Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[iOS] Crash in [RCTModuleData setUpMethodQueue] #9334

Closed
ghost opened this issue Aug 10, 2016 · 37 comments
Closed

[iOS] Crash in [RCTModuleData setUpMethodQueue] #9334

ghost opened this issue Aug 10, 2016 · 37 comments
Assignees
Labels
Platform: iOS iOS applications. Ran Commands One of our bots successfully processed a command. Resolution: Locked This issue was locked by the bot.

Comments

@ghost
Copy link

ghost commented Aug 10, 2016

I'm looking for a squashing bug in an iOS app that I can't work out/reproduce. I am getting a logged error of
Selector name found in current argument registers: retain

This only seems to happen on iOS devices with 9.3
(Currently one of our top crashes in our application)

Log file for crash:

Thread 19 Crashed:
0   libdispatch.dylib                    0x0000000181c02534 _os_object_retain + 72
1   libobjc.A.dylib                      0x0000000181834128 objc_storeStrong + 40
2   libobjc.A.dylib                      0x000000018181a908 object_setIvar + 272
3   Foundation                           0x0000000182ac36e4 -[NSObject(NSKeyValueCoding) setValue:forKey:] + 264
4   myapp                              0x00000001007a4908 -[RCTModuleData setUpMethodQueue] (RCTModuleData.m:186)
5   myapp                              0x00000001007a43f8 -[RCTModuleData setUpInstanceAndBridge] (RCTModuleData.m:120)
6   myapp                              0x00000001007a4a6c -[RCTModuleData instance] (RCTModuleData.m:222)
7   myapp                              0x000000010079e2b4 -[RCTBatchedBridge moduleForName:] (RCTBatchedBridge.m:216)
8   myapp                              0x00000001007b4660 -[RCTBridge moduleForClass:] (RCTBridge.m:199)
9   myapp                              0x000000010074e254 __100-[RCTImageLoader loadImageOrDataWithURLRequest:size:scale:resizeMode:progressBlock:completionBlock:]_block_invoke.142 (RCTImageLoader.m:415)
10  libdispatch.dylib                    0x0000000181c014bc _dispatch_call_block_and_release + 20
11  libdispatch.dylib                    0x0000000181c0147c _dispatch_client_callout + 12
12  libdispatch.dylib                    0x0000000181c0d4c0 _dispatch_queue_drain + 860
13  libdispatch.dylib                    0x0000000181c04f80 _dispatch_queue_invoke + 460
14  libdispatch.dylib                    0x0000000181c0147c _dispatch_client_callout + 12
15  libdispatch.dylib                    0x0000000181c0f914 _dispatch_root_queue_drain + 2136
16  libdispatch.dylib                    0x0000000181c0f0b0 _dispatch_worker_thread3 + 108
17  libsystem_pthread.dylib              0x0000000181e19470 _pthread_wqthread + 1088
18  libsystem_pthread.dylib              0x0000000181e19020 start_wqthread + 0
@joshuafeldman
Copy link

We are seeing this same crash in our reporting tool. It is currently the top crash in our application. We have not been able to figure out how to reproduce it but an interesting thing in the log is API MISUSE: Resurrection of an object. Not sure if that helps...

@basketofsoftkittens
Copy link

@Damir46 what version of react native are you on?

@conover
Copy link

conover commented Aug 15, 2016

For us, this crash occurs in the context of the RCTImageLoader. And it has the same API MISUSE: Resurrection of an object message. This is on React-Native .30. Here is the stack trace:

Crashed: com.facebook.react.ImageLoaderURLCacheQueue
0 libdispatch.dylib 0x1831f6534 _os_object_retain + 72
1 libobjc.A.dylib 0x182e28128 objc_storeStrong + 44
2 libobjc.A.dylib 0x182e0e908 object_setIvar + 276
3 Foundation 0x1840b76e4 -[NSObject(NSKeyValueCoding) setValue:forKey:] + 268
4 Curse 0x1001223e8 -[RCTModuleData setUpMethodQueue] + 4296369128
5 Curse 0x100121ed8 -[RCTModuleData setUpInstanceAndBridge] + 4296367832
6 Curse 0x10012254c -[RCTModuleData instance] + 4296369484
7 Curse 0x10011b850 -[RCTBatchedBridge moduleForName:] + 4296341584
8 Curse 0x100132e7c -[RCTBridge moduleForClass:] + 4296437372
9 Curse 0x100132fb0 -[RCTBridge modulesConformingToProtocol:] + 4296437680
10 Curse 0x100160980 -[RCTNetworking handlerForRequest:] + 4296624512
11 Curse 0x100163128 -[RCTNetworking networkTaskWithRequest:completionBlock:] + 4296634664
12 Curse 0x100156da4 __100-[RCTImageLoader loadImageOrDataWithURLRequest:size:scale:resizeMode:progressBlock:completionBlock:]_block_invoke.146 + 4296584612
13 libdispatch.dylib 0x1831f54bc _dispatch_call_block_and_release + 24
14 libdispatch.dylib 0x1831f547c _dispatch_client_callout + 16
15 libdispatch.dylib 0x1832014c0 _dispatch_queue_drain + 864
16 libdispatch.dylib 0x1831f8f80 _dispatch_queue_invoke + 464
17 libdispatch.dylib 0x1831f547c _dispatch_client_callout + 16
18 libdispatch.dylib 0x183203914 _dispatch_root_queue_drain + 2140
19 libdispatch.dylib 0x1832030b0 _dispatch_worker_thread3 + 112
20 libsystem_pthread.dylib 0x18340d470 _pthread_wqthread + 1092
21 libsystem_pthread.dylib 0x18340d020 start_wqthread + 4

@ghost
Copy link
Author

ghost commented Aug 16, 2016

@basketofsoftkittens We are on 0.28.0

@ymmuse
Copy link
Contributor

ymmuse commented Aug 20, 2016

I met the same crash.

@ghost ghost changed the title Crash in [RCTModuleData setUpMethodQueue] [iOS] Crash in [RCTModuleData setUpMethodQueue] Aug 23, 2016
@Aaang
Copy link

Aaang commented Aug 23, 2016

It's also the top crash of our application and we can't figure out what's the problem without being able to reproduce the issue. We keep looking into it and share our findings here.

Crash: [RCTModuleData setUpMethodQueue] (RCTModuleData.m:186)
React Native version: 0.28.0
iOS version: only iOS 9, but it doesn't need to mean anything as most of our users are using iOS 9 devices
iOS devices: various iPhones and iPads

@nicklockwood, @javache, @tadeuzagallo any idea what could be the reason for this crash?

@bberthelemy
Copy link

bberthelemy commented Aug 24, 2016

I have the same PB from my users, I do not know where this crash occurs unfortunatly.

React native 0.31
Devices : ios8, ios9 and ios10 (iphones and ipads)

Crashed: com.facebook.react.ImageLoaderURLCacheQueue
0 libdispatch.dylib 0x182a3e534 _os_object_retain + 72
1 libobjc.A.dylib 0x182670128 objc_storeStrong + 44
2 libobjc.A.dylib 0x182656908 object_setIvar + 276
3 Foundation 0x1838ff6e4 -[NSObject(NSKeyValueCoding) setValue:forKey:] + 268
4 Cd 0x100263d74 -[RCTModuleData setUpMethodQueue] + 4296834420
5 Cd 0x100263870 -[RCTModuleData setUpInstanceAndBridge] + 4296833136
6 Cd 0x100263ed8 -[RCTModuleData instance] + 4296834776
7 Cd 0x10025d71c -[RCTBatchedBridge moduleForName:] + 4296808220
8 Cd 0x100272c7c -[RCTBridge moduleForClass:] + 4296895612
9 Cd 0x1002940e4 __93-[RCTImageLoader loadImageOrDataWithTag:size:scale:resizeMode:progressBlock:completionBlock:]_block_invoke_2.129 + 4297031908

10 libdispatch.dylib 0x182a3d4bc _dispatch_call_block_and_release + 24
11 libdispatch.dylib 0x182a3d47c _dispatch_client_callout + 16
12 libdispatch.dylib 0x182a494c0 _dispatch_queue_drain + 864
13 libdispatch.dylib 0x182a40f80 _dispatch_queue_invoke + 464
14 libdispatch.dylib 0x182a3d47c _dispatch_client_callout + 16
15 libdispatch.dylib 0x182a4b914 _dispatch_root_queue_drain + 2140
16 libdispatch.dylib 0x182a4b0b0 _dispatch_worker_thread3 + 112
17 libsystem_pthread.dylib 0x182c55470 _pthread_wqthread + 1092
18 libsystem_pthread.dylib 0x182c55020 start_wqthread + 4

@conover
Copy link

conover commented Aug 24, 2016

Our theory behind this is that there are several places where weak refs are being treated like strong refs. And also a series of places where things were not being null-checked. We are in the process of testing a patch: Curse@bdf1354 Apply at your own risk, obviously.

