Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix hard to find crash in MLDelayableTimer
This crash seems to be a bug in a compiler optimization, releasing the MLDelayableTimer object and its ivars (like the _cancelHamdler block) and then trying to call the _cancelHandler ivar (which is nil at this point). I had to disassemble the Mach-O binary in our Monal.ipa release file using llvm-otool and use that disassembly together with the crash report to reconstruct what was happening. 000000000055057c mov x0, x19 0000000000550580 bl _objc_msgSend$invalidate 0000000000550584 mov x0, x19 0000000000550588 bl 0x564908 ; symbol stub for: _objc_sync_exit 000000000055058c mov x0, x19 0000000000550590 bl 0x56486c ; symbol stub for: _objc_release ; <-- unexpected ARC release of self in [MLDelayableTimer cancel] 0000000000550594 ldr x0, [x19, #0x10] ; <-- load of now zeroed _cancelHandler ivar that should point to an objc block 0000000000550598 ldr x2, [x0, #0x10] ; <-- crash while trying to access the pointer to the code inside our objc block (we try to access the invalid address 0x0000000000000010) 000000000055059c mov x1, x19 00000000005505a0 ldp x29, x30, [sp, #0x30] 00000000005505a4 ldp x20, x19, [sp, #0x20] 00000000005505a8 add sp, sp, #0x40 00000000005505ac br x2
- Loading branch information