 0x185668850 _pthread_body + 240
8 libsystem_pthread.dylib 0x185668760 _pthread_body + 282
9 libsystem_pthread.dylib 0x185665dac thread_start + 4

WebThread
0 libsystem_kernel.dylib 0x18558416c mach_msg_trap + 8
1 libsystem_kernel.dylib 0x185583fdc mach_msg + 72
2 CoreFoundation 0x18657fcec __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x18657d908 __CFRunLoopRun + 1132
4 CoreFoundation 0x1864ac048 CFRunLoopRunSpecific + 444
5 WebCore 0x18b05545c RunWebThread(void*) + 456
6 libsystem_pthread.dylib 0x185668850 _pthread_body + 240
7 libsystem_pthread.dylib 0x185668760 _pthread_body + 282
8 libsystem_pthread.dylib 0x185665dac thread_start + 4

JIT Worklist Worker Thread
0 libsystem_kernel.dylib 0x1855a1e1c __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1856679c0 _pthread_cond_wait + 640
2 libc++.1.dylib 0x184f913ec std::__1::condition_variable::wait(std::__1::unique_lockstd::__1::mutex&) + 56
3 JavaScriptCore 0x18ad3fe58 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 2016
4 JavaScriptCore 0x18ab186fc JSC::JITWorklist::runThread() + 192
5 JavaScriptCore 0x18ab18b4c WTF::Vector<WTF::RefPtrJSC::JITWorklist::Plan, 32ul, WTF::CrashOnOverflow, 16ul>::expandCapacity(unsigned long, WTF::RefPtrJSC::JITWorklist::Plan) + 14
6 JavaScriptCore 0x18a489dac WTF::threadEntryPoint(void) + 212
7 JavaScriptCore 0x18a489cbc WTF::wtfThreadEntryPoint(void*) + 24
8 libsystem_pthread.dylib 0x185668850 _pthread_body + 240
9 libsystem_pthread.dylib 0x185668760 _pthread_body + 282
10 libsystem_pthread.dylib 0x185665dac thread_start + 4

WTF Parallel Helper Thread
0 libsystem_kernel.dylib 0x1855a1e1c __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1856679c0 _pthread_cond_wait + 640
2 libc++.1.dylib 0x184f913ec std::__1::condition_variable::wait(std::__1::unique_lockstd::__1::mutex&) + 56
3 JavaScriptCore 0x18ad3fe58 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 2016
4 JavaScriptCore 0x18ad3f450 WTF::ParallelHelperPool::waitForClientWithTask(WTF::LockerWTF::LockBase const&) + 288
5 JavaScriptCore 0x18ad3f1f0 WTF::ParallelHelperPool::helperThreadBody() + 76
6 JavaScriptCore 0x18a489dac WTF::threadEntryPoint(void*) + 212
7 JavaScriptCore 0x18a489cbc WTF::wtfThreadEntryPoint(void*) + 24
8 libsystem_pthread.dylib 0x185668850 _pthread_body + 240
9 libsystem_pthread.dylib 0x185668760 _pthread_body + 282
10 libsystem_pthread.dylib 0x185665dac thread_start + 4

AFNetworking
0 libsystem_kernel.dylib 0x18558416c mach_msg_trap + 8
1 libsystem_kernel.dylib 0x185583fdc mach_msg + 72
2 CoreFoundation 0x18657fcec __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x18657d908 __CFRunLoopRun + 1132
4 CoreFoundation 0x1864ac048 CFRunLoopRunSpecific + 444
5 Foundation 0x186fbda8c -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 304
6 Foundation 0x187012210 -[NSRunLoop(NSRunLoop) run] + 88
7 OurApp 0x1004ef8f0 +[AFURLConnectionOperation networkRequestThreadEntryPoint:] (AFURLConnectionOperation.m:164)
8 Foundation 0x1870bb47c NSThread__start + 1024
9 libsystem_pthread.dylib 0x185668850 _pthread_body + 240
10 libsystem_pthread.dylib 0x185668760 _pthread_body + 282
11 libsystem_pthread.dylib 0x185665dac thread_start + 4

QBGCDAsyncSocket-CFStream
0 libsystem_kernel.dylib 0x18558416c mach_msg_trap + 8
1 libsystem_kernel.dylib 0x185583fdc mach_msg + 72
2 CoreFoundation 0x18657fcec __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x18657d908 __CFRunLoopRun + 1132
4 CoreFoundation 0x1864ac048 CFRunLoopRunSpecific + 444
5 Foundation 0x186fbda8c -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 304
6 Quickblox 0x10151efc0 qb_jid + 217540
7 Foundation 0x1870bb47c NSThread__start + 1024
8 libsystem_pthread.dylib 0x185668850 _pthread_body + 240
9 libsystem_pthread.dylib 0x185668760 _pthread_body + 282
10 libsystem_pthread.dylib 0x185665dac thread_start + 4

ASDeallocQueue (this is the one that may be most interesting)
0 libsystem_kernel.dylib 0x1855a1e64 __psynch_mutexwait + 8
1 libsystem_pthread.dylib 0x18566bda4 _pthread_mutex_lock_wait + 96
2 libsystem_pthread.dylib 0x18566bfa8 _pthread_mutex_lock_slow + 296
3 OurApp 0x1008024d0 -[ASRunLoopQueue lock] (ASThread.h:209)
4 OurApp 0x1007d0160 ASPerformMainThreadDeallocation(objc_object* __strong*) (ASDisplayNodeExtras.mm:42)
5 OurApp 0x1007c4740 -[ASDisplayNode _scheduleIvarsForMainDeallocation] (ASDisplayNode.mm:443)
6 OurApp 0x1007c44f8 -[ASDisplayNode dealloc] (ASDisplayNode.mm:414)
7 libobjc.A.dylib 0x185025fe0 (anonymous namespace)::AutoreleasePoolPage::pop(void*) + 704
8 OurApp 0x100801834 __28-[ASDeallocQueue threadMain]_block_invoke (ASRunLoopQueue.mm:97)
9 CoreFoundation 0x1865808f4 CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION + 28
10 CoreFoundation 0x186580608 __CFRunLoopDoTimer + 872
11 CoreFoundation 0x18657fec4 __CFRunLoopDoTimers + 244
12 CoreFoundation 0x18657dac0 __CFRunLoopRun + 1572
13 CoreFoundation 0x1864ac048 CFRunLoopRunSpecific + 444
14 CoreFoundation 0x1864f98d4 CFRunLoopRun + 112
15 OurApp 0x10080171c -[ASDeallocQueue threadMain] (ASRunLoopQueue.mm:112)
16 Foundation 0x1870bb47c NSThread__start + 1024
17 libsystem_pthread.dylib 0x185668850 _pthread_body + 240
18 libsystem_pthread.dylib 0x185668760 _pthread_body + 282
19 libsystem_pthread.dylib 0x185665dac thread_start + 4

Nevertheless, we'll try your suggestion to see if it fixes (or at the very least mitigates) the issue. We'll let you know how it turns out.

[nguyenhuy]

@carlos-saraiva #915 should address this issue. I'm going to close this ticket, but feel free to re-open if the issue still occurs after the fix. Thank you for the report!