@ymmuse
Copy link
Contributor

ymmuse commented Aug 25, 2016

I agree with it @conover. I also met another crash incorrectly used object refs in RCTImageLoader .m #9497

@Aaang
Copy link

Aaang commented Aug 26, 2016

@conover it really looks like it's losing the referencing at some point, you're right. The patch looks promising. Could you please share your findings as soon as you've evaluated the crash rate with your patch? We'll probably make our own patch with detailed debug tracking as well.

@ymmuse we're also seeing quite some RCTImageLoader crashes (5 variations) in our crash reporting tool, but by far not as many as the setUpMethodQueue crash.

Here's some additional information that might be useful:

  • we only have one native module which returns the main queue in methodQueue but doesn't synthesize the bridge as we don't need the bridge instance in the native module
  • we have a wrapper for the internal native module to not expose its API as the React Native application is integrated as a CocoaPod in other Apps

I've also created a GitHub project providing the abstract structure of our React Native integration, might be of use when investigating possible issues:
https://github.com/Aaang/ReactNative-SetupMethodQueueCrash

@bennyguitar
Copy link

bennyguitar commented Aug 31, 2016

So the RCTImageLoader crashes persist despite hardier strongSelf and weakSelf checking, as well as into 0.33.0-rc0's changes with the image loading classes.

In current testing, it seems like this block is the culprit:

return ^{
    if (cancelLoad) {
      cancelLoad();
      cancelLoad = nil;
    }
    OSAtomicOr32Barrier(1, &cancelled);
  };

This is in RCTImageLoader.m, and in the methods:

  • _loadImageOrDataWithURLRequest:size:scale:resizeMode:progressBlock:completionBlock
  • loadImageWithURLRequest:size:scale:clipped:resizeMode:progressBlock:completionBlock

The call stack flows from RCTImageView::reloadImage -> RCTImageView::cancelImageLoad -> those methods.

The following lines will throw an EXC_BAD_ACCESS exception:

  • cancelLoad = nil;
  • After commenting that out, OSAtomicOr32Barrier(1, &cancelled); throws the exception as well.
  • Sometimes (less frequently), cancelLoad() will throw it as well

This is reproducible, but not pinned down to an exact set of steps that will make it crash guaranteed. We have a ListView with a large number of rows in which a <Text> component is wrapping a remotely loaded <Image> component. This crash happens basically every time after scrolling quickly through the list, but not on a certain row or image url. That's why it's quasi-reproducible.


Ideas:

Setting a property to nil that has already been dereferenced, will cause an EXC_BAD_ACCESS exception. Obviously this property is being released, but where and why that can happen is still unclear. My current idea is that the app is experiencing memory pressure and pruning views, which are still loading and holding references to the callback blocks, and then the app crashes doing what it thinks it should do.

I'm not sure who to ping on this, but I'm going to ping @brentvatne since he seems to be all over the place in the issues here. Sorry if this is not your area Brent, but maybe you could point us in the right direction here?

@brentvatne
Copy link
Collaborator

@javache is the man for this one, I believe

@ymmuse
Copy link
Contributor

ymmuse commented Sep 8, 2016

what's the status on this?

@lprhodes
Copy link
Contributor

Starting to feel the pain of using RN in production from this. I have the time to go digging but some pointers would be great - @javache? Thanks!

@joshuafeldman
Copy link

We were loading a react view when the application launched that was not on the current tab. We were doing this so that when the user navigated to that tab the view was already built. We removed this and this crash went way down. Haven't had time to dig much into it but maybe it will help some other people who are seeing it in high numbers.

@bennyguitar
Copy link

We are testing some block changes, and will update with results from the newest build.

