rnmapbox
[Bug]: Random crashes on iOS when using local ZXY tiles
Mapbox Implementation
Mapbox
Mapbox Version
11.8.0
React Native Version
0.76.0
Platform
iOS
@rnmapbox/maps version
10.1.33
Standalone component to reproduce
import React from 'react';
import {
MapView,
RasterSource,
RasterLayer,
Camera,
} from '@rnmapbox/maps';
class BugReportExample extends React.Component {
render() {
return (
<MapView style={{flex: 1}}>
<Camera centerCoordinate={[0,0]} zoomLevel={5} />
<RasterSource tileUrlTemplates={["any LOCAL ZXY path"]} tileSize={256}>
<RasterLayer
minZoomLevel={3}
maxZoomLevel={13}
/>
</RasterSource>
</MapView>
);
}
}
Observed behavior and steps to reproduce
- Run the app as many times possible and pan to load the tiles
- In very rare cases (3 per day in a production app with 5000 users), this stack trace will happen
OS Version: iOS 18.2 (22C152)
Report Version: 104
Exception Type: EXC_CRASH (SIGABRT)
Crashed Thread: 10 **(This thread number is random every time)**
Application Specific Information:
*** error for object %p: pointer being freed was not allocated
> MyAppName > MyAppName(1724,0x16be8b000) malloc: *** error for object 0x3007949e0: pointer being freed was not allocated
Thread 10 Crashed:
0 libsystem_kernel.dylib 0x3b825e2d4 __pthread_kill
1 libsystem_pthread.dylib 0x42aca059c pthread_kill
2 libsystem_c.dylib 0x32525bb08 abort
3 libsystem_malloc.dylib 0x3361f8bdc <redacted>
4 libsystem_malloc.dylib 0x3361f8850 <redacted>
5 libsystem_malloc.dylib 0x3361f5dc4 <redacted>
6 libcache.dylib 0x466b21a8c cache_set_name
7 CoreFoundation 0x3156deb88 <redacted>
8 CoreUI 0x352495184 <redacted>
9 CoreUI 0x352490320 <redacted>
10 CoreUI 0x3524ab560 <redacted>
11 CoreUI 0x3524ab414 <redacted>
12 CoreUI 0x3524ab2e4 <redacted>
13 CoreUI 0x3524ab124 <redacted>
14 UIKitCore 0x31aa9546c <redacted>
15 UIKitCore 0x31a6e148c <redacted>
16 UIKitCore 0x31a6deff0 <redacted>
17 UIKitCore 0x31aa94954 <redacted>
18 UIKitCore 0x31aa94820 <redacted>
19 UIKitCore 0x31a6ddc8c <redacted>
20 UIKitCore 0x31a6dd778 <redacted>
21 UIKitCore 0x31aa94db0 <redacted>
22 UIKitCore 0x31a82f8ec <redacted>
23 MyAppName 0x204658188 RCTImageFromLocalAssetURL (RCTUtils.m:864)
24 MyAppName 0x2047a9164 -[RCTBundleAssetImageLoader loadImageForURL:size:scale:resizeMode:progressHandler:partialLoadHandler:completionHandler:] (RCTBundleAssetImageLoader.mm:52)
25 MyAppName 0x2047acc94 -[RCTImageLoader _loadImageOrDataWithURLRequest:size:scale:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:561)
26 MyAppName 0x2047aebe4 -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:841)
27 MyAppName 0x2047ac090 -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:373)
28 MyAppName 0x2047abf88 -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:352)
29 MyAppName 0x204b3b67c RNMBXImageQueueOperation.start (RNMBXImageQueue.swift:72)
30 MyAppName 0x20450af68 thunk for closure
31 libdispatch.dylib 0x32515a248 <redacted>
32 libdispatch.dylib 0x32515bfa8 <redacted>
33 libdispatch.dylib 0x32515f0f4 <redacted>
34 libdispatch.dylib 0x32516dec0 <redacted>
35 libdispatch.dylib 0x32516e6c4 <redacted>
36 libsystem_pthread.dylib 0x42ac9b644 _pthread_wqthread
Thread 0
