Crash due to EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x0000000000000000

[halonsoluis]

This issue is caused by func deliver(_ deliver: CocoaMQTTDeliver, wantToSend frame: CocoaMQTTFramePublish)

At the beginning of this function there's a force unwrap that can be the cause of the reported crash.

      let msgid = frame.msgid!

      guard let message = sendingMessages[msgid] else {
          return
      }

This can be fixed by adding msgid creation into the guard.

guard let msgid = frame.msgid, let message = sendingMessages[msgid] else { return }

Crash Report:

Crashed: com.apple.root.user-initiated-qos 0 CocoaMQTT 0x102be08ac $s9CocoaMQTTAAC7deliver_10wantToSendyAA0A11MQTTDeliverC_AA0A16MQTTFramePublishVtFTf4dnn_n + 140 1 CocoaMQTT 0x102be7c70 $s9CocoaMQTT0A11MQTTDeliverC7deliver33_95E0A6B76F6AC9616E232A5BF1E96E76LLyyAA0A16MQTTFramePublishVFyAGcfU_yycfU_TATm + 76 2 CocoaMQTT 0x102bd998c $sIeg_IeyB_TR + 28 3 libdispatch.dylib 0x1a91c3a38 _dispatch_call_block_and_release + 24 4 libdispatch.dylib 0x1a91c47d4 _dispatch_client_callout + 16 5 libdispatch.dylib 0x1a9175160 _dispatch_root_queue_drain + 680 6 libdispatch.dylib 0x1a91758d0 _dispatch_worker_thread2 + 128 7 libsystem_pthread.dylib 0x1a93a41b4 _pthread_wqthread + 464 8 libsystem_pthread.dylib 0x1a93a6cd4 start_wqthread + 4

[halonsoluis]

Also seen at the same spot, after repeated hits to publish and subscribe. This behaviour gets fixed after applying previous modification.

2019-09-05 12:18:03.467120+0200 A1[54736:198278] -[__NSCFNumber objectForKey:]: unrecognized selector sent to instance 0x8000000000000000 2019-09-05 12:18:03.476634+0200 A1[54736:198278] *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '-[__NSCFNumber objectForKey:]: unrecognized selector sent to instance 0x8000000000000000' *** First throw call stack: ( 0 CoreFoundation 0x000000011ea428db __exceptionPreprocess + 331 1 libobjc.A.dylib 0x000000011d900ac5 objc_exception_throw + 48 2 CoreFoundation 0x000000011ea60c94 -[NSObject(NSObject) doesNotRecognizeSelector:] + 132 3 CoreFoundation 0x000000011ea47623 forwarding + 1443 4 CoreFoundation 0x000000011ea49418 CF_forwarding_prep_0 + 120 5 libswiftCore.dylib 0x0000000120c63dcc $sSD8_VariantVyq_Sgxcig + 140 6 libswiftCore.dylib 0x0000000120e8f7b9 $sSDyq_Sgxcig + 9 7 CocoaMQTT 0x000000010ef9c441 $s9CocoaMQTTAAC7deliver_10wantToSendyAA0A11MQTTDeliverC_AA0A16MQTTFramePublishVtF + 513 8 CocoaMQTT 0x000000010efa0e8e $s9CocoaMQTTAACAA0A19MQTTDeliverProtocolA2aCP7deliver_10wantToSendyAA0aC0C_AA0A16MQTTFramePublishVtFTW + 30 9 CocoaMQTT 0x000000010efb3158 $s9CocoaMQTT0A11MQTTDeliverC7deliver33_95E0A6B76F6AC9616E232A5BF1E96E76LLyyAA0A16MQTTFramePublishVFyAGcfU_yycfU + 120 10 CocoaMQTT 0x000000010efb337f $s9CocoaMQTT0A11MQTTDeliverC7deliver33_95E0A6B76F6AC9616E232A5BF1E96E76LLyyAA0A16MQTTFramePublishVFyAGcfU_yycfU_TA + 31 11 CocoaMQTT 0x000000010ef9f33d $sIeg_IeyB_TR + 45 12 libdispatch.dylib 0x000000012183dd7f _dispatch_call_block_and_release + 12 13 libdispatch.dylib 0x000000012183edb5 _dispatch_client_callout + 8 14 libdispatch.dylib 0x000000012184f806 _dispatch_root_queue_drain + 819 15 libdispatch.dylib 0x000000012184ffca _dispatch_worker_thread2 + 130 16 libsystem_pthread.dylib 0x0000000121c276b3 _pthread_wqthread + 583 17 libsystem_pthread.dylib 0x0000000121c273fd start_wqthread + 13 ) libc++abi.dylib: terminating with uncaught exception of type NSException

[halonsoluis]

Either case, this appear to not be the only problem around, as after applying the modification, there's still an EXC_BAD_ACCESS (code=1, address=0x18) on the same line.

This happens after much more hits to publish/subscribe randomly.

