[iOS] Crash in [RCTModuleData setUpMethodQueue]

I'm looking for a squashing bug in an iOS app that I can't work out/reproduce. I am getting a logged error of
Selector name found in current argument registers: retain

This only seems to happen on iOS devices with 9.3
(Currently one of our top crashes in our application)

Log file for crash:

Thread 19 Crashed:
0   libdispatch.dylib                    0x0000000181c02534 _os_object_retain + 72
1   libobjc.A.dylib                      0x0000000181834128 objc_storeStrong + 40
2   libobjc.A.dylib                      0x000000018181a908 object_setIvar + 272
3   Foundation                           0x0000000182ac36e4 -[NSObject(NSKeyValueCoding) setValue:forKey:] + 264
4   myapp                              0x00000001007a4908 -[RCTModuleData setUpMethodQueue] (RCTModuleData.m:186)
5   myapp                              0x00000001007a43f8 -[RCTModuleData setUpInstanceAndBridge] (RCTModuleData.m:120)
6   myapp                              0x00000001007a4a6c -[RCTModuleData instance] (RCTModuleData.m:222)
7   myapp                              0x000000010079e2b4 -[RCTBatchedBridge moduleForName:] (RCTBatchedBridge.m:216)
8   myapp                              0x00000001007b4660 -[RCTBridge moduleForClass:] (RCTBridge.m:199)
9   myapp                              0x000000010074e254 __100-[RCTImageLoader loadImageOrDataWithURLRequest:size:scale:resizeMode:progressBlock:completionBlock:]_block_invoke.142 (RCTImageLoader.m:415)
10  libdispatch.dylib                    0x0000000181c014bc _dispatch_call_block_and_release + 20
11  libdispatch.dylib                    0x0000000181c0147c _dispatch_client_callout + 12
12  libdispatch.dylib                    0x0000000181c0d4c0 _dispatch_queue_drain + 860
13  libdispatch.dylib                    0x0000000181c04f80 _dispatch_queue_invoke + 460
14  libdispatch.dylib                    0x0000000181c0147c _dispatch_client_callout + 12
15  libdispatch.dylib                    0x0000000181c0f914 _dispatch_root_queue_drain + 2136
16  libdispatch.dylib                    0x0000000181c0f0b0 _dispatch_worker_thread3 + 108
17  libsystem_pthread.dylib              0x0000000181e19470 _pthread_wqthread + 1088
18  libsystem_pthread.dylib              0x0000000181e19020 start_wqthread + 0

[joshuafeldman]

We are seeing this same crash in our reporting tool. It is currently the top crash in our application. We have not been able to figure out how to reproduce it but an interesting thing in the log is API MISUSE: Resurrection of an object. Not sure if that helps...

[basketofsoftkittens]

@Damir46 what version of react native are you on?

[conover]

For us, this crash occurs in the context of the RCTImageLoader. And it has the same API MISUSE: Resurrection of an object message. This is on React-Native .30. Here is the stack trace:

Crashed: com.facebook.react.ImageLoaderURLCacheQueue
0 libdispatch.dylib 0x1831f6534 _os_object_retain + 72
1 libobjc.A.dylib 0x182e28128 objc_storeStrong + 44
2 libobjc.A.dylib 0x182e0e908 object_setIvar + 276
3 Foundation 0x1840b76e4 -[NSObject(NSKeyValueCoding) setValue:forKey:] + 268
4 Curse 0x1001223e8 -[RCTModuleData setUpMethodQueue] + 4296369128
5 Curse 0x100121ed8 -[RCTModuleData setUpInstanceAndBridge] + 4296367832
6 Curse 0x10012254c -[RCTModuleData instance] + 4296369484
7 Curse 0x10011b850 -[RCTBatchedBridge moduleForName:] + 4296341584
8 Curse 0x100132e7c -[RCTBridge moduleForClass:] + 4296437372
9 Curse 0x100132fb0 -[RCTBridge modulesConformingToProtocol:] + 4296437680
10 Curse 0x100160980 -[RCTNetworking handlerForRequest:] + 4296624512
11 Curse 0x100163128 -[RCTNetworking networkTaskWithRequest:completionBlock:] + 4296634664
12 Curse 0x100156da4 __100-[RCTImageLoader loadImageOrDataWithURLRequest:size:scale:resizeMode:progressBlock:completionBlock:]_block_invoke.146 + 4296584612
13 libdispatch.dylib 0x1831f54bc _dispatch_call_block_and_release + 24
14 libdispatch.dylib 0x1831f547c _dispatch_client_callout + 16
15 libdispatch.dylib 0x1832014c0 _dispatch_queue_drain + 864
16 libdispatch.dylib 0x1831f8f80 _dispatch_queue_invoke + 464
17 libdispatch.dylib 0x1831f547c _dispatch_client_callout + 16
18 libdispatch.dylib 0x183203914 _dispatch_root_queue_drain + 2140
19 libdispatch.dylib 0x1832030b0 _dispatch_worker_thread3 + 112
20 libsystem_pthread.dylib 0x18340d470 _pthread_wqthread + 1092
21 libsystem_pthread.dylib 0x18340d020 start_wqthread + 4

@basketofsoftkittens We are on 0.28.0

[ymmuse]

I met the same crash.

[Aaang]

It's also the top crash of our application and we can't figure out what's the problem without being able to reproduce the issue. We keep looking into it and share our findings here.

