NSURLSession引起EXC_BAD_ACCESS错误

Question

我注意到实现NSURLSessionDataDelegate并启动任务时，偶尔会抛出EXC_BAD_ACCESS错误。实际调用方法产生错误似乎有所不同，但总是来自CFNetwork。大部分情况下，调用方法来自NSURLSession delegate_dataTask:didReceiveData:completionHandler。下面附上两个具有不同调用者的崩溃日志。我还附上了我的NSURLSessionDataDelegate实现。

不幸的是，我无法可靠地重现此错误，因此我没有示例脚本可共享。创建和启动Downloader对象最终会导致错误。似乎在处理较大文件时会更频繁发生。我这里实现有问题吗？从这个堆栈跟踪有什么好的调试方法吗？

我已在iOS10和10.1.1上进行了测试，并得到了相同的结果。

实现：

class Downloader: NSObject, NSURLSessionDataDelegate {
    private let url: String
    var finished = false
    let finishCondition = NSCondition()

    init(url:String) {
        self.url = url
        super.init()
    }

    func start() {
        let config = NSURLSessionConfiguration.defaultSessionConfiguration()
        let session = NSURLSession(configuration: config,
                               delegate: self,
                               delegateQueue: nil)
        guard let u = NSURL(string: url) else {
            return
        }
        let request = NSMutableURLRequest(URL: u)
        let task = session.dataTaskWithRequest(request)
        task.resume()
    }

    func URLSession(session: NSURLSession, dataTask: NSURLSessionDataTask,
                    didReceiveData data: NSData) {
    }

    func URLSession(session: NSURLSession,
                    task: NSURLSessionTask,
                    didCompleteWithError error: NSError?) {
        session.invalidateAndCancel()
    }

    func URLSession(session: NSURLSession, dataTask: NSURLSessionDataTask,
                    didReceiveResponse response: NSURLResponse,
                                       completionHandler: (NSURLSessionResponseDisposition) -> Void) {
        completionHandler(NSURLSessionResponseDisposition.Allow)
    }

    func waitForFinish() {
        finishCondition.lock()
        while !finished {
            finishCondition.wait()
        }
        finishCondition.unlock()
    }

    func URLSession(session: NSURLSession, didBecomeInvalidWithError error: NSError?) {
        finishCondition.lock()
        finished = true
        finishCondition.broadcast()
        finishCondition.unlock()
    }
}

