[ios] Fix `EXC_BAD_ACCESS` in start method of `RCTCxxBridge` #25

lukmccall · 2021-03-08T22:03:01Z

Why

Fixes:

Crashed Thread:        0  Dispatch queue: com.apple.main-thread
Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000119
Exception Note:        EXC_CORPSE_NOTIFY
Termination Signal:    Segmentation fault: 11
Termination Reason:    Namespace SIGNAL, Code 0xb
Terminating Process:   exc handler [19427]
VM Regions Near 0x119:
--> 
    __TEXT                 0000000101c69000-0000000102fc1000 [ 19.3M] r-x/r-x SM=COW  /Users/USER/Library/Developer/CoreSimulator/Devices/BBE20DAE-6B68-4A70-B515-1A9A2543AB12/data/Containers/Bundle/Application/2CF4257D-1903-49DA-ABCD-50424F4910C3/BareExpoDetox.app/BareExpoDetox
Application Specific Information:
CoreSimulator 732.18.6 - Device: iPhone 8 (BBE20DAE-6B68-4A70-B515-1A9A2543AB12) - Runtime: iOS 14.4 (18D46) - DeviceType: iPhone 8
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libobjc.A.dylib               	0x00007fff2018fa85 objc_retain + 5
1   dev.expo.Payments             	0x0000000101f6d781 -[UIResponder(Reanimated) jsExecutorFactoryForBridge:] + 49 (UIResponder+Reanimated.mm:35)
2   dev.expo.Payments             	0x0000000101fc31a1 -[RCTCxxBridge start] + 1214
3   dev.expo.Payments             	0x0000000101fb2bc0 -[RCTBridge setUp] + 464 (RCTBridge.m:321)
4   dev.expo.Payments             	0x0000000101fb22ac -[RCTBridge initWithDelegate:bundleURL:moduleProvider:launchOptions:] + 223 (RCTBridge.m:178)
5   dev.expo.Payments             	0x0000000101fb2142 -[RCTBridge initWithDelegate:launchOptions:] + 55 (RCTBridge.m:154)
6   dev.expo.Payments             	0x0000000101c6ec52 AppDelegate.initializeReactNativeBridge(_:) + 146 (AppDelegate.swift:47)
7   dev.expo.Payments             	0x0000000101c6dbf8 AppDelegate.application(_:didFinishLaunchingWithOptions:) + 344
8   dev.expo.Payments             	0x0000000101c6eb93 @objc AppDelegate.application(_:didFinishLaunchingWithOptions:) + 131
9   com.apple.UIKitCore           	0x00007fff24692fdd -[UIApplication _handleDelegateCallbacksWithOptions:isSuspended:restoreState:] + 232
10  com.apple.UIKitCore           	0x00007fff24694b5f -[UIApplication _callInitializationDelegatesWithActions:forCanvas:payload:fromOriginatingProcess:] + 3919
11  com.apple.UIKitCore           	0x00007fff2469a56d -[UIApplication _runWithMainScene:transitionContext:completion:] + 1237
12  com.apple.UIKitCore           	0x00007fff23cc36f7 -[_UISceneLifecycleMultiplexer completeApplicationLaunchWithFBSScene:transitionContext:] + 122
13  com.apple.UIKitCore           	0x00007fff24251d1e _UIScenePerformActionsWithLifecycleActionMask + 88
14  com.apple.UIKitCore           	0x00007fff23cc4206 __101-[_UISceneLifecycleMultiplexer _evalTransitionToSettings:fromSettings:forceExit:withTransitionStore:]_block_invoke + 198
15  com.apple.UIKitCore           	0x00007fff23cc3c18 -[_UISceneLifecycleMultiplexer _performBlock:withApplicationOfDeactivationReasons:fromReasons:] + 296
16  com.apple.UIKitCore           	0x00007fff23cc4037 -[_UISceneLifecycleMultiplexer _evalTransitionToSettings:fromSettings:forceExit:withTransitionStore:] + 819
17  com.apple.UIKitCore           	0x00007fff23cc38cb -[_UISceneLifecycleMultiplexer uiScene:transitionedFromState:withTransitionContext:] + 345
