-[SDWebImageDownloaderOperation URLSession:dataTask:didReceiveData:] crash #1998

hongruqi · 2017-08-16T02:12:20Z

New Issue Checklist

I have read and understood the CONTRIBUTING guide
I have read the Documentation
I have searched for a similar issue in the project and found none

Issue Info

Info	Value
Platform Name	e.g. ios
Platform Version	e.g. 10.0
SDWebImage Version	e.g. 4.1.0
Integration Method	e.g. carthage / cocoapods / manually
Xcode Version	e.g. Xcode 8
Repro rate	e.g. all the time (100%) / sometimes x% / only once
Repro with our demo prj	e.g. does it happen with our demo project?
Demo project link	e.g. link to a demo project that highlights the issue

Issue Description and Steps

Please fill in the detailed description of the issue (full output of any stack trace, compiler error, ...) and the steps to reproduce the issue.

Fatal Exception: NSInvalidArgumentException
-[NSMallocBlock appendData:]: unrecognized selector sent to instance 0x17184f000

bpoplauschi · 2017-08-16T05:23:24Z

@hongruqi

Please fill in the detailed description of the issue (full output of any stack trace, compiler error, ...) and the steps to reproduce the issue.

hongruqi · 2017-08-16T08:12:30Z

@bpoplauschi
Fatal Exception: NSInvalidArgumentException
0 CoreFoundation 0x18292efe0 __exceptionPreprocess
1 libobjc.A.dylib 0x181390538 objc_exception_throw
2 CoreFoundation 0x182935ef4 __methodDescriptionForSelector
3 CoreFoundation 0x182932f54 forwarding
4 CoreFoundation 0x18282ed4c _CF_forwarding_prep_0
5 XXXXX 0x1004fb44c -[SDWebImageDownloaderOperation URLSession:dataTask:didReceiveData:] (SDWebImageDownloaderOperation.m:301)
6 XXXXX 0x1004f92a4 -[SDWebImageDownloader URLSession:dataTask:didReceiveData:] (SDWebImageDownloader.m:304)
7 XXXXXX 0x101300b78 -[_priv_NBSLensAllMethodsDlgt_urlSess nbs_URLSession:dataTask:didReceiveData:]
8 CFNetwork 0x183108a20 __67-[NSURLSession delegate_dataTask:didReceiveData:completionHandler:]_block_invoke.242
9 Foundation 0x1833fe854 NSBLOCKOPERATION_IS_CALLING_OUT_TO_A_BLOCK
10 Foundation 0x1833437b0 -[NSBlockOperation main]
11 Foundation 0x183333b68 -[__NSOperationInternal _start:]
12 Foundation 0x183400bf0 __NSOQSchedule_f
13 libdispatch.dylib 0x1817e69a0 _dispatch_client_callout
14 libdispatch.dylib 0x1817f4ad4 _dispatch_queue_serial_drain
15 libdispatch.dylib 0x1817ea2cc _dispatch_queue_invoke
16 libdispatch.dylib 0x1817f6a50 _dispatch_root_queue_drain
17 libdispatch.dylib 0x1817f67d0 _dispatch_worker_thread3
18 libsystem_pthread.dylib 0x1819ef100 _pthread_wqthread
19 libsystem_pthread.dylib 0x1819eecac start_wqthread

bpoplauschi · 2017-08-18T18:58:00Z

@hongruqi we need you to fill the data in the template table, not leave it with example values.
It's key for us to know:

Platform Name
Platform Version
SDWebImage Version
Integration Method
Xcode Version
Repro rate
Repro with our demo prj
Demo project link

dreampiggy · 2017-08-20T08:26:31Z

6 XXXXX 0x1004f92a4 -[SDWebImageDownloader URLSession:dataTask:didReceiveData:] (SDWebImageDownloader.m:304)

-------------------->
7 XXXXXX 0x101300b78 -[_priv_NBSLensAllMethodsDlgt_urlSess nbs_URLSession:dataTask:didReceiveData:]
<--------------------Swizzle here ? We(even NSURLSession itself) do not have this method