崩溃日志 #1：

* thread #5: tid = 0x25923, 0x0000000100042e8c libBacktraceRecording.dylib`__gcd_queue_item_enqueue_hook_block_invoke, queue = 'com.apple.NSURLSession-work', stop reason = EXC_BAD_ACCESS (code=1, address=0xf8686a68b98c6ec8)
  * frame #0: 0x0000000100042e8c libBacktraceRecording.dylib`__gcd_queue_item_enqueue_hook_block_invoke
    frame #1: 0x000000010004241c libBacktraceRecording.dylib`gcd_queue_item_enqueue_hook + 232
    frame #2: 0x000000010065dee8 libdispatch.dylib`_dispatch_introspection_queue_item_enqueue_hook + 40
    frame #3: 0x000000010063cba4 libdispatch.dylib`_dispatch_queue_push + 196
    frame #4: 0x000000018ba50500 Foundation`iop_promote_qos_outward + 112
    frame #5: 0x000000018ba4e524 Foundation`-[NSOperation setQualityOfService:] + 168
    frame #6: 0x000000018b9d7714 Foundation`-[NSOperationQueue addOperationWithBlock:] + 76
    frame #7: 0x000000018b73f82c CFNetwork`-[NSURLSession delegate_dataTask:didReceiveData:completionHandler:] + 208
    frame #8: 0x000000018b5a2c5c CFNetwork`-[__NSCFLocalSessionTask _task_onqueue_didReceiveDispatchData:completionHandler:] + 276
    frame #9: 0x000000018b5a5474 CFNetwork`-[__NSCFLocalSessionTask connection:didReceiveData:completion:] + 164
    frame #10: 0x000000018b647bf0 CFNetwork`__48-[__NSCFURLLocalSessionConnection _tick_running]_block_invoke + 120
    frame #11: 0x000000018b647b60 CFNetwork`-[__NSCFURLLocalSessionConnection _tick_running] + 344
    frame #12: 0x000000018b648c74 CFNetwork`-[__NSCFURLLocalSessionConnection _didReceiveData:] + 412
    frame #13: 0x000000018b64af8c CFNetwork`SessionConnectionLoadable::_loaderClientEvent_DidReceiveData(__CFArray const*) + 52
    frame #14: 0x000000018b6f823c CFNetwork`___ZN19URLConnectionLoader19protocolDidLoadDataEPK8__CFDatax_block_invoke_2 + 44
    frame #15: 0x000000018b64b58c CFNetwork`___ZN25SessionConnectionLoadable21withLoaderClientAsyncEU13block_pointerFvP21LoaderClientInterfaceE_block_invoke + 32
    frame #16: 0x000000010063125c libdispatch.dylib`_dispatch_call_block_and_release + 24
    frame #17: 0x000000010063121c libdispatch.dylib`_dispatch_client_callout + 16
    frame #18: 0x000000010063eb54 libdispatch.dylib`_dispatch_queue_serial_drain + 1136
    frame #19: 0x0000000100634ce4 libdispatch.dylib`_dispatch_queue_invoke + 672
    frame #20: 0x0000000100640e6c libdispatch.dylib`_dispatch_root_queue_drain + 584
    frame #21: 0x0000000100640bb8 libdispatch.dylib`_dispatch_worker_thread3 + 140
    frame #22: 0x000000018a01e2b8 libsystem_pthread.dylib`_pthread_wqthread + 1288
    frame #23: 0x000000018a01dda4 libsystem_pthread.dylib`start_wqthread + 4

崩溃日志 #2：

* thread #12: tid = 0x2521f, 0x000000010010ae8c libBacktraceRecording.dylib`__gcd_queue_item_enqueue_hook_block_invoke, queue = 'com.apple.CFNetwork.Connection', stop reason = EXC_BAD_ACCESS (code=1, address=0xd00f524835000200)
      * frame #0: 0x000000010010ae8c libBacktraceRecording.dylib`__gcd_queue_item_enqueue_hook_block_invoke
        frame #1: 0x000000010010a41c libBacktraceRecording.dylib`gcd_queue_item_enqueue_hook + 232
        frame #2: 0x0000000100759ee8 libdispatch.dylib`_dispatch_introspection_queue_item_enqueue_hook + 40
        frame #3: 0x0000000100738ba4 libdispatch.dylib`_dispatch_queue_push + 196
        frame #4: 0x00000001975ccb3c libnetwork.dylib`nw_connection_read + 448
        frame #5: 0x00000001975d938c libnetwork.dylib`tcp_connection_read + 168
        frame #6: 0x000000018b719d54 CFNetwork`TCPIOConnection::read(unsigned long, unsigned long, void (dispatch_data_s*, CFStreamError) block_pointer) + 172
        frame #7: 0x000000018b782af4 CFNetwork`HTTPEngine::_getBodyIntelligently(void (dispatch_data_s*, CFStreamError, bool) block_pointer) + 816
        frame #8: 0x000000018b780d0c CFNetwork`HTTPEngine::_readBodyStartNextRead() + 76
        frame #9: 0x000000018b783664 CFNetwork`___ZN10HTTPEngine21_getBodyIntelligentlyEU13block_pointerFvP15dispatch_data_s13CFStreamErrorbE_block_invoke.56 + 344
        frame #10: 0x000000018b719f64 CFNetwork`___ZN15TCPIOConnection4readEmmU13block_pointerFvP15dispatch_data_s13CFStreamErrorE_block_invoke + 480
        frame #11: 0x000000010072d25c libdispatch.dylib`_dispatch_call_block_and_release + 24
        frame #12: 0x000000010072d21c libdispatch.dylib`_dispatch_client_callout + 16
        frame #13: 0x000000010073ab54 libdispatch.dylib`_dispatch_queue_serial_drain + 1136
        frame #14: 0x0000000100730ce4 libdispatch.dylib`_dispatch_queue_invoke + 672
        frame #15: 0x000000010073ce6c libdispatch.dylib`_dispatch_root_queue_drain + 584
        frame #16: 0x000000010073cbb8 libdispatch.dylib`_dispatch_worker_thread3 + 140
        frame #17: 0x000000018a01e2b8 libsystem_pthread.dylib`_pthread_wqthread + 1288
        frame #18: 0x000000018a01dda4 libsystem_pthread.dylib`start_wqthread + 4