0 MapboxCoreMaps 0x105d871c4 mbgl::FillLayerFactory::getTypeInfo
1 MapboxCoreMaps 0x105cf7b94 mbgl::LayerManagerDefault::addLayerType
2 MapboxCoreMaps 0x105cf7664 mbgl::LayerManagerDefault::LayerManagerDefault
3 MapboxCoreMaps 0x106023fe4 mbgl::style::conversion::Converter<T>::operator()
4 MapboxCoreMaps 0x105c92e14 mapbox::maps::StyleManagerImpl::addStyleLayer
5 MapboxCoreMaps 0x105c1eb54 mapbox::maps::StyleManager::addPersistentStyleLayer
6 MapboxCoreMaps 0x105be1acc -[MBMStyleManager addPersistentStyleLayerForProperties:layerPosition:]
7 MapboxMaps 0x10716f9c0 MBMStyleManager
8 MapboxMaps 0x107166ee0 StyleManager.addPersistentLayer
9 MapboxMaps 0x10716b6bc handleExpected<T>
10 MapboxMaps 0x1071620c8 StyleManager.addLayer
11 MapboxMaps 0x107161f90 StyleManager.addPersistentLayer
12 MapboxMaps 0x1071686c8 StyleManager
13 MapboxMaps 0x1070dd418 AnnotationManagerImpl.init (AnnotationManagerImpl.swift:135)
14 MapboxMaps 0x1070c8acc PointAnnotationManager.init
15 MapboxMaps 0x106ea36b8 [inlined] PointAnnotationManager.init
16 MapboxMaps 0x106ea36b8 [inlined] PointAnnotationManager.__allocating_init (PointAnnotationManager.swift:36)
17 MapboxMaps 0x106ea36b8 [inlined] PointAnnotationManager (<compiler-generated>:30)
18 MapboxMaps 0x106ea36b8 AnnotationOrchestrator.make<T> (AnnotationOrchestrator.swift:154)
19 MapboxMaps 0x106ea21c8 [inlined] AnnotationOrchestrator.make<T>
20 MapboxMaps 0x106ea21c8 AnnotationOrchestrator.makePointAnnotationManager (AnnotationOrchestrator.swift:104)
21 MyAppName 0x204b6d98c RNMBXPointAnnotationManager.init (RNMBXMapView.swift:1594)
22 MyAppName 0x204b598d4 [inlined] RNMBXPointAnnotationManager.init
23 MyAppName 0x204b598d4 [inlined] RNMBXPointAnnotationManager.__allocating_init (RNMBXMapView.swift:1597)
24 MyAppName 0x204b598d4 [inlined] RNMBXMapView.pointAnnotationManager.getter (RNMBXMapView.swift:201)
25 MyAppName 0x204b598d4 RNMBXMapView.pointAnnotationManager.getter (RNMBXMapView.swift:200)
26 MyAppName 0x204b5ba04 RNMBXMapView.applyOnPress (RNMBXMapView.swift:1169)
27 MyAppName 0x204b5b328 RNMBXMapView.Property.apply (RNMBXMapView.swift:383)
28 MyAppName 0x204b740d0 [inlined] thunk for closure
29 MyAppName 0x204b740d0 thunk for closure
30 MyAppName 0x204b74470 thunk for closure
31 MyAppName 0x204b742f4 [inlined] thunk for closure
32 MyAppName 0x204b742f4 thunk for closure
33 MyAppName 0x204b742c0 [inlined] PropertyChanges.apply (PropertyChanges.swift:53)
34 MyAppName 0x204b742c0 [inlined] PropertyChanges.apply
35 MyAppName 0x204b742c0 PropertyChanges.apply
36 MyAppName 0x204b6d7d4 [inlined] thunk for closure
37 MyAppName 0x204b6d7d4 [inlined] thunk for closure
38 MyAppName 0x204b6d7d4 Sequence.forEach
39 MyAppName 0x204b6f3fc [inlined] Sequence.forEach
40 MyAppName 0x204b6f3fc [inlined] PropertyChanges.apply (PropertyChanges.swift:52)
41 MyAppName 0x204b6f3fc RNMBXMapView.didSetProps (RNMBXMapView.swift:752)
42 MyAppName 0x204b5fbf4 [inlined] RNMBXMapView.didSetProps
43 MyAppName 0x204b5fbf4 RNMBXMapView.didSetProps (<compiler-generated>:746)
44 MyAppName 0x204652714 __45-[RCTUIManager _dispatchPropsDidChangeEvents]_block_invoke (RCTUIManager.m:1263)
