[Bug]: [OneSignal startNewSessionInternal] Crash

[tikidunpon]

What happened?

Crashes occur at a rate of about 1 in 7,000.

Steps to reproduce?

Only reported on Crashlytics and we have not been able to reproduce it.  
The available RAM space is about 80 MB.

What did you expect to happen?

Crash should not happen.

OneSignal iOS SDK version

Release 5.1.0

iOS version

15

Specific iOS version

- iOS 17.3.1

Relevant log output

EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x0000000000000000

Crashed: com.apple.main-thread
0  OneSignalUser                  0xd210 block_destroy_helper + 5416
1  OneSignalUser                  0xe978 block_destroy_helper + 11408
2  OneSignalUser                  0x1a45c block_destroy_helper.32 + 15588
3  OneSignalUser                  0x837c __swift_project_boxed_opaque_existential_1 + 13672
4  OneSignalUser                  0x8640 __swift_project_boxed_opaque_existential_1 + 14380
5  OneSignalUser                  0x80e4 __swift_project_boxed_opaque_existential_1 + 13008
6  OneSignalUser                  0x8218 __swift_project_boxed_opaque_existential_1 + 13316
7  OneSignalFramework             0x7f34 +[OneSignal startNewSessionInternal] + 264
8  libdispatch.dylib              0x26a8 <redacted> + 32
9  libdispatch.dylib              0x4300 <redacted> + 20
10 libdispatch.dylib              0x12998 <redacted> + 984
11 libdispatch.dylib              0x125b0 _dispatch_main_queue_callback_4CF + 44
12 CoreFoundation                 0x36f9c <redacted> + 16
13 CoreFoundation                 0x33ca8 <redacted> + 1996
14 CoreFoundation                 0x333f8 CFRunLoopRunSpecific + 608
15 GraphicsServices               0x34f8 GSEventRunModal + 164
16 UIKitCore                      0x22c8a0 <redacted> + 888
17 UIKitCore                      0x22bedc UIApplicationMain + 340
18 my-app                         0xa77c main + 21 (AppDelegate.swift:21)
19 ???                            0x1d817edcc

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

[nan-li]

Hi @tikidunpon, thank you for reporting.

0  OneSignalUser                  0xd210 block_destroy_helper + 5416
1  OneSignalUser                  0xe978 block_destroy_helper + 11408
2  OneSignalUser                  0x1a45c block_destroy_helper.32 + 15588
3  OneSignalUser                  0x837c __swift_project_boxed_opaque_existential_1 + 13672
4  OneSignalUser                  0x8640 __swift_project_boxed_opaque_existential_1 + 14380
5  OneSignalUser                  0x80e4 __swift_project_boxed_opaque_existential_1 + 13008
6  OneSignalUser                  0x8218 __swift_project_boxed_opaque_existential_1 + 13316

These lines are very obscure and we have trouble knowing what methods are called to resolve this issue. The real classes and methods are being hidden.

Are you able to take the crash report and symbolicate it?

[tikidunpon]

@nan-li The log is fully symbolicated. However, block_destroy_helper seems to be an optimization code inserted by the compiler at release build. （refs）So I will get more detailed logs in debug build. But, we have not been able to reproduce the crash in the debug build.

Since this crash occurs infrequently, we suspect that the problem is due to concurrency or lack of memory, or both.

[nan-li]

@tikidunpon

I see, I have been investigating how to get more information than __swift_project_boxed_opaque_existential_1 and block_destroy_helper, but bearing no results.

I haven't been able to get far with just this stacktrace since these could be a method in one of many classes 🤔.

[tikidunpon]

@nan-li

I read the code. I could not find a cause of the crash, but I did find potentially cause problems in concurrency.

1. Unsafe initialization of singleton instances

Singleton instances should be safely initialized only once using dispatch_once_t . refs: https://stackoverflow.com/a/2200751

For example, the following code is potentially unsafe. (and all other singleton initialization points) https://github.com/OneSignal/OneSignal-iOS-SDK/blob/8f47b6fca513ac848634c31052080ae2f3d9e915/iOS_SDK/OneSignalSDK/OneSignalOutcomes/OSOutcomes.m#L37-L39

2. Unsafe mutable state access

Critical sections should be exclusively controlled using dedicated Sirial Queues or other methods. https://stackoverflow.com/a/45712847

For example, the following code is potentially unsafe. (and all other singleton mutable state access) https://github.com/OneSignal/OneSignal-iOS-SDK/blob/8f47b6fca513ac848634c31052080ae2f3d9e915/iOS_SDK/OneSignalSDK/OneSignalOutcomes/Source/OutcomeEvents/OSSessionManager.m#L105

[tikidunpon]

We decided to downgrade to v3 sdk due to many crashes when rolling out as is. looking forward to the improved stability of the v5 sdk. Thank you.

