Apple Silicon设备通过Rosetta运行app出现runtime、dyld库神秘崩溃问题求助

问题特征 #

我们的应用在Apple Silicon设备上通过Rosetta转译运行时出现原因不明的崩溃，崩溃触发自苹果官方的runtime和dyld库，调用栈结构固定但无有效符号信息，具体特征如下：

• 所有崩溃均为5层栈帧的固定模式，最底层为dyld，上方4层均属于runtime，仅显示内存地址，无法识别调用的符号名称
• 偏移值有时一致有时不同，归类后至少存在两类栈，特征相近可判断为同一根因导致
• 崩溃日志中仅加载了上述两个库，推测是启动初期环境未完全初始化时崩溃，或崩溃发生时日志采集不全、出现了内存损坏
• 所有崩溃均发生在Apple Silicon设备上
• 覆盖macOS 11和macOS 12版本，可排除Monterey测试版的专属问题
• 崩溃均上报Code Signature Invalid原因，但该结论不可靠：根据收集的日志记录，崩溃后应用可正常启动运行

典型崩溃日志示例（应用相关信息已脱敏） #

Version:               ???
Code Type:             X86-64 (Translated)
Parent Process:        ??? [1]
User ID:               503

Date/Time:             2021-08-06 14:38:06.408 +0200
OS Version:            macOS 11.5.1 (20G80)
Report Version:        12

Time Awake Since Boot: 21000 seconds
Time Since Wake:       15000 seconds

System Integrity Protection: enabled

Crashed Thread:        0

Exception Type:        EXC_BAD_ACCESS (Code Signature Invalid)
Exception Codes:       0x0000000000000032, 0x0000000106675000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Reason:    Namespace CODESIGNING, Code 0x2

kernel messages:

VM Regions Near 0x106675000:
    VM_ALLOCATE (reserved)      106671000-106675000    [   16K] r--/r-- SM=NUL  reserved VM address space (unallocated)
--> mapped file                 106675000-107ff9000    [ 25.5M] r-x/rwx SM=COW  Object_id=695dd8f1
    mapped file                 107ff9000-107ffd000    [   16K] r-x/r-x SM=COW  Object_id=6aaf57f1

Thread 0 Crashed:
0   runtime                         0x00007ffdffe9ac40 0x7ffdffe96000 + 19520
1   runtime                         0x00007ffdffea3df4 0x7ffdffe96000 + 56820
2   runtime                         0x00007ffdffea35ec 0x7ffdffe96000 + 54764
3   runtime                         0x00007ffdffe9a440 0x7ffdffe96000 + 17472
4   dyld                            0x000000020683f000 0x20683f000 + 0

Thread 0 crashed with ARM Thread State (64-bit):
    x0: 0x0000000106675000   x1: 0x000000030d81b730   x2: 0x0000000000000218   x3: 0x0000000000000012
    x4: 0x0000000000000004   x5: 0x0000000001984000   x6: 0x0000000000000000   x7: 0x0000000000000a40
    x8: 0x0000000000000007   x9: 0x0000000000000012  x10: 0x0000000106675fff  x11: 0x0000000100000000
   x12: 0x0000000000000000  x13: 0x0000000000000000  x14: 0x0000000000000000  x15: 0x000007d900018601
   x16: 0x00000000000000c5  x17: 0x000000000220bef3  x18: 0x000000030d81b073  x19: 0x000000030d81b730
   x20: 0x000000030d81aa78  x21: 0x0000000106675000  x22: 0x0000000000000004  x23: 0x0000000106675000
   x24: 0x0000000000000003  x25: 0x0000000000000001  x26: 0x000000030d81ab90  x27: 0x000000020683f000
   x28: 0x000000030d823960   fp: 0x000000030d81aa20   lr: 0x00007ffdffea267c
    sp: 0x000000030d81a9b0   pc: 0x00007ffdffe9ac40 cpsr: 0x20000000
   far: 0x0000000106675000  esr: 0x92000006


Binary Images:
       0x20683f000 -        0x2068dafff  dyld (852.2) <57DB2053-BFD5-3683-97C6-F1DB2A1F1D09> /usr/lib/dyld
    0x7ffdffe96000 -     0x7ffdffec5fff  runtime (203.58) <52A2E5D0-FAA3-34EF-8BB7-07F73718C034> /usr/libexec/rosetta/runtime

External Modification Summary:
  Calls made by other processes targeting this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by all processes on this machine:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0

VM Region Summary:
ReadOnly portion of Libraries: Total=1048K resident=0K(0%) swapped_out_or_unallocated=1048K(100%)
Writable regions: Total=19.8M written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=19.8M(100%)
 
                                VIRTUAL   REGION 
REGION TYPE                        SIZE    COUNT (non-coalesced) 
===========                     =======  ======= 
STACK GUARD                       56.0M        1 
Stack                             8176K        1 
VM_ALLOCATE                       10.5M        1 
VM_ALLOCATE (reserved)            1132K        3         reserved VM address space (unallocated)
__DATA                             288K        4 
__DATA_CONST                        32K        1 
__LINKEDIT                         272K        4 
__TEXT                             816K        2 
mapped file                        4.8G       11 
===========                     =======  ======= 
TOTAL                              4.9G       28 
TOTAL, minus reserved VM space     4.9G       28 

排查思路与解决方案 #

优先排查项 #

• 检查应用签名完整性：确认应用包内所有二进制文件、内嵌框架、插件均使用同一开发者证书完成签名，避免签名不一致触发Rosetta的运行时校验失败。如果当前使用的是ad-hoc签名，尝试切换为正规开发者ID签名验证问题是否缓解。
• 核对Hardened Runtime权限配置：如果应用开启了Hardened Runtime，检查是否缺失Allow Unsigned Executable Memory、Allow JIT等和可执行内存相关的权限，Rosetta转译过程需要动态生成可执行代码，权限不足会偶发内存访问异常。
• 排查启动期非标准操作：确认应用是否在main函数执行前、动态链接未完成阶段有自定义的内存修改、注入逻辑，此类操作会干扰Rosetta runtime的初始化流程，触发内部崩溃。

规避方案 #

• 提供原生ARM架构构建包：直接发布支持Apple Silicon原生运行的应用版本，引导用户避开Rosetta转译环境，从根本上消除该类崩溃。
• 增加启动重试逻辑：由于该崩溃为偶发、且崩溃后二次启动可正常运行，可在应用外层增加崩溃检测逻辑，首次启动失败时自动重试启动。

系统侧问题反馈 #

该崩溃栈完全落在苹果官方的Rosetta runtime和dyld组件内部，且无应用侧符号，符合系统级缺陷的特征。可将崩溃日志通过苹果Feedback Assistant提交，等待官方后续系统更新修复。

内容的提问来源于stack exchange，提问作者LarryW