[NSOperationBlock dealloc]崩溃问题排查技术问询

崩溃日志 #

Exception Type:  SIGSEGV
Exception Codes: SEGV_MAPERR at 0xf86985380
Crashed Thread:  4

Thread 4 Crashed:
0   libobjc.A.dylib                     0x000000018677b518 objc_release + 16
1   libobjc.A.dylib                     0x000000018677e21c objc_destructInstance + 80
2   libobjc.A.dylib                     0x00000001867879d0 _objc_rootDealloc + 80
3   MyApp                               0x0000000100060670 __destroy_helper_block_e8_32s40s48s56s (NSURLCache+Utils.m:0)
4   libsystem_blocks.dylib              0x00000001d9ce5124 _call_dispose_helpers_excp + 48
5   libsystem_blocks.dylib              0x00000001d9ce4d54 _Block_release + 252
6   Foundation                          0x000000018786f424 -[NSBlockOperation dealloc] + 76
7   libsystem_blocks.dylib              0x00000001d9ce6e2c bool HelperBase<GenericInline>::disposeCapture<(HelperBase<GenericInline>::BlockCaptureKind)3>(unsigned int, unsigned char*) + 68
8   libsystem_blocks.dylib              0x00000001d9ce5a98 HelperBase<GenericInline>::destroyBlock(Block_layout*, bool, unsigned char*) + 160
9   libsystem_blocks.dylib              0x00000001d9ce513c _call_dispose_helpers_excp + 72
10  libsystem_blocks.dylib              0x00000001d9ce4d54 _Block_release + 252
11  libdispatch.dylib                   0x0000000194846328 __destroy_helper_block_8_32c35_ZTS29dispatch_block_private_data_s + 96
12  libsystem_blocks.dylib              0x00000001d9ce5124 _call_dispose_helpers_excp + 48
13  libsystem_blocks.dylib              0x00000001d9ce4d54 _Block_release + 252
14  libdispatch.dylib                   0x0000000194845fdc _dispatch_client_callout + 20
15  libdispatch.dylib                   0x000000019484946c _dispatch_continuation_pop + 504
16  libdispatch.dylib                   0x0000000194848ad4 _dispatch_async_redirect_invoke + 584
17  libdispatch.dylib                   0x0000000194857a6c _dispatch_root_queue_drain + 396
18  libdispatch.dylib                   0x0000000194858284 _dispatch_worker_thread2 + 164
19  libsystem_pthread.dylib             0x00000001d9ce8dbc _pthread_wqthread + 228
20  libsystem_pthread.dylib             0x00000001d9ce8b98 start_wqthread + 8

问题背景与疑问 #

• 当前崩溃与旧案例类似，但场景存在差异：我的对象以强引用持有NSOperationQueue和NSOperationBlock属性。
• 对旧案例结论的困惑：若处于ARC环境，NSOperationQueue释放时为何会再次释放已释放的block？block难道不会自动拷贝到堆上吗？
• 当前案例的矛盾点：堆栈中唯一应用相关条目指向未使用的私有分类死代码，疑似野指针导致，但ARC环境下未错误传递对象地址，为何会出现野指针？该崩溃每日高频发生，但本地无法复现。
• 引用问题的疑问：应用中存在block直接使用self未配合weakify/strongify的情况，按常理这类错误应导致循环引用和内存泄漏，为何会引发崩溃？

内容的提问来源于stack exchange，提问作者Bill David