IOS应用EXC_BAD_ACCESS(SIGSEGV)崩溃问题排查求助

近期通过管理后台收到用户反馈应用冷启动时出现崩溃，崩溃日志如下：

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000010
Exception Codes: 0x0000000000000001, 0x0000000000000010
VM Region Info: 0x10 is not in any region.  Bytes before following region: 68719476720
      REGION TYPE                 START - END      [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      UNUSED SPACE AT START
--->  
      commpage (reserved)     1000000000-7000000000 [384.0G] ---/--- SM=NUL  ...(unallocated)
Triggered by Thread:  0


Kernel Triage:
VM - pmap_enter retried due to resource shortage
VM - pmap_enter retried due to resource shortage
VM - pmap_enter retried due to resource shortage
VM - pmap_enter retried due to resource shortage
VM - pmap_enter retried due to resource shortage


Thread 0 name:
Thread 0 Crashed:
0   libobjc.A.dylib                 0x00000001d30f9c20 objc_msgSend + 32 (:-1)
1   UIKitCore                       0x00000001dc192224 -[UIViewController dealloc] + 768 (UIViewController.m:3098)
2   UIKitCore                       0x00000001dc18fdf8 -[UINavigationController dealloc] + 308 (UINavigationController.m:774)
3   libobjc.A.dylib                 0x00000001d30f95d8 AutoreleasePoolPage::releaseUntil(objc_object**) + 196 (NSObject.mm:938)
4   libobjc.A.dylib                 0x00000001d30fcf80 objc_autoreleasePoolPop + 256 (NSObject.mm:1208)
5   UIKitCore                       0x00000001dc192340 -[UIViewController dealloc] + 1052 (UIViewController.m:3128)
6   UIKitCore                       0x00000001dc18fdf8 -[UINavigationController dealloc] + 308 (UINavigationController.m:774)
7   libobjc.A.dylib                 0x00000001d30f95d8 AutoreleasePoolPage::releaseUntil(objc_object**) + 196 (NSObject.mm:938)
8   libobjc.A.dylib                 0x00000001d30fcf80 objc_autoreleasePoolPop + 256 (NSObject.mm:1208)
9   CoreFoundation                  0x00000001d9e4e764 _CFAutoreleasePoolPop + 32 (NSObject.m:793)
10  CoreFoundation                  0x00000001d9e4c4b8 __CFRunLoopPerCalloutARPEnd + 48 (CFRunLoop.c:746)
11  CoreFoundation                  0x00000001d9e4c080 __CFRunLoopRun + 2076 (CFRunLoop.c:3149)
12  CoreFoundation                  0x00000001d9e50ed4 CFRunLoopRunSpecific + 612 (CFRunLoop.c:3418)
13  GraphicsServices                0x0000000213152368 GSEventRunModal + 164 (GSEvent.c:2196)
14  UIKitCore                       0x00000001dc32f3d0 -[UIApplication _run] + 888 (UIApplication.m:3745)
15  UIKitCore                       0x00000001dc32f034 UIApplicationMain + 340 (UIApplication.m:5335)
16  AppIOS                          0x000000010546defc main + 68 (AppDelegate.swift:21)
17  dyld                            0x00000001f84b8960 start + 2528 (dyldMain.cpp:1170)


Thread 0 crashed with ARM Thread State (64-bit):
    x0: 0x00000001120ac600   x1: 0x00000001d5cacf78   x2: 0x0000000112910400   x3: 0x000000016ae5a268
    x4: 0x0000000000000010   x5: 0x0000000111f5d290   x6: 0x0000000000000020   x7: 0x0000000000000000
    x8: 0x0000000280568de0   x9: 0x0000000000000000  x10: 0x6ae10001120ac600  x11: 0x000000000000001f
   x12: 0x0000000000984000  x13: 0x0000000111f42fe0  x14: 0x0000000000000000  x15: 0x0000000000000000
   x16: 0x0000000000000000  x17: 0x0000000235516f30  x18: 0x0000000000000000  x19: 0x0000000112910400
   x20: 0x00000001128096c8  x21: 0x0000000280568de0  x22: 0x0000000000000050  x23: 0x00000000000001b8
   x24: 0x000000022d863000  x25: 0x0000000100000002  x26: 0x0000000000000050  x27: 0x0000000000000001
   x28: 0x0000000283eb1210   fp: 0x000000016ae5a3c0   lr: 0x00000001dc192224
    sp: 0x000000016ae5a1a0   pc: 0x00000001d30f9c20 cpsr: 0x20000000
   esr: 0x56000080  Address size fault

相关代码 #

根视图控制器初始化代码 #

class AppDelegate: UIResponder, UIApplicationDelegate {

//...//

 var window: UIWindow?

 func application(
        _ application: UIApplication,
        didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?
    ) -> Bool {
    createRootVC()
}

private func createRootVC() {
        self.window = UIWindow(frame: UIScreen.main.bounds)
        let mainView = Main_V2()
        let navigation = RootNavigationController(rootViewController: mainView)
        self.window?.rootViewController = navigation
        self.window?.makeKeyAndVisible()
    }

//..//

}

应用重启代码 #

private func restartApp() {
        let mainView = Main_V2()
        let navigation = RootNavigationController(rootViewController: mainView)
        // Get current Window with RootViewController
        guard
            let window = UIApplication.shared.keyWindow,
            let rootVC = window.rootViewController
        else {
            createRootVC()
            return
        }
        // Change frame of current root frame
        navigation.view.frame = rootVC.view.frame
        navigation.view.layoutIfNeeded()
        
        // Clear All
        window.rootViewController = nil
        
        // Animate transition new rootViewController
        UIView.transition(with: window, duration: 0.2, options: .transitionCrossDissolve) {
            window.rootViewController = navigation
        }
    }

已知信息 #

• 崩溃发生在首次冷启动阶段，后台重启逻辑暂不相关
• Main_V2作为启动页，发起网络请求后跳转至下一页面，随后会从导航控制器栈中移除
• 无法复现该问题，即使开启AddressSanitizer和ZombieObject扫描也无法触发
• 调试符号缺失UIKit的dSYM文件，无法通过atos命令进一步解析UIKit内部调用细节

排查方向分析 #

• 野指针/僵尸对象访问：崩溃栈显示在视图控制器dealloc阶段触发objc_msgSend，推测是某个已释放的对象被UIKit内部代码引用。检查Main_V2或RootNavigationController中是否有未正确管理的引用（比如闭包循环引用、手动内存管理对象提前释放）。
• 内存资源不足：Kernel Triage中多次出现pmap_enter retried due to resource shortage，说明设备内存紧张。冷启动时内存压力可能导致UIKit内部对象被提前释放，后续代码仍尝试访问。
• 导航栈操作隐患：检查Main_V2被移除出导航栈的逻辑，是否未清理关联的观察者、代理对象，导致这些对象释放后被UIKitdealloc流程意外访问。
• 自定义NavigationController问题：若RootNavigationController重写了dealloc或生命周期方法，确认是否有不当操作（比如提前释放父类依赖对象）导致父类释放时出错。
• 冷启动时序冲突：检查Main_V2生命周期方法中是否有异步操作（如网络请求）与视图控制器生命周期冲突，导致对象生命周期紊乱。

内容的提问来源于stack exchange，提问作者Сергей Верховский