18  com.apple.UIKitCore           	0x00007fff23ccbb63 __186-[_UIWindowSceneFBSSceneTransitionContextDrivenLifecycleSettingsDiffAction _performActionsForUIScene:withUpdatedFBSScene:settingsDiff:fromSettings:transitionContext:lifecycleActionType:]_block_invoke + 178
19  com.apple.UIKitCore           	0x00007fff2415b613 +[BSAnimationSettings(UIKit) tryAnimatingWithSettings:actions:completion:] + 871
20  com.apple.UIKitCore           	0x00007fff2426e5c6 _UISceneSettingsDiffActionPerformChangesWithTransitionContext + 240
21  com.apple.UIKitCore           	0x00007fff23ccb869 -[_UIWindowSceneFBSSceneTransitionContextDrivenLifecycleSettingsDiffAction _performActionsForUIScene:withUpdatedFBSScene:settingsDiff:fromSettings:transitionContext:lifecycleActionType:] + 361
22  com.apple.UIKitCore           	0x00007fff23aee75f __64-[UIScene scene:didUpdateWithDiff:transitionContext:completion:]_block_invoke + 797
23  com.apple.UIKitCore           	0x00007fff23aed209 -[UIScene _emitSceneSettingsUpdateResponseForCompletion:afterSceneUpdateWork:] + 253
24  com.apple.UIKitCore           	0x00007fff23aee398 -[UIScene scene:didUpdateWithDiff:transitionContext:completion:] + 208
25  com.apple.UIKitCore           	0x00007fff24698a0c -[UIApplication workspace:didCreateScene:withTransitionContext:completion:] + 508
26  com.apple.UIKitCore           	0x00007fff24183a1f -[UIApplicationSceneClientAgent scene:didInitializeWithEvent:completion:] + 358
27  com.apple.FrontBoardServices  	0x00007fff25aa70ae -[FBSScene _callOutQueue_agent_didCreateWithTransitionContext:completion:] + 391
28  com.apple.FrontBoardServices  	0x00007fff25acfb41 __94-[FBSWorkspaceScenesClient createWithSceneID:groupID:parameters:transitionContext:completion:]_block_invoke.176 + 102
29  com.apple.FrontBoardServices  	0x00007fff25ab4ad5 -[FBSWorkspace _calloutQueue_executeCalloutFromSource:withBlock:] + 209
30  com.apple.FrontBoardServices  	0x00007fff25acf80f __94-[FBSWorkspaceScenesClient createWithSceneID:groupID:parameters:transitionContext:completion:]_block_invoke + 352
31  libdispatch.dylib             	0x00007fff20106508 _dispatch_client_callout + 8
32  libdispatch.dylib             	0x00007fff20109052 _dispatch_block_invoke_direct + 281
33  com.apple.FrontBoardServices  	0x00007fff25af57a5 __FBSSERIALQUEUE_IS_CALLING_OUT_TO_A_BLOCK__ + 30
34  com.apple.FrontBoardServices  	0x00007fff25af548b -[FBSSerialQueue _targetQueue_performNextIfPossible] + 433
35  com.apple.FrontBoardServices  	0x00007fff25af5950 -[FBSSerialQueue _performNextFromRunLoopSource] + 22
36  com.apple.CoreFoundation      	0x00007fff2039038a __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
37  com.apple.CoreFoundation      	0x00007fff20390282 __CFRunLoopDoSource0 + 180
38  com.apple.CoreFoundation      	0x00007fff2038f764 __CFRunLoopDoSources0 + 248
39  com.apple.CoreFoundation      	0x00007fff20389f2f __CFRunLoopRun + 878
40  com.apple.CoreFoundation      	0x00007fff203896d6 CFRunLoopRunSpecific + 567
41  com.apple.GraphicsServices    	0x00007fff2c257db3 GSEventRunModal + 139
42  com.apple.UIKitCore           	0x00007fff24696cf7 -[UIApplication _run] + 912
43  com.apple.UIKitCore           	0x00007fff2469bba8 UIApplicationMain + 101
44  dev.expo.Payments             	0x0000000101c6f748 main + 56 (AppDelegate.swift:20)
45  libdyld.dylib                 	0x00007fff2025a3e9 start + 1