On this regard I have failed to locate the issue due to everything seems to be valid when the execution occurs.

po frame ▿ PUBLISH(msgid: 199, topic: /8, payload: [])

• header : 50
• variableHeader : 0 elements
• payload : 0 elements ▿ msgid : Optional<UInt16>
  • some : 199 ▿ topic : Optional<String>
  • some : "/8"
• data : nil

(lldb) po sendingMessages ▿ 69 elements ▿ 0 : 2 elements - key : 52 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x600003876880> ▿ 1 : 2 elements - key : 28 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d9350> ▿ 2 : 2 elements - key : 66 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039e5b30> ▿ 3 : 2 elements - key : 118 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039e1260> ▿ 4 : 2 elements - key : 182 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d4720> ▿ 5 : 2 elements - key : 183 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x60000383aa00> ▿ 6 : 2 elements - key : 157 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d9c50> ▿ 7 : 2 elements - key : 84 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d8f00> ▿ 8 : 2 elements - key : 87 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000038175d0> ▿ 9 : 2 elements - key : 25 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x60000381d350> ▿ 10 : 2 elements - key : 2 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039ce3d0> ▿ 11 : 2 elements - key : 99 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039c8d20> ▿ 12 : 2 elements - key : 27 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d9110> ▿ 13 : 2 elements - key : 67 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039cb0c0> ▿ 14 : 2 elements - key : 34 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039cc480> ▿ 15 : 2 elements - key : 65 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d8270> ▿ 16 : 2 elements - key : 145 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x60000383b690> ▿ 17 : 2 elements - key : 49 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x600003877930> ▿ 18 : 2 elements - key : 165 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039ce520> ▿ 19 : 2 elements - key : 7 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000038be2e0> ▿ 20 : 2 elements - key : 31 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x600003838b40> ▿ 21 : 2 elements - key : 198 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039cea30> ▿ 22 : 2 elements - key : 4 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x600003895710> ▿ 23 : 2 elements - key : 97 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039e5200> ▿ 24 : 2 elements - key : 111 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039ccba0> ▿ 25 : 2 elements - key : 130 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039e1e30> ▿ 26 : 2 elements - key : 148 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000038be340> ▿ 27 : 2 elements - key : 64 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x60000383b7b0> ▿ 28 : 2 elements - key : 110 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039ce7f0> ▿ 29 : 2 elements - key : 181 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000038bcae0> ▿ 30 : 2 elements - key : 78 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039ce490> ▿ 31 : 2 elements - key : 96 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039cc600> ▿ 32 : 2 elements - key : 10 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039c3480> ▿ 33 : 2 elements - key : 124 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x600003816a90> ▿ 34 : 2 elements - key : 133 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d82a0> ▿ 35 : 2 elements - key : 90 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000038765e0> ▿ 36 : 2 elements - key : 127 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d8b10> ▿ 37 : 2 elements - key : 154 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039cc0f0> ▿ 38 : 2 elements - key : 109 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x600003810510> ▿ 39 : 2 elements - key : 177 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039cd650> ▿ 40 : 2 elements - key : 136 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039cc870> ▿ 41 : 2 elements - key : 197 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000038104e0> ▿ 42 : 2 elements - key : 199 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d7780> ▿ 43 : 2 elements - key : 101 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d93b0> ▿ 44 : 2 elements - key : 81 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d97a0> ▿ 45 : 2 elements - key : 40 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039e6490> ▿ 46 : 2 elements - key : 138 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039e7fc0> ▿ 47 : 2 elements - key : 93 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039c8cf0> ▿ 48 : 2 elements - key : 151 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039caaf0> ▿ 49 : 2 elements - key : 75 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039e6160> ▿ 50 : 2 elements - key : 13 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d87b0> ▿ 51 : 2 elements - key : 70 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000038afa80> ▿ 52 : 2 elements - key : 108 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039cbc00> ▿ 53 : 2 elements - key : 26 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000038afc30> ▿ 54 : 2 elements - key : 184 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d8480> ▿ 55 : 2 elements - key : 162 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039c90e0> ▿ 56 : 2 elements - key : 168 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039ca220> ▿ 57 : 2 elements - key : 121 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039ccd80> ▿ 58 : 2 elements - key : 63 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039e63a0> ▿ 59 : 2 elements - key : 100 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x60000387cba0> ▿ 60 : 2 elements - key : 137 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000038bd0e0> ▿ 61 : 2 elements - key : 37 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000038bd980> ▿ 62 : 2 elements - key : 16 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d97d0> ▿ 63 : 2 elements - key : 46 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x600003877960> ▿ 64 : 2 elements - key : 43 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039e22b0> ▿ 65 : 2 elements - key : 180 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039cb2a0> ▿ 66 : 2 elements - key : 174 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d9500> ▿ 67 : 2 elements - key : 98 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039d8e40> ▿ 68 : 2 elements - key : 171 ▿ value : <CocoaMQTT.CocoaMQTTMessage: 0x6000039c8ae0>

[HJianBo]

Hi, @halonsoluis Thanks for your focus to these problems and suggestion.

I think it may be caused by process condition for the shared memory.

The delivery & receiving mechanism is improving on the develop branch, it will be released at v1.3.0

[halonsoluis]

I did noticed another Thread (AsyncSocket lib related) stuck in an error reporting line. If this may be of help I may try to reproduce in the following hours.

[grangej]

For me I am getting this crash every time on calling connect()

I have tried 1.2.5 and now develop, both crash as soon as connect() is called, (1.1.3 is working but I am getting disconnects very frequently that 1.2.1 was supposed to solve) .

Any ideas?

[grangej]

Ok something very strange here, I had this happening on two different machines then I did a clean build and all of a sudden no more crash. Any ideas of the root cause here?

[jupe1]

Any news when this will be fixed? As this causes loads of crashes. Or maybe anyone knows which version doesn't have this issue?

By the way - 1.3.0-alpha.1 still has this issue

[HJianBo]

Hi, @jupe1 Any ideas to help me to reprodce it at v1.3.0-alpha.1?

[yycking]

@HJianBo I also reproduce this issue by Create CocoaMQTT x 100 and set delegateQueue = DispatchQueue.global(qos: .background)

I have no idea why sendingMessages does not found message from msgid