更新： 我现在可以通过在iOS模拟器中运行下面粘贴的循环来半可靠地重现这个错误。在iOS 9.3上不会发生这种情况。如果您运行下面的代码，一分钟内应该会收到错误。由于在模拟器中发生的可能性非常高，相比于设备，我会认为这是一个并发问题，随着处理能力/核心数量的增加，它变得更有可能发生。 要复现错误，请运行以下内容：

var i = 0
while true {
    print("running: \(i)")
    // random url, larger files seem more likely to cause error
    let url = "http://qthttp.apple.com.edgesuite.net/1010qwoeiuryfg/3340/33409.ts"
    let c = Downloader(url: url)
    c.start()
    c.waitForFinish()
    i += 1
}

- oliveroneill

---

在iOS 10模拟器中看到了这个问题，但在9.3模拟器中没有。症状相同，回溯信息也相同，没有线索。 - Icydog

我在10.0模拟器上看到了类似的崩溃* 线程 #64: tid = 0x5e3688, 0x000000010717deac libBacktraceRecording.dylib`__gcd_queue_item_enqueue_hook_block_invoke + 4, queue = 'com.apple.network.connections', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)。 - yuf

我很高兴我不是唯一一个遇到这个问题的人。有没有好的方法来调试它？ - oliveroneill

Answer 1

经过与苹果技术支持的沟通，我们确认这是一个 libBacktraceRecording.dylib 库内部的bug，该库用于在Xcode中进行调试。我已经提交了一个错误报告，并被告知在大多数用户设备上不会崩溃，因为这是一个出现在库中的调试错误，而该库并未出现在大多数用户的设备上。

- oliveroneill

---

你能分享一个关于该缺陷报告的链接或更多信息吗？以便其他人可以查看其进展情况？还有，你是如何联系到苹果技术支持的？他们响应快吗？ - mfaani

我在Sierra的Mac上遇到了完全相同的崩溃；出现了相同的症状（EXC_BAD_ACCESS深入到NSURLConnectionLoader代码中，但仅从Xcode调试会话中出现）；任何guard Malloc、地址检查器等都可以解决。在Mac上使用相同的dylib。 - mackworth

@user1479585 你从苹果那里收到有关这个 bug 的任何更新了吗？我在 Xcode 8.2 中似乎遇到了完全相同的问题。 - Tim Reddy

没有更新。当与苹果开发支持人员交流时，他们表示我不应该经常创建新的NSURLSession 对象，因为它们是长期存在的对象。因此，我实现了一个复用器，使得多个代理可以在同一个NSURLSession中运行，这大大减少了错误发生的次数。 - oliveroneill

非常感谢@user1479585发布这个问答，这真的很痛苦。 - Fattie

Answer 2

尝试在Zombies工具中运行。我猜测你的Downloader类实例在NSURLSession操作期间被释放，因此当它调用你的didReceiveData方法时，原先被你的对象占据的内存包含了其他内容。（这就是所谓的“僵尸”）。

- Duncan C

---

我无法在Zombie Instrument中重现错误。但是，从“编辑方案”中打开“Zombie Objects”确实导致了相同的错误，而没有输出任何僵尸对象警告。这两者之间有区别吗？ - oliveroneill

我遇到了类似的崩溃问题，当时我开启了僵尸对象检测，但是没有捕获到任何异常。 - yuf

我可以确认，在Sierra 10.12.5上，Xcode 9 beta 5仍然存在这个问题。 - manmal