理论文章

crash分析攻略：https://mp.weixin.qq.com/s/hVj-j61Br3dox37SN79fDQ

常见崩溃原因分析

分享一些常见的崩溃原因

总览

可以通过Exception Information和Backtrace迅速判断出大致崩溃原因。

image.png

有些常见的崩溃都有额外的诊断信息，这些信息能够帮助我们进一步排查出问题。

Swift Runtime Error

Swift通过内存安全技术来提前捕获代码问题。Swift Runtime Error会有比较鲜明的特征

Exception Type:  EXC_BREAKPOINT (SIGTRAP)
...
Termination Signal: Trace/BPT trap: 5
Termination Reason: Namespace SIGNAL, Code 0x5

在英特尔处理器上，崩溃信如下

Exception Type:        EXC_BAD_INSTRUCTION (SIGILL)
...
Exception Note:        EXC_CORPSE_NOTIFY
Termination Signal:    Illegal instruction: 4
Termination Reason:    Namespace SIGNAL, Code 0x4

在堆栈区域也有相关信息

Thread 0 Crashed:
0   MyCoolApp                         0x0000000100a71a88 @objc ViewController.viewDidLoad() (in MyCoolApp) (ViewController.swift:18)

如何定位解决swift runtime error

Language Exception（OC崩溃）

Apple的系统框架在发生runtime错误的时候会抛出Language Exception，比如数组越界等。会有如下特征：

Exception Type:  EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Exception Note:  EXC_CORPSE_NOTIFY

同时此类崩溃还有Last Exception Backtrace

Last Exception Backtrace:
0   CoreFoundation                    0x19aae2a48 __exceptionPreprocess + 220
1   libobjc.A.dylib                   0x19a809fa4 objc_exception_throw + 55

如何定位解决Language Exception

watch dog强杀
被watchdog强杀一般崩溃类型是SIGKILL，同时Termination Reason里面的Code固定为0x8badf00d。

Exception Type:  EXC_CRASH (SIGKILL)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Exception Note:  EXC_CORPSE_NOTIFY
Termination Reason: Namespace SPRINGBOARD, Code 0x8badf00d

如果watchdog强杀是因为app长时间没有响应，则可能会有额外信息。

Termination Description: SPRINGBOARD, 
    scene-create watchdog transgression: application<com.example.MyCoolApp>:667
    exhausted real (wall clock) time allowance of 19.97 seconds 
    | ProcessVisibility: Foreground 
    | ProcessState: Running 
    | WatchdogEvent: scene-create 
    | WatchdogVisibility: Foreground 
    | WatchdogCPUStatistics: ( 
    |  "Elapsed total CPU time (seconds): 15.290 (user 15.290, system 0.000), 28% CPU", 
    |  "Elapsed application CPU time (seconds): 0.367, 1% CPU" 
    | )

如何定位解决watchdog强杀

访问僵尸对象导致的崩溃
访问僵尸对象的，意思是说给已经dealloc的对象发送消息。给已经析构的对象发送消息会发生 objc_msgSend, objc_retain, or objc_release类似这种崩溃。

Thread 0 Crashed:
0   libobjc.A.dylib                   0x00000001a186d190 objc_msgSend + 16
1   Foundation                        0x00000001a1f31238 __NSThreadPerformPerform + 232
2   CoreFoundation                    0x00000001a1ac67e0 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24

另外一种情况也可能代表是访问了僵尸对象，这时候会有Last Exception Backtrace信息

Last Exception Backtrace:
0   CoreFoundation                    0x1bf596a48 __exceptionPreprocess + 220
1   libobjc.A.dylib                   0x1bf2bdfa4 objc_exception_throw + 55
2   CoreFoundation                    0x1bf49a5a8 -[NSObject+ 193960 (NSObject) doesNotRecognizeSelector:] + 139

如何定位解决访问僵尸对象问题

Memory Access野指针问题

野指针异常类型一般是EXC_BAD_ACCESS，同时还就会有VM Region Info信息。

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000000
VM Region Info: 0 is not in any region.  Bytes before following region: 4307009536
      REGION TYPE                      START - END             [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      UNUSED SPACE AT START
--->  
      __TEXT                 0000000100b7c000-0000000100b84000 [   32K] r-x/r-x SM=COW  ...pp/MyGreatApp

如何定位解决野指针问题

Framework丢失
如果app运行时发现缺少framework，会抛出 EXC_CRASH (SIGABRT)异常错误码，而且你也会收到Termination Description中断描述。

Exception Type: EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY
Termination Description: DYLD, dependent dylib '@rpath/MyFramework.framework/MyFramework' 
    not found for '<path>/MyCoolApp.app/MyCoolApp', tried but didn't find: 
    '/usr/lib/swift/MyFramework.framework/MyFramework' 
    '<path>/MyCoolApp.app/Frameworks/MyFramework.framework/MyFramework' 
    '@rpath/MyFramework.framework/MyFramework' 
    '/System/Library/Frameworks/MyFramework.framework/MyFramework'