We are transitioning the code that looks like this:

return ^{
    if (cancelLoad) {
      cancelLoad();
      cancelLoad = nil;
    }
    OSAtomicOr32Barrier(1, &cancelled);
  };

to this:

return ^{
    dispatch_block_t innerCancel = [cancelLoad copy];
    if (innerCancel) {
      innerCancel();
      innerCancel = nil;
    }
    OSAtomicOr32Barrier(1, &cancelled);
  };

Doing this seems to fix it while testing, but this is really a huge problem in memory starved cases that are harder to debug and test in house. We really only started seeing these crashes once the app was out in production and crash reports started arriving in droves.

@lprhodes
Copy link
Contributor

My use case made it very easy to reproduce - this change fixes it thanks @bennyguitar !!!

@rogerkerse
Copy link
Contributor

OSAtomicOr32Barrier(1, &cancelled);

This line still causes me the issue even after @bennyguitar's change

mikelambert added a commit to mikelambert/react-native that referenced this issue Sep 19, 2016
@javache
Copy link
Member

javache commented Sep 21, 2016

@bennyguitar We are seeing this crash disappear at FB with the latest version of React Native. Your patch can cause the scenario where items are cancelled multiple times, since cancelLoad is never nilled out.

@bennyguitar
Copy link

bennyguitar commented Sep 21, 2016

@javache 0.33 or 0.34 release candidate?

EDIT: my code changes were for 0.33 because it was crashing for our use case. I haven't tried with 0.34 yet.

@javache
Copy link
Member

javache commented Sep 21, 2016

This would be v34.

@bennyguitar
Copy link

Okay thanks, when I get a chance to update I'll do it and test again to verify that it's fixed.

@Aaang
Copy link

Aaang commented Sep 22, 2016

@javache thanks for the great news, I'll update to the 0.34 stable version asap and release a new app version in the following week(s). I will monitor our crashes, if there are any, and let you know if I can verify the fix.

@bennyguitar
Copy link

bennyguitar commented Sep 23, 2016

@javache still seeing this crash in 0.34.

Stack Trace:

[RCTImageLoader _loadImageOrDataWithURLRequest:size:scale:resizeMode:progressBlock:completionBlock:]_block)invoke.186
[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:progressBlock:completionBlock:]_block)invoke
[RCTImageView cancelImageLoad]
[RCTImageView didMoveToWindow]
[UIView(Internal) _didMoveFromWindow:toWindow:]
[UIView(Hierarchy) removeFromSuperview]
[RCTView react_updateClippedSubviewsWithClipRect:relativeToView:]
[RCTView(RCTViewUnmounting) react_updateClippedSubviewsWithClipRect:relativeToView:]
[RCTView(RCTViewUnmounting) react_updateClippedSubviewsWithClipRect:relativeToView:]
[RCTView react_updateClippedSubviewsWithClipRect:relativeToView:]
[RCTScrollView updateClippedSubviews]
[RCTScrollView scrollViewDidScroll:]

View Set Up

Basically we have a ListView which contains Views for rows, where each View contains a Text component that wraps an Image component.

EDIT:

Forgot to mention that this happens when setting cancelLoad = nil;

@Griffosx
Copy link

@bennyguitar did you solve this problem?
I'm using 0.34 and still crash...

@bennyguitar
Copy link

@Griffosx: I did not, though the crashes are more infrequent with the 0.34 code changes.

@lprhodes
Copy link
Contributor

I'm seeing the same thing, reproduction while scrolling through a long social feed now takes ~20 seconds to crash rather than 5 seconds.

@ymmuse
Copy link
Contributor

ymmuse commented Sep 27, 2016

So, the crash not still fixed with the 0.34?

@lprhodes
Copy link
Contributor

@ymmuse no it's not

@cosmith
Copy link
Contributor

cosmith commented Oct 6, 2016

We're seeing the same crash on 0.33 in high numbers, we're going to update to 0.34.1 and update here.

@cosmith
Copy link
Contributor

cosmith commented Oct 6, 2016

@facebook-github-bot label iOS

@facebook-github-bot facebook-github-bot added Platform: iOS iOS applications. Ran Commands One of our bots successfully processed a command. labels Oct 6, 2016
@Griffosx
Copy link

Griffosx commented Oct 6, 2016

The issue is not resolved in 0.34.1
After a quick investigation I think I found what causes the problem (in my case). In very short, when an image goes out of the screen and it's still loading sometimes the app crashes.