45 MyAppName 0x204651eac __44-[RCTUIManager flushUIBlocksWithCompletion:]_block_invoke (RCTUIManager.m:1162)
46 MyAppName 0x204651fb0 __44-[RCTUIManager flushUIBlocksWithCompletion:]_block_invoke.144 (RCTUIManager.m:1182)
47 libdispatch.dylib 0x32515a248 <redacted>
48 libdispatch.dylib 0x32515bfa8 <redacted>
49 libdispatch.dylib 0x32516aa34 <redacted>
50 libdispatch.dylib 0x32516a64c _dispatch_main_queue_callback_4CF
51 CoreFoundation 0x315679bbc <redacted>
52 CoreFoundation 0x3156761b0 <redacted>
53 CoreFoundation 0x3156c8274 CFRunLoopRunSpecific
54 GraphicsServices 0x3afa214c0 GSEventRunModal
55 UIKitCore 0x31aa2677c <redacted>
56 UIKitCore 0x31a64ce64 UIApplicationMain
57 MyAppName 0x2044f01f0 main (main.m:8)
58 <unknown> 0x1b8cfcde8 <redacted>
Thread 1
0 libsystem_kernel.dylib 0x3b825359c __ulock_wait2
1 libsystem_platform.dylib 0x42ab41d9c <redacted>
2 UIKitCore 0x31a6dd6c0 <redacted>
3 UIKitCore 0x31a82f844 <redacted>
4 MyAppName 0x204658188 RCTImageFromLocalAssetURL (RCTUtils.m:864)
5 MyAppName 0x2047a9164 -[RCTBundleAssetImageLoader loadImageForURL:size:scale:resizeMode:progressHandler:partialLoadHandler:completionHandler:] (RCTBundleAssetImageLoader.mm:52)
6 MyAppName 0x2047acc94 -[RCTImageLoader _loadImageOrDataWithURLRequest:size:scale:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:561)
7 MyAppName 0x2047aebe4 -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:841)
8 MyAppName 0x2047ac090 -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:373)
9 MyAppName 0x2047abf88 -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:352)
10 MyAppName 0x204b3b67c RNMBXImageQueueOperation.start (RNMBXImageQueue.swift:72)
11 MyAppName 0x20450af68 thunk for closure
12 libdispatch.dylib 0x32515a248 <redacted>
13 libdispatch.dylib 0x32515bfa8 <redacted>
14 libdispatch.dylib 0x32515f0f4 <redacted>
15 libdispatch.dylib 0x32516dec0 <redacted>
16 libdispatch.dylib 0x32516e6c4 <redacted>
17 libsystem_pthread.dylib 0x42ac9b644 _pthread_wqthread
Thread 2
...
<More 82 threads like Thread 1, all starting with RNMBXImageQueueOperation.start (RNMBXImageQueue.swift:72) and crashing on RCTImageFromLocalAssetURL (RCTUtils.m:864)>
Expected behavior
App not crashing randomly
Notes / preliminary analysis
The traces shows Mapbox running 82 threads of image loading.
Randomly, some thread crash, starting on this call:
RNMBXImageQueueOperation.start (RNMBXImageQueue.swift:72)
and crashing on this call
RCTImageFromLocalAssetURL (RCTUtils.m:864)
Those crashs are rare (2 per day on a production app with 5000 users) and is very possible it is a race condition.
Additional links and references
No response
Hi, I'm experiencing the same issue.
About 5 crashes per day on a production app with 5k daily users.
A few differences though:
- Mapbox Version : 10.18.2
- React Native Version : 0.76.6
- @rnmapbox/maps version : 10.1.34
Hope this helps.
Hello, I’m experiencing the same crash too.
*** error for object %p: pointer being freed was not allocated > mobile > mobile(23538,0x16ba4f000) malloc: *** error for object 0x112cf7620: pointer being freed was not allocated
My setup:
@rnmapbox/maps: 10.1.38 react-native: 0.76.9
It happens in production for about 2% of our users.