8 CFNetwork 0x183108a20 __67-[NSURLSession delegate_dataTask:didReceiveData:completionHandler:]_block_invoke.242

groupds · 2017-08-21T05:33:23Z

0 CoreFoundation	___exceptionPreprocess + 124
1 libobjc.A.dylib	objc_exception_throw + 56
2 CoreFoundation	-[NSException initWithCoder:]
3 Foundation	NSAllocateMemoryPages + 100
4 Foundation	__NSDataCreateVMDispatchData + 36
5 Foundation	-[_NSPlaceholderData initWithBytes:length:copy:deallocator:] + 248
6 UIKit	__UIImageRefFromData + 364
7 UIKit	-[UIImage(UIImagePrivate) _initWithData:preserveScale:cache:] + 124
8 SDWebImage	+[UIImage(MultiFormat) sd_imageWithData:] + 152
9 SDWebImage	-[SDWebImageDownloaderOperation URLSession:task:didCompleteWithError:] + 464
10 SDWebImage	-[SDWebImageDownloader URLSession:task:didCompleteWithError:] + 128
11 CFNetwork	___51-[NSURLSession delegate_task:didCompleteWithError:]_block_invoke.185 + 72
12 Foundation	_NSBLOCKOPERATION_IS_CALLING_OUT_TO_A_BLOCK + 16
13 Foundation	-[NSBlockOperation main] + 96
14 Foundation	-[__NSOperationInternal _start:] + 620
15 Foundation	___NSOQSchedule_f + 228
16 libdispatch.dylib	__dispatch_client_callout + 16
17 libdispatch.dylib	__dispatch_queue_serial_drain + 928
18 libdispatch.dylib	__dispatch_queue_invoke + 652
19 libdispatch.dylib	__dispatch_root_queue_drain + 572
20 libdispatch.dylib	__dispatch_worker_thread3 + 124
21 libsystem_pthread.dylib	_pthread_wqthread + 1288
22 libsystem_pthread.dylib	start_wqthread + 4

groupds · 2017-08-21T05:34:32Z

0 CoreFoundation	CFRelease + 120
1 SDWebImage	-[SDWebImageDownloaderOperation URLSession:dataTask:didReceiveData:] + 1108
2 SDWebImage	-[SDWebImageDownloader URLSession:dataTask:didReceiveData:] + 128
3 CFNetwork	___67-[NSURLSession delegate_dataTask:didReceiveData:completionHandler:]_block_invoke.242 + 36
4 Foundation	_NSBLOCKOPERATION_IS_CALLING_OUT_TO_A_BLOCK + 16
5 Foundation	-[NSBlockOperation main] + 96
6 Foundation	-[__NSOperationInternal _start:] + 620
7 Foundation	___NSOQSchedule_f + 228
8 libdispatch.dylib	__dispatch_client_callout + 16
9 libdispatch.dylib	__dispatch_queue_serial_drain + 928
10 libdispatch.dylib	__dispatch_queue_invoke + 652
11 libdispatch.dylib	__dispatch_root_queue_drain + 572
12 libdispatch.dylib	__dispatch_worker_thread3 + 124
13 libsystem_pthread.dylib	_pthread_wqthread + 1288

dreampiggy · 2017-08-22T02:44:46Z

The first crash is because of that NSAllocateMemoryPages alloc memory too large but current free memory is low. This happened on + [UIImage imageWithData:] and maybe we could not do something to solve this because it's UIKit private method. The best choice is to set SDWebImageScaleDownLargeImages or to check other memory issue(for example, is there something memory leak or whether the image bitmap is too large)

dreampiggy · 2017-08-22T02:50:14Z

The second one CFRelease release an CFObject that has been released. But I search that file in SD 4.1. There are only two ways to call CFRelease directly. Each of that is protected by check the CFObject first. We have one that do not protected in the previous version(See #1947 ) Are you sure you're using the SD 4.1 version ?

joshuafeldman · 2017-08-28T21:23:09Z

I am seeing this crash in version 4.1.0 of the SDK as well. Although it is not a very large crash.

[__NSArrayI appendData:]: unrecognized selector sent to instance 0x174e4b940

0 | CoreFoundation | __exceptionPreprocess
1 | libobjc.A.dylib | objc_exception_throw
2 | CoreFoundation | __methodDescriptionForSelector
3 | CoreFoundation | ___forwarding___
4 | CoreFoundation | _CF_forwarding_prep_0
5 | XXX | SDWebImageDownloaderOperation.m line 302-[SDWebImageDownloaderOperation URLSession:dataTask:didReceiveData:]
6 | XXX | SDWebImageDownloader.m line 289-[SDWebImageDownloader URLSession:dataTask:didReceiveData:]
7 | CFNetwork | __67-[NSURLSession delegate_dataTask:didReceiveData:completionHandler:]_block_invoke.242
8 | Foundation | __NSBLOCKOPERATION_IS_CALLING_OUT_TO_A_BLOCK__
9 | Foundation | -[NSBlockOperation main]
10 | Foundation | -[__NSOperationInternal _start:]
11 | Foundation | __NSOQSchedule_f
12 | libdispatch.dylib | _dispatch_client_callout
13 | libdispatch.dylib | _dispatch_queue_serial_drain
14 | libdispatch.dylib | _dispatch_queue_invoke
15 | libdispatch.dylib | _dispatch_root_queue_drain
16 | libdispatch.dylib | _dispatch_worker_thread3
17 | libsystem_pthread.dylib | _pthread_wqthread
18 | libsystem_pthread.dylib | start_wqthread

joshuafeldman · 2017-08-28T21:30:31Z

Possible race condition? The imageData collection is being set to nil before this callback is unexpectedly called...?

dreampiggy · 2017-08-29T02:50:57Z

@joshuafeldman It seems that there is an non-thread safe issue to that NSMutableData self.imageData. When you called -[NSURLSessionTask cancel], it may not immediately stop any later call to the URLSession delegate. So there may be an race condition because URLSession delegate queue set the self.imageData=xxx but SD operation queue set self.imageData=nil.

