iOS 支付调转支付宝web页后点击返回后web页没有销毁,造成app 野指针崩溃

[Alexiuce]

1. 手机上未安装支付宝应用.
2. 调用Ping++ 支付时选支付宝方式后跳转到一个支付宝Html的页面.
3. 在该页面不进行任何支付,点击返回
4. 在其他页面调用键盘输入时,由于HTML页面造成的内存野指针导致崩溃.

[samurai00]

因为这个页面是支付宝的 SDK 实现的，我们的代码没有这些实际的操作。简单的页面测试也没有复现出这种崩溃。
要不你贴一下具体的报错信息，还有机器以及系统版本。

[Alexiuce]

thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BREAKPOINT (code=1, subcode=0x186628a48)
frame #0: 0x0000000186628a48 CoreFoundation___forwarding___ + 1180 frame #1: 0x000000018650dccc CoreFoundation_CF_forwarding_prep_0 + 92
frame #2: 0x000000018fdd5fa8 UIKit-[_UIWebViewScrollViewDelegateForwarder respondsToSelector:] + 92 frame #3: 0x000000018fc2bfb0 UIKit-[UIScrollView _getDelegateZoomView] + 92
frame #4: 0x000000018fc2be60 UIKit-[UIScrollView _zoomScaleFromPresentationLayer:] + 44 frame #5: 0x000000018fc2be10 UIKit-[UIWebDocumentView _zoomedDocumentScale] + 56
frame #6: 0x000000018fc2ba48 UIKit-[UIWebDocumentView _layoutRectForFixedPositionObjects] + 104 frame #7: 0x000000018fc2b8c4 UIKit-[UIWebDocumentView _updateFixedPositionedObjectsLayoutRectUsingWebThread:synchronize:] + 60
frame #8: 0x000000018fc2dc20 UIKit-[UIWebDocumentView _updateFixedPositioningObjectsLayoutAfterScroll] + 36 frame #9: 0x000000018fc2dbf0 UIKit-[UIWebBrowserView _updateFixedPositioningObjectsLayoutAfterScroll] + 60
frame #10: 0x00000001865b513c CoreFoundation__CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 20 frame #11: 0x00000001865b46dc CoreFoundation_CFXRegistrationPost + 420
frame #12: 0x00000001865b4440 CoreFoundation___CFXNotificationPost_block_invoke + 60 frame #13: 0x0000000186631e24 CoreFoundation-[_CFXNotificationRegistrar find:object:observer:enumerator:] + 1408
frame #14: 0x00000001864ead60 CoreFoundation_CFXNotificationPost + 380 frame #15: 0x0000000186f17348 Foundation-[NSNotificationCenter postNotificationName:object:userInfo:] + 68
frame #16: 0x000000019079ed38 UIKit-[UIInputWindowController postEndNotifications:withInfo:] + 1660 frame #17: 0x00000001907a1f54 UIKit__77-[UIInputWindowController moveFromPlacement:toPlacement:starting:completion:]_block_invoke_2.1098 + 100
frame #18: 0x000000019079960c UIKit-[UIInputWindowController performWithSafeTransitionFrames:] + 220 frame #19: 0x00000001907a1d1c UIKit__77-[UIInputWindowController moveFromPlacement:toPlacement:starting:completion:]_block_invoke.1089 + 1180
frame #20: 0x000000018fc16188 UIKit-[UIViewAnimationBlockDelegate _didEndBlockAnimation:finished:context:] + 764 frame #21: 0x000000018fc15afc UIKit-[UIViewAnimationState sendDelegateAnimationDidStop:finished:] + 312
frame #22: 0x000000018fc15808 UIKit-[UIViewAnimationState animationDidStop:finished:] + 296 frame #23: 0x000000018a676dc4 QuartzCoreCA::Layer::run_animation_callbacks(void*) + 284
frame #24: 0x0000000108b3d1f8 libclang_rt.asan_ios_dynamic.dylibasan_dispatch_call_block_and_release + 308 frame #25: 0x000000010a36528c libdispatch.dylib_dispatch_client_callout + 16
frame #26: 0x000000010a369ea0 libdispatch.dylib_dispatch_main_queue_callback_4CF + 1196 frame #27: 0x00000001865cb344 CoreFoundationCFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE + 12
frame #28: 0x00000001865c8f20 CoreFoundation__CFRunLoopRun + 2012 frame #29: 0x00000001864e8c58 CoreFoundationCFRunLoopRunSpecific + 436
frame #30: 0x0000000188394f84 GraphicsServicesGSEventRunModal + 100 frame #31: 0x000000018fc415c4 UIKitUIApplicationMain + 236

• frame swift项目使用cocoapods安装Pingpp，import的时候报错：No such module #32: 0x0000000104f10244 Flashfishmain(argc=1, argv=0x000000016b983780) at main.m:14 frame #33: 0x000000018600856c libdyld.dylibstart + 4

---

1. 上面是崩溃时的系统调用栈信息

2. 每次操作都会出现(Bug 100%复现)

3. 调用代码类似如下:
   [Pingpp createPayment:payMent
   viewController:self
   appURLScheme:payScheme
   withCompletion:^(NSString *result, PingppError *error) {
   if ([result isEqualToString:@"success"]) {
   // 支付成功
   NSLog(@"支付成功");
   } else {
   // 支付失败或取消
   NSLog(@"PingppError.code = %@",@(error.code));

          }
      }];
   

4. 每次调用时跳转支付宝web页面时会支付宝创建APayWapPayViewController ,但返回时没有释放,造成野指针问题.

[samurai00]

• 模拟器上可以复现吗？
• 是在主线程调用的 [Pingpp createPayment:...] 吗？
• 如果不是模拟器，那么是什么机型和系统版本号呢？

[Alexiuce]

1. 没有使用模拟器,全部是真机,机型包括iphone6,6S, iphoneX
2. 发起调用是在主线程进行的,调用时打印线程结果<NSThread: 0x15190fb00>{number = 1, name = main}
   3.机型的系统版本为iOS 11.2.5
3. 必现的情况是从支付页面返回后,在其他页面有键盘输入时才会触发这个Bug,若无键盘操作,则正常.

[Alexiuce]

Ping++ 的使用版本是2.2.0

[samurai00]

还是没法重现，虽然 iOS 版本不太一样(11.4)，但应该不影响。你试试我们的 example 里的项目，能不能重现这个问题。

[Alexiuce]

经过底层排查,结果发现是webView与NSArray中的运行时获取objectAtIndex方法时造成崩溃...问题已解决~.