Not sure if anyone got a fix on this but I was searching around and noticed there is a bug posed in the RN github as well https://github.com/facebook/react-native/issues/54015. Looking at the stack trace I wasn't really sure what is actually being freed. It was only reproducible on a release build since the crash happened on RCTBundleAssetImageLoader. On debug this loader is not being used
This code is not thread safe:
https://github.com/facebook/react-native/blob/6d7a93f2b15dd275a4622625aef089e934a1a8dd/packages/react-native/React/Base/RCTUtils.mm#L853-L872
But RCTImageLoader is, so this seems to be a similar race condition to https://github.com/facebook/react-native/issues/46115
This code is not thread safe:
https://github.com/facebook/react-native/blob/6d7a93f2b15dd275a4622625aef089e934a1a8dd/packages/react-native/React/Base/RCTUtils.mm#L853-L872
But RCTImageLoader is, so this seems to be a similar race condition to facebook/react-native#46115
Interesting, the code you referenced point to bundleForPath just doing some debugging, I'm loading an image with url looks something like this MyApp.app/assets/application/modules/mapping/assets/Icon.png. Based on the crash report the method that crashed is RCTImageFromLocalAssetURL. With my code, the bundleForPath method never gets called.
UIImage *__nullable RCTImageFromLocalAssetURL(NSURL *imageURL)
{
NSString *imageName = RCTBundlePathForURL(imageURL);
NSBundle *bundle = nil;
NSArray *imagePathComponents = [imageName pathComponents];
if ([imagePathComponents count] > 1 &&
[[[imagePathComponents firstObject] pathExtension] isEqualToString:@"bundle"]) { <-- evaluate to false
NSString *bundlePath = [imagePathComponents firstObject];
bundle = bundleForPath([bundlePath stringByDeletingPathExtension]);
imageName = [imageName substringFromIndex:(bundlePath.length + 1)];
}
UIImage *image = nil;
if (imageName) {
if (bundle) {
image = [UIImage imageNamed:imageName inBundle:bundle compatibleWithTraitCollection:nil];
} else {
image = [UIImage imageNamed:imageName]; <-- here is the start of the OS level code and crash
}
}
.....
return image;
}
@yliu342 yes good point.
https://github.com/facebook/react-native/blob/v0.76.0/packages/react-native/React/Base/RCTUtils.m#L864 which in in the original stack trace is also [UIImage imageNamed:imageName] but it's documented to be thread safe, since ios9:
https://developer.apple.com/documentation/uikit/uiimage/init(named:)?language=objc
In iOS 9 and later, this method is thread safe.
original stack trace is also [UIImage imageNamed:imageName]
Do you mean https://github.com/facebook/react-native/issues/46115 ticket? Looking closely at this, One crash I was able to reproduce with reproduce is and Customer is observing a different crash are two different crash. The one you are experiencing is looping through an array and while looping through it the array got changed. the customer one is what being reported here and what we are experiencing.
RN has put a lock on the setup to ensure the dispatch queue can't get modified while running the setup function which fixes your issue but I believe it is different from the one in here.
In iOS 9 and later, this method is thread safe.
Yes the apple doc does say it is thread safe and I'm 100% agree since my background is writing native iOS code. My guess at this point is something along device running out of memory. If device is under memory pressure and then calling [UIImage imageNamed:imageName] then there might be some issue with the cache that comes with [UIImage imageNamed:imageName] method?
I think we just had a similar crash on app start.
- Production build
- Platform: iOS 18.6.2
- RN Version: 0.81.4
- @rnmapbox/maps Version: 10.1.45
Stacktrace:
EXC_BREAKPOINT: kCGImageProviderBitmapInfo
libsystem_malloc 0x1aed0b020 _xzm_xzone_malloc_tiny_outlined
CoreGraphics 0x1a07a74a8 CGPropertiesCreate
CoreGraphics 0x1a07a74a8 CGPropertiesCreate
CoreGraphics 0x1a07a7714 CGImageProviderSetProperty
ImageIO 0x1a413aa98 IIOImagePlus::setImageBlockProc