Crash: [RCTModuleData setUpMethodQueue] (RCTModuleData.m:186)
React Native version: 0.28.0
iOS version: only iOS 9, but it doesn't need to mean anything as most of our users are using iOS 9 devices
iOS devices: various iPhones and iPads

@nicklockwood, @javache, @tadeuzagallo any idea what could be the reason for this crash?

[bberthelemy]

I have the same PB from my users, I do not know where this crash occurs unfortunatly.

React native 0.31
Devices : ios8, ios9 and ios10 (iphones and ipads)

Crashed: com.facebook.react.ImageLoaderURLCacheQueue
0 libdispatch.dylib 0x182a3e534 _os_object_retain + 72
1 libobjc.A.dylib 0x182670128 objc_storeStrong + 44
2 libobjc.A.dylib 0x182656908 object_setIvar + 276
3 Foundation 0x1838ff6e4 -[NSObject(NSKeyValueCoding) setValue:forKey:] + 268
4 Cd 0x100263d74 -[RCTModuleData setUpMethodQueue] + 4296834420
5 Cd 0x100263870 -[RCTModuleData setUpInstanceAndBridge] + 4296833136
6 Cd 0x100263ed8 -[RCTModuleData instance] + 4296834776
7 Cd 0x10025d71c -[RCTBatchedBridge moduleForName:] + 4296808220
8 Cd 0x100272c7c -[RCTBridge moduleForClass:] + 4296895612
9 Cd 0x1002940e4 __93-[RCTImageLoader loadImageOrDataWithTag:size:scale:resizeMode:progressBlock:completionBlock:]_block_invoke_2.129 + 4297031908
10 libdispatch.dylib 0x182a3d4bc _dispatch_call_block_and_release + 24
11 libdispatch.dylib 0x182a3d47c _dispatch_client_callout + 16
12 libdispatch.dylib 0x182a494c0 _dispatch_queue_drain + 864
13 libdispatch.dylib 0x182a40f80 _dispatch_queue_invoke + 464
14 libdispatch.dylib 0x182a3d47c _dispatch_client_callout + 16
15 libdispatch.dylib 0x182a4b914 _dispatch_root_queue_drain + 2140
16 libdispatch.dylib 0x182a4b0b0 _dispatch_worker_thread3 + 112
17 libsystem_pthread.dylib 0x182c55470 _pthread_wqthread + 1092
18 libsystem_pthread.dylib 0x182c55020 start_wqthread + 4

[conover]

Our theory behind this is that there are several places where weak refs are being treated like strong refs. And also a series of places where things were not being null-checked. We are in the process of testing a patch: Curse@bdf1354 Apply at your own risk, obviously.

[ymmuse]

I agree with it @conover. I also met another crash incorrectly used object refs in RCTImageLoader .m #9497

[Aaang]

@conover it really looks like it's losing the referencing at some point, you're right. The patch looks promising. Could you please share your findings as soon as you've evaluated the crash rate with your patch? We'll probably make our own patch with detailed debug tracking as well.

@ymmuse we're also seeing quite some RCTImageLoader crashes (5 variations) in our crash reporting tool, but by far not as many as the setUpMethodQueue crash.

Here's some additional information that might be useful:

• we only have one native module which returns the main queue in methodQueue but doesn't synthesize the bridge as we don't need the bridge instance in the native module
• we have a wrapper for the internal native module to not expose its API as the React Native application is integrated as a CocoaPod in other Apps

I've also created a GitHub project providing the abstract structure of our React Native integration, might be of use when investigating possible issues:
https://github.com/Aaang/ReactNative-SetupMethodQueueCrash

[bennyguitar]

So the RCTImageLoader crashes persist despite hardier strongSelf and weakSelf checking, as well as into 0.33.0-rc0's changes with the image loading classes.

In current testing, it seems like this block is the culprit:

return ^{
    if (cancelLoad) {
      cancelLoad();
      cancelLoad = nil;
    }
    OSAtomicOr32Barrier(1, &cancelled);
  };

This is in RCTImageLoader.m, and in the methods:

• _loadImageOrDataWithURLRequest:size:scale:resizeMode:progressBlock:completionBlock
• loadImageWithURLRequest:size:scale:clipped:resizeMode:progressBlock:completionBlock

The call stack flows from RCTImageView::reloadImage -> RCTImageView::cancelImageLoad -> those methods.

The following lines will throw an EXC_BAD_ACCESS exception:

• cancelLoad = nil;
• After commenting that out, OSAtomicOr32Barrier(1, &cancelled); throws the exception as well.
• Sometimes (less frequently), cancelLoad() will throw it as well

---

This is reproducible, but not pinned down to an exact set of steps that will make it crash guaranteed. We have a ListView with a large number of rows in which a <Text> component is wrapping a remotely loaded <Image> component. This crash happens basically every time after scrolling quickly through the list, but not on a certain row or image url. That's why it's quasi-reproducible.

---

Ideas:

Setting a property to nil that has already been dereferenced, will cause an EXC_BAD_ACCESS exception. Obviously this property is being released, but where and why that can happen is still unclear. My current idea is that the app is experiencing memory pressure and pruning views, which are still loading and holding references to the callback blocks, and then the app crashes doing what it thinks it should do.

I'm not sure who to ping on this, but I'm going to ping @brentvatne since he seems to be all over the place in the issues here. Sorry if this is not your area Brent, but maybe you could point us in the right direction here?

[brentvatne]

@javache is the man for this one, I believe