How

Normally, RCTCxxBridgeDelegate protocol uses std::unique_ptr to return the js executor object.
However, we needed to change the signature of jsExecutorFactoryForBridge to return void * instead. See expo/expo#9862. This change works great in Expo Go because we have full control over modules initialization, but if someone is using our fork in the bare app, crashes may occur (EXC_BAD_ACCESS). To fix it, we need to get the return type of jsExecutorFactoryForBridge and handle two cases:

method returns void *
method returns std::unique_ptr<JSExecutorFactory>

Test Plan

Expo Go ✅
Bare expo ✅

brentvatne · 2021-03-08T23:35:57Z

merging this to proceed with sdk 41 QA, but lmk if you have any thoughts on this @wkozyra95

…ve#25

ide · 2021-03-09T06:31:31Z

Currently -[EXVersionManager versionedJsExecutorFactoryForBridge:] has a void * return type and returns a versioned facebook::react::JSCExecutorFactory * value, which is why we need to use void *. Would it be possible to keep the void * return type, but return versioned unique_ptr<facebook::react::JSCExecutorFactory> values?

The idea is that we then wouldn't need this commit to detect if the returned value is a smart pointer because -[EXVersionManager versionedJsExecutorFactoryForBridge:] would always return a smart pointer and have a void * static return type.

lukmccall · 2021-03-09T09:10:07Z

Maybe it is possible. However, I couldn't find any other working solution.

wkozyra95 · 2021-03-09T09:33:43Z

@ide unique_ptr is not a pointer so you can't reinterpret_cast to void* (it won't compile). Technically it's possible to do that but we would need to keep unique_ptr somewhere to make sure that it won't be released and we would need to use sth like this

    auto ptr = std::unique_ptr<Test>(new Test());
    void* voidPtr = (*reinterpret_cast<void**>(&ptr));

Maybe a bit cleaner solution would be to rename jsExecutorFactoryForBridge -> versionedJsExecutorFactoryForBridge in ios/Exponent/Kernel/ReactAppManager/EXReactAppManager.mm
and here we could detect based on respondsToSelector. versionedJsExecutorFactoryForBridge would return void* and jsExecutorFactoryForBridge would return unique_ptr. We still have if, but at least we don't comapre strings

ide · 2021-03-09T18:26:56Z

I don't have a specific solution in mind. I'd just like our patch to be the easiest to maintain. Currently, this commit patches the code from expo/expo#9862. Sometimes a patch for a patch is less maintainable than re-thinking the first patch, and if we can make our fork simpler, let's do that.

This is a squashed commit from the following changes: commit c1c976f Author: Stanisław Chmiela <sjchmiela@gmail.com> Date: Thu Aug 20 19:05:55 2020 +0200 Make RCTCxxBridgeDelegate not care about return value of jsExecutorFactoryForBridge commit d1dd984 Author: Stanisław Chmiela <sjchmiela@gmail.com> Date: Thu Aug 20 19:06:13 2020 +0200 Make RCTCxxBridge not care about the actual protocol implemented, only the method used commit efd22a8 Author: Łukasz Kosmaty <lukasz.kosmaty@swmansion.com> Date: Tue Mar 9 00:36:25 2021 +0100 [ios] Fix `EXC_BAD_ACCESS` in start method of `RCTCxxBridge` (#25) commit 0e9b4f9 Author: Kudo Chien <kudo@expo.io> Date: Tue Aug 17 19:17:48 2021 +0800 support hermes for our RCTCxxBridge patch (#26)