ImageIO 0x1a4153380 IIOReadPlugin::setupImageProviderCallbackV1
ImageIO 0x1a41532b8 IIOReadPlugin::setupCallback
ImageIO 0x1a413d57c IIOReadPlugin::postInitialize
ImageIO 0x1a41382d4 IIOReadPlugin::callInitialize
ImageIO 0x1a4137784 IIO_Reader::initImageAtOffset
ImageIO 0x1a4134504 IIOImageSource::makeImagePlus
ImageIO 0x1a413e354 IIOImageSource::getPropertiesAtIndexInternal
ImageIO 0x1a413e270 IIOImageSource::copyPropertiesAtIndex
ImageIO 0x1a413d244 CGImageSourceCopyPropertiesAtIndex
UIKitCore 0x1a1008254 _UIImageGetOrientationAndScale
UIKitCore 0x1a1147654 ImageSourceAtPath
UIKitCore 0x1a1143ae4 GetImageAtPath
UIKitCore 0x1a11437e8 -[_UIPathLazyImageAsset imageWithConfiguration:]
UIKitCore 0x1a10741d4 +[UIImage imageNamed:inBundle:withConfiguration:]
React 0x1080f949c RCTImageFromLocalAssetURL
React 0x10831ab50 -[RCTBundleAssetImageLoader loadImageForURL:size:scale:resizeMode:progressHandler:partialLoadHandler:completionHandler:]
React 0x10831f618 RCTLoadImageURLFromLoader
React 0x10831e8e8 -[RCTImageLoader _loadImageOrDataWithURLRequest:size:scale:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:]
React 0x108320b90 -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:]
React 0x10831dc30 -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:progressBlock:partialLoadBlock:completionBlock:]
React 0x10831db28 -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:progressBlock:partialLoadBlock:completionBlock:]
IONDev 0x1055458ac closure in RNMBXImageQueueOperation.start
IONDev 0x1045f63bc thunk for closure
libdispatch 0x1a6606aa8 _dispatch_call_block_and_release
libdispatch 0x1a6620580 _dispatch_client_callout
libdispatch 0x1a663c2ac _dispatch_queue_override_invoke.cold.3
libdispatch 0x1a660b1f4 _dispatch_queue_override_invoke
libdispatch 0x1a6618dac _dispatch_root_queue_drain
libdispatch 0x1a6619548 _dispatch_worker_thread2
libsystem_pthread 0x228b249cc _pthread_wqthread
libsystem_malloc 0x1aed0b020 _xzm_xzone_malloc_tiny_outlined
CoreGraphics 0x1a07a74a8 CGPropertiesCreate
CoreGraphics 0x1a07a74a8 CGPropertiesCreate
CoreGraphics 0x1a07a7714 CGImageProviderSetProperty
ImageIO 0x1a413aa98 IIOImagePlus::setImageBlockProc
ImageIO 0x1a4153380 IIOReadPlugin::setupImageProviderCallbackV1
ImageIO 0x1a41532b8 IIOReadPlugin::setupCallback
ImageIO 0x1a413d57c IIOReadPlugin::postInitialize
ImageIO 0x1a41382d4 IIOReadPlugin::callInitialize
ImageIO 0x1a4137784 IIO_Reader::initImageAtOffset
ImageIO 0x1a4134504 IIOImageSource::makeImagePlus
ImageIO 0x1a413e354 IIOImageSource::getPropertiesAtIndexInternal
ImageIO 0x1a413e270 IIOImageSource::copyPropertiesAtIndex
ImageIO 0x1a413d244 CGImageSourceCopyPropertiesAtIndex
UIKitCore 0x1a1008254 _UIImageGetOrientationAndScale
UIKitCore 0x1a1147654 ImageSourceAtPath
UIKitCore 0x1a1143ae4 GetImageAtPath
UIKitCore 0x1a11437e8 -[_UIPathLazyImageAsset imageWithConfiguration:]
UIKitCore 0x1a10741d4 +[UIImage imageNamed:inBundle:withConfiguration:]
React 0x1080f949c RCTImageFromLocalAssetURL
React 0x10831ab50 -[RCTBundleAssetImageLoader loadImageForURL:size:scale:resizeMode:progressHandler:partialLoadHandler:completionHandler:]
React 0x10831f618 RCTLoadImageURLFromLoader
React 0x10831e8e8 -[RCTImageLoader _loadImageOrDataWithURLRequest:size:scale:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:]
React 0x108320b90 -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:]
React 0x10831dc30 -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:progressBlock:partialLoadBlock:completionBlock:]
React 0x10831db28 -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:progressBlock:partialLoadBlock:completionBlock:]
IONDev 0x1055458ac closure in RNMBXImageQueueOperation.start
IONDev 0x1045f63bc thunk for closure
libdispatch 0x1a6606aa8 _dispatch_call_block_and_release
libdispatch 0x1a6620580 _dispatch_client_callout
libdispatch 0x1a663c2ac _dispatch_queue_override_invoke.cold.3
libdispatch 0x1a660b1f4 _dispatch_queue_override_invoke
libdispatch 0x1a6618dac _dispatch_root_queue_drain
libdispatch 0x1a6619548 _dispatch_worker_thread2
libsystem_pthread 0x228b249cc _pthread_wqthread
