Closed numist closed 3 years ago
Sounds like this isn't as reproducible as I'd hoped. Multi-dispatch hasn't been without its problems (https://github.com/numist/Switch/issues/65 and https://github.com/numist/NNKit/pull/9 come immediately to mind) so it's not unreasonable to expect that there's still some way for an object to slip through the cracks.
But if there is, I can't find it yet.
Here's the line at 169:
[(id<SWWindowContentsSubscriber>)self.subscriberDispatcher windowContentService:self updatedContent:contentContainer.content forWindow:contentContainer.window];
The crash report adds:
Selector name found in current argument registers: subscriberDispatcher
SWWindowContentsService.m
assembly from v0.0.8 when that selector is in the register bank:
mov rsi, qword [ds:0x100031488] ; @selector(subscriberDispatcher)
call r14 ; imp___got__objc_msgSend (cached)
mov rdi, rax ; move result to arg1 of next call
call imp___stubs__objc_retainAutoreleasedReturnValue ; crash, presumably.
mov qword [ss:rbp-0x50+var_16], rax
mov rax, qword [ds:r13+0x28]
mov qword [ss:rbp-0x50+var_24], rax
mov rsi, qword [ds:0x1000315a8] ; subscriberDispatcher no longer in registers
subscriberDispatcher
itself looks like:
push rbp
mov rbp, rsp
mov rax, qword [ds:_OBJC_IVAR_$_NNService._subscriberDispatcher]
mov rax, qword [ds:rdi+rax]
pop rbp
ret
There's not a whole lot to go wrong here; the property is readonly
and set in NNService
's initializer.
SWAppDelegate
should implement [BITCrashManagerDelegate applicationLogForCrashManager:]
to provide more context for this (and future) crashes.
Obsoleted by #139, which removes the NNKit dependency.
Reported by @bavarious, who adds that DictationIM crashes shortly after Switch. Both are Accessibility applications, but it may be a red herring since Switch is crashing in code unrelated to the Accessibility APIs. I suspect that Switch crashing may have left AX in a bad enough mood to take it out on others.
From the report:
Unable to reproduce locally; maybe something else on the system was bound to
⌥↑
?From the crash group:
-Os
seems to have collapsed some of the stack frames, but that code is dispatchingwindowContentService:updatedContent:forWindow:
to all of the window content service's subscribers. Not sure which pointer was bad whenobjc_retain
got to it, but it looks like a dead object problem.This crash happened at least twice in less than an hour for one person, so it appears to be reproducible when conditions are right.