…tion for existing view (facebook#51294) Summary: Pull Request resolved: facebook#51294 changelog: [internal] Fix a crash where a node that is supposed to be culled doesn't get visited because culling context is not updated. The differentiator would generate a create instruction for a view that already exists. Stack trace for the crash: ``` * thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT * frame #0: 0x0000000111740874 libsystem_kernel.dylib`__pthread_kill + 8 frame #1: 0x00000001117aa2ec libsystem_pthread.dylib`pthread_kill + 264 frame #2: 0x0000000180171ea8 libsystem_c.dylib`abort + 100 frame #3: 0x00000001802b0144 libc++abi.dylib`abort_message + 128 frame #4: 0x000000018029fe4c libc++abi.dylib`demangling_terminate_handler() + 296 frame #5: 0x000000018006f220 libobjc.A.dylib`_objc_terminate() + 124 frame #6: 0x00000001375d1964 INFRAFramework`meta_terminate() + 5468 frame #7: 0x00000001802af570 libc++abi.dylib`std::__terminate(void (*)()) + 12 frame #8: 0x00000001802b2498 libc++abi.dylib`__cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*) + 32 frame #9: 0x00000001802b2478 libc++abi.dylib`__cxa_throw + 88 frame #10: 0x0000000180093904 libobjc.A.dylib`objc_exception_throw + 384 frame #11: 0x0000000180e6999c Foundation`-[NSAssertionHandler handleFailureInFunction:file:lineNumber:description:] + 268 frame #12: 0x000000031a3bcfc8 XPLAT_6_Framework`-[RCTComponentViewRegistry dequeueComponentViewWithComponentHandle:tag:] + 528 frame #13: 0x000000031a3ccdec XPLAT_6_Framework`RCTPerformMountInstructions(std::__1::vector<facebook::react::ShadowViewMutation, std::__1::allocator<facebook::react::ShadowViewMutation>> const&, RCTComponentViewRegistry*, RCTMountingTransactionObserverCoordinator&, int) + 356 frame #14: 0x000000031a3ccc7c XPLAT_6_Framework`-[RCTMountingManager performTransaction:]::$_1::operator()(facebook::react::MountingTransaction const&, facebook::react::SurfaceTelemetry const&) const + 80 frame #15: 0x000000031a3ccc20 XPLAT_6_Framework`decltype(std::declval<-[RCTMountingManager performTransaction:]::$_1&>()(std::declval<facebook::react::MountingTransaction const&>(), std::declval<facebook::react::SurfaceTelemetry const&>())) std::__1::__invoke[abi:ne190102]<-[RCTMountingManager performTransaction:]::$_1&, facebook::react::MountingTransaction const&, facebook::react::SurfaceTelemetry const&>(-[RCTMountingManager performTransaction:]::$_1&, facebook::react::MountingTransaction const&, facebook::react::SurfaceTelemetry const&) + 40 frame #16: 0x000000031a3ccbc8 XPLAT_6_Framework`void std::__1::__invoke_void_return_wrapper<void, true>::__call[abi:ne190102]<-[RCTMountingManager performTransaction:]::$_1&, facebook::react::MountingTransaction const&, facebook::react::SurfaceTelemetry const&>(-[RCTMountingManager performTransaction:]::$_1&, facebook::react::MountingTransaction const&, facebook::react::SurfaceTelemetry const&) + 40 frame #17: 0x000000031a3ccb94 XPLAT_6_Framework`std::__1::__function::__alloc_func<-[RCTMountingManager performTransaction:]::$_1, std::__1::allocator<-[RCTMountingManager performTransaction:]::$_1>, void (facebook::react::MountingTransaction const&, facebook::react::SurfaceTelemetry const&)>::operator()[abi:ne190102](facebook::react::MountingTransaction const&, facebook::react::SurfaceTelemetry const&) + 44 frame #18: 0x000000031a3cba1c XPLAT_6_Framework`std::__1::__function::__func<-[RCTMountingManager performTransaction:]::$_1, std::__1::allocator<-[RCTMountingManager performTransaction:]::$_1>, void (facebook::react::MountingTransaction const&, facebook::react::SurfaceTelemetry const&)>::operator()(facebook::react::MountingTransaction const&, facebook::react::SurfaceTelemetry const&) + 44 frame #20: 0x000000032f219804 XPLAT_1_Framework`std::__1::function<void (facebook::react::MountingTransaction const&, facebook::react::SurfaceTelemetry const&)>::operator()(this=0x000000016d4f0c78, __arg=0x000000016d4f0a10, __arg=0x000000016d4f0978) const at function.h:989:10 frame #21: 0x000000032f219668 XPLAT_1_Framework`facebook::react::TelemetryController::pullTransaction(this=0x00000003f4680f00, willMount=0x000000016d4f0c98, doMount=0x000000016d4f0c78, didMount=0x000000016d4f0c58) const at TelemetryController.cpp:39:3 frame #22: 0x000000031a3c5b28 XPLAT_6_Framework`-[RCTMountingManager performTransaction:] + 544 frame #23: 0x000000031a3c5864 XPLAT_6_Framework`-[RCTMountingManager initiateTransaction:] + 456 frame #24: 0x000000031a3c5240 XPLAT_6_Framework`__42-[RCTMountingManager scheduleTransaction:]_block_invoke + 308 frame #25: 0x0000000131f81b84 BOTTOMFramework`__RCTExecuteOnMainQueue_block_invoke + 40 frame #26: 0x000000018017c788 libdispatch.dylib`_dispatch_call_block_and_release + 24 frame #27: 0x0000000180197278 libdispatch.dylib`_dispatch_client_callout + 12 frame #28: 0x00000001801b2fcc libdispatch.dylib`_dispatch_main_queue_drain.cold.7 + 24 frame #29: 0x000000018018c1c4 libdispatch.dylib`_dispatch_main_queue_drain + 1184 frame #30: 0x000000018018bd14 libdispatch.dylib`_dispatch_main_queue_callback_4CF + 40 frame #31: 0x0000000180427fec CoreFoundation`__CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 12 frame #32: 0x00000001804229f8 CoreFoundation`__CFRunLoopRun + 1920 frame #33: 0x0000000180421e3c CoreFoundation`CFRunLoopRunSpecific + 536 frame #34: 0x0000000190f62d00 GraphicsServices`GSEventRunModal + 164 frame #35: 0x0000000185bcec98 UIKitCore`-[UIApplication _run] + 796 frame #36: 0x0000000185bd3064 UIKitCore`UIApplicationMain + 124 frame #37: 0x0000000115fbf0bc PRODUCTFramework`main + 200 frame #38: 0x00000001114293d8 dyld_sim`start_sim + 20 frame #39: 0x0000000111506b4c dyld`start + 6000 ``` Reviewed By: rubennorte Differential Revision: D74654157 fbshipit-source-id: 9181bcd28524c71d0ca4620bd630dc0baa172386