From the apple doc:

A task may, under some circumstances, send messages to its delegate before the cancelation is acknowledged.

Maybe an simple solution is to make all the modify operation in the same queue(for example, put these in the SD's barrierQueue which is previously used for callbackBlocks). I check the code and there are 3 modify process to that imageData property.

//line:231
self.imageData = nil;

//line:270
self.imageData = [[NSMutableData alloc] initWithCapacity:expected];

//line:441
[self.imageData setData:UIImagePNGRepresentation(image)];

Update: Instead of add that dispatch_barrier_sync in any access(getter and setter) position, it's simple to just make that self.imageData=nil happend in the NSURLSession delegate queue. I update the PR and hope someone can review it.

dreampiggy · 2017-08-29T03:10:35Z

And also, all the process that read the image data should be called with copy to get an const NSData because this modification may happen whenever other method call read the data(See that +[UIImage imageWithData:] crash above)...I can later provide an fix to solve this.

joshuafeldman · 2017-09-11T21:49:01Z

Seems like a valid observation to me.

Any timeline for getting this merged in? Would love to include it in our next release.

dreampiggy · 2017-09-12T02:22:47Z

It should on 4.1.1 but current we do not have an possible release date.

@bpoplauschi Maybe we can review this PR and try to merge this to master branch(since this is a crash fix)

dreampiggy · 2017-09-30T07:16:52Z

Fixed via #2011 and will be released in 4.1.1

bpoplauschi · 2017-10-06T19:11:16Z

4.1.1 is now released.

dreampiggy added the crash label Aug 29, 2017

dreampiggy mentioned this issue Aug 30, 2017

Fix SDWebImageDownloadOperation imageData multi-thread issue. #2011

Merged

8 tasks

dreampiggy mentioned this issue Sep 19, 2017

meet crash #2025

Closed

3 tasks

dreampiggy mentioned this issue Sep 29, 2017

Crash: SDWebImageDownloaderOperation.m, line 528 #2042

Closed

3 tasks

dreampiggy added this to the 4.1.1 milestone Sep 30, 2017

dreampiggy closed this as completed Sep 30, 2017

dreampiggy mentioned this issue Jan 28, 2018

crash #2194

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

-[SDWebImageDownloaderOperation URLSession:dataTask:didReceiveData:] crash #1998

-[SDWebImageDownloaderOperation URLSession:dataTask:didReceiveData:] crash #1998

hongruqi commented Aug 16, 2017 •

edited

bpoplauschi commented Aug 16, 2017

hongruqi commented Aug 16, 2017

bpoplauschi commented Aug 18, 2017

dreampiggy commented Aug 20, 2017 •

edited

groupds commented Aug 21, 2017

groupds commented Aug 21, 2017

dreampiggy commented Aug 22, 2017 •

edited

dreampiggy commented Aug 22, 2017

joshuafeldman commented Aug 28, 2017

joshuafeldman commented Aug 28, 2017

dreampiggy commented Aug 29, 2017 •

edited

dreampiggy commented Aug 29, 2017

joshuafeldman commented Sep 11, 2017

dreampiggy commented Sep 12, 2017

dreampiggy commented Sep 30, 2017 •

edited

bpoplauschi commented Oct 6, 2017

-[SDWebImageDownloaderOperation URLSession:dataTask:didReceiveData:] crash #1998

-[SDWebImageDownloaderOperation URLSession:dataTask:didReceiveData:] crash #1998

Comments

hongruqi commented Aug 16, 2017 • edited

New Issue Checklist

Issue Info

Issue Description and Steps

bpoplauschi commented Aug 16, 2017

hongruqi commented Aug 16, 2017

bpoplauschi commented Aug 18, 2017

dreampiggy commented Aug 20, 2017 • edited

groupds commented Aug 21, 2017

groupds commented Aug 21, 2017

dreampiggy commented Aug 22, 2017 • edited

dreampiggy commented Aug 22, 2017

joshuafeldman commented Aug 28, 2017

joshuafeldman commented Aug 28, 2017

dreampiggy commented Aug 29, 2017 • edited

dreampiggy commented Aug 29, 2017

joshuafeldman commented Sep 11, 2017

dreampiggy commented Sep 12, 2017

dreampiggy commented Sep 30, 2017 • edited

bpoplauschi commented Oct 6, 2017

hongruqi commented Aug 16, 2017 •

edited

dreampiggy commented Aug 20, 2017 •

edited

dreampiggy commented Aug 22, 2017 •

edited

dreampiggy commented Aug 29, 2017 •

edited

dreampiggy commented Sep 30, 2017 •

edited