Workoround
In RCTImageView.m replace in the method didMoveToWindow the line:
[self cancelImageLoad];
with
if (_imageSource.request.URL.absoluteString) { [self cancelImageLoad]; }
With this modification my crashes vanished

Note:
I don't know exactly why sometimes the imagesSource is nil, I only noticed that this happens. Also, I'm quite sure that my modification doesn't hurt the system, because that line is only an optimization, it can be commented also without problem.

@bennyguitar
Copy link

@Griffosx I believe you're seeing this "work" because technically the image has already been downloaded at that point.

There's a _pendingImageSource and an _imageSource and I believe the problem comes in play when you call [self cancelImageLoad] while it is still in the process of loading. So with your fix, it just continues loading all the way through instead of removing the network task from the queue.

It looks like there have been two commits to master that potentially deal with this problem.

The first one is slated for 0.35 release, and the second is in master and most likely to be added to 0.36.

The first fix "sounds" like it's correct via the commit description and reasoning. I'm going to add these two commit changes to our current fork and see if we can get the app to crash or not.

@buckcao
Copy link

buckcao commented Oct 21, 2016

I also found this crash. it's error image url in listview.can you fix listview memory.
Crashed: NSOperationQueue 0x17003c920 :: NSOperation 0x1744475c0 (QOS: USER_INITIATED)
0 libobjc.A.dylib 0x1871c0ab4 objc_loadWeakRetained + 148
1 libobjc.A.dylib 0x1871c0c70 objc_copyWeak + 24
2 sunflower 0x1008ec9fc 100-[RCTImageLoader loadImageOrDataWithURLRequest:size:scale:resizeMode:progressBlock:completionBlock:]_block_invoke.214 + 4303620604
3 sunflower 0x1008f3a88 -[RCTNetworkTask URLRequest:didCompleteWithError:] + 4303649416
4 sunflower 0x1008f436c __50-[RCTFileRequestHandler sendRequest:withDelegate:]_block_invoke + 4303651692
5 Foundation 0x1892317e4 __NSBLOCKOPERATION_IS_CALLING_OUT_TO_A_BLOCK
+ 16
6 Foundation 0x189176358 -[NSBlockOperation main] + 96
7 Foundation 0x189166954 -[__NSOperationInternal _start:] + 620
8 Foundation 0x189233b90 __NSOQSchedule_f + 228
9 libdispatch.dylib 0x1875f91c0 _dispatch_client_callout + 16
10 libdispatch.dylib 0x187607444 _dispatch_queue_serial_drain + 928
11 libdispatch.dylib 0x1875fc9a8 _dispatch_queue_invoke + 652
12 libdispatch.dylib 0x18760938c _dispatch_root_queue_drain + 572
13 libdispatch.dylib 0x1876090ec _dispatch_worker_thread3 + 124
14 libsystem_pthread.dylib 0x1878012c8 _pthread_wqthread + 1288
15 libsystem_pthread.dylib 0x187800db4 start_wqthread + 4

@Aaang
Copy link

Aaang commented Oct 31, 2016

I can also confirm that this is still crashing, even though the crash rate got much better after upgrading to version 0.36.0.rc.1.

We upgraded our production app from 0.28.0 to 0.34.0 two weeks ago. After that, we experienced an enormous increase of crashes, so we decided to release a new app update with 0.36.rc.1 as soon as possible (hence the release candidate and not the stable version) as there were two promising commits in 0.35.0. and 0.36.0,rc.1.

After evaluating the crash rate of this crash after a week on production, the crash rate was reduced by 88%, so it really helped a lot. But still, a proper fix would be amazing.

@XHTeng
Copy link

XHTeng commented Nov 16, 2016

also crash in 0.37.0

@javache
Copy link
Member

javache commented Mar 21, 2017

We're no longer seeing this crash internally.

@javache javache closed this as completed Mar 21, 2017
@facebook facebook locked as resolved and limited conversation to collaborators Jul 19, 2018
@react-native-bot react-native-bot added the Resolution: Locked This issue was locked by the bot. label Jul 19, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Platform: iOS iOS applications. Ran Commands One of our bots successfully processed a command. Resolution: Locked This issue was locked by the bot.
Projects
None yet
Development

No branches or pull requests