This is a squashed commit from the following changes: commit c1c976f Author: Stanisław Chmiela <sjchmiela@gmail.com> Date: Thu Aug 20 19:05:55 2020 +0200 Make RCTCxxBridgeDelegate not care about return value of jsExecutorFactoryForBridge commit d1dd984 Author: Stanisław Chmiela <sjchmiela@gmail.com> Date: Thu Aug 20 19:06:13 2020 +0200 Make RCTCxxBridge not care about the actual protocol implemented, only the method used commit efd22a8 Author: Łukasz Kosmaty <lukasz.kosmaty@swmansion.com> Date: Tue Mar 9 00:36:25 2021 +0100 [ios] Fix `EXC_BAD_ACCESS` in start method of `RCTCxxBridge` (#25) commit 0e9b4f9 Author: Kudo Chien <kudo@expo.io> Date: Tue Aug 17 19:17:48 2021 +0800 support hermes for our RCTCxxBridge patch (#26)

[ios] Fix EXC_BAD_ACCESS in start method of RCTCxxBridge

c5a0ca8

lukmccall requested a review from brentvatne March 8, 2021 22:03

brentvatne requested review from wkozyra95 and ide March 8, 2021 22:07

brentvatne merged commit 16a0e6c into exp-latest Mar 8, 2021

brentvatne deleted the @lukmccall/fix-EXC_BAD_ACCESS-in-CxxBridge-start branch March 8, 2021 23:36

brentvatne added a commit to expo/expo that referenced this pull request Mar 8, 2021

Update react-native-lab to point to version with fix: expo/react-nati…

169faac

…ve#25

brentvatne mentioned this pull request Mar 8, 2021

[ios][android][react-native-lab] Update react-native-reanimated to v2 expo/expo#12150

Merged

brentvatne added a commit to expo/expo that referenced this pull request Mar 9, 2021

Update react-native-lab to point to version with fix: expo/react-nati…

6b7a0ea

…ve#25

Kudo pushed a commit that referenced this pull request Jul 19, 2021

[ios] Fix EXC_BAD_ACCESS in start method of RCTCxxBridge (#25)

efd22a8

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[ios] Fix `EXC_BAD_ACCESS` in start method of `RCTCxxBridge` #25

[ios] Fix `EXC_BAD_ACCESS` in start method of `RCTCxxBridge` #25

Uh oh!

lukmccall commented Mar 8, 2021

Uh oh!

brentvatne commented Mar 8, 2021

Uh oh!

ide commented Mar 9, 2021

Uh oh!

lukmccall commented Mar 9, 2021

Uh oh!

wkozyra95 commented Mar 9, 2021 •

edited

Loading

Uh oh!

ide commented Mar 9, 2021

Uh oh!

Uh oh!

[ios] Fix EXC_BAD_ACCESS in start method of RCTCxxBridge #25

[ios] Fix EXC_BAD_ACCESS in start method of RCTCxxBridge #25

Uh oh!

Conversation

lukmccall commented Mar 8, 2021

Why

How

Test Plan

Uh oh!

brentvatne commented Mar 8, 2021

Uh oh!

ide commented Mar 9, 2021

Uh oh!

lukmccall commented Mar 9, 2021

Uh oh!

wkozyra95 commented Mar 9, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ide commented Mar 9, 2021

Uh oh!

Uh oh!

[ios] Fix `EXC_BAD_ACCESS` in start method of `RCTCxxBridge` #25

[ios] Fix `EXC_BAD_ACCESS` in start method of `RCTCxxBridge` #25

wkozyra95 commented Mar 9, 2021 •

edited

Loading