[nan-li]

Thanks for the feedback @tikidunpon,

The callouts you made are on old code that also exist on v3 of the SDK. We haven't had crash reports from those, but it is still good to be aware and address the potential problems.

They are in a different framework, so the crash you are seeing is coming from our OneSignalUser framework, which is Swift-only. I am now actively looking at unsafe code in that framework.

We decided to downgrade to v3 sdk due to many crashes when rolling out as is.

Can you share the crashes you experienced during your rollout?

[tikidunpon]

@nan-li Thanks for the explanation about v3 and v5 using a common code base. I also understood that OneSignalUser is a closed source and I cannot investigate further.

We have only rolledout to a few percent of the total users yet. But other crashe have occurred. I will share those logs with you.

Crashed: com.apple.main-thread
EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x00003241fe303ff0

0  libswiftCore.dylib             0x3a68fc <redacted> + 32
1  libswiftCore.dylib             0x3a7fb0 <redacted> + 136
2  OneSignalUser                  0x38ffc block_destroy_helper + 1196
3  OneSignalUser                  0x35ee4 __swift_noop_void_return + 19232
4  OneSignalUser                  0x38ad4 __swift_noop_void_return + 30480
5  OneSignalOSCore                0x8e90 __swift_instantiateConcreteTypeFromMangledName + 4288
6  OneSignalUser                  0x86fc __swift_project_boxed_opaque_existential_1 + 14568
7  OneSignalFramework             0xd54c +[OneSignalTracker applicationBackgrounded] + 276
8  CoreFoundation                 0x2f258 <redacted> + 148
9  CoreFoundation                 0x2ec20 <redacted> + 88
10 CoreFoundation                 0x2eb68 <redacted> + 440
11 CoreFoundation                 0x2e0b8 _CFXNotificationPost + 724
12 Foundation                     0x2a704 <redacted> + 92
13 UIKitCore                      0x211334 <redacted> + 1216
14 UIKitCore                      0x13ae1c <redacted> + 176
15 UIKitCore                      0x1398c0 <redacted> + 608
16 UIKitCore                      0x139228 <redacted> + 248
17 UIKitCore                      0x1390f8 <redacted> + 148
18 UIKitCore                      0x139000 <redacted> + 736
19 UIKitCore                      0x138888 _UISceneSettingsDiffActionPerformChangesWithTransitionContextAndCompletion + 224
20 UIKitCore                      0x138538 <redacted> + 316
21 UIKitCore                      0x4bc270 <redacted> + 612
22 UIKitCore                      0x1376bc <redacted> + 216
23 UIKitCore                      0x13752c <redacted> + 244
24 UIKitCore                      0x13736c <redacted> + 336
25 FrontBoardServices             0xe5b4 <redacted> + 660
26 FrontBoardServices             0xe300 <redacted> + 152
27 FrontBoardServices             0xe19c <redacted> + 168
28 FrontBoardServices             0xe0b8 <redacted> + 344
29 libdispatch.dylib              0x4300 <redacted> + 20
30 libdispatch.dylib              0x7d48 <redacted> + 284
31 FrontBoardServices             0xa520 <redacted> + 52
32 FrontBoardServices             0xa4a0 <redacted> + 240
33 FrontBoardServices             0xa378 <redacted> + 28
34 CoreFoundation                 0x370ac <redacted> + 28
35 CoreFoundation                 0x36328 <redacted> + 176
36 CoreFoundation                 0x34adc <redacted> + 244
37 CoreFoundation                 0x33818 <redacted> + 828
38 CoreFoundation                 0x333f8 CFRunLoopRunSpecific + 608
39 GraphicsServices               0x34f8 GSEventRunModal + 164
40 UIKitCore                      0x22c8a0 <redacted> + 888
41 UIKitCore                      0x22bedc UIApplicationMain + 340
42 my-app                     0xa77c main + 21 (AppDelegate.swift:21)
43 ???                            0x1b1812dcc

[guillecom]

Hi @tikidunpon I have experienced the same two crashes in a new app that has less than 100 users, so this is concerning. I also have an app that has 3.0.0 which never had these crashes. Is there any update on this issue?

[nan-li]

Hi @guillecom what version of the OneSignal iOS SDK did the crashes occur on?

[nan-li]

Hi @tikidunpon and @guillecom, we have a few crash fixes since these reports.

Please update to Release 5.1.6 or later, and let us know if the crashes are resolved, or what crashes still remain.