[TIMOB-26420] ios 12 app crash (EXC_BAD_ACCESS, KERN_INVALID_ADDRESS)

GitHub Issue	n/a
Type	Bug
Priority	Critical
Status	Resolved
Resolution	Duplicate
Resolution Date	2018-10-05T12:16:02.000+0000
Affected Version/s	n/a
Fix Version/s	n/a
Components	n/a
Labels	device, ios-12, ios12, kroll
Reporter	Bar Bruy
Assignee	Vijay Singh
Created	2018-09-19T08:27:01.000+0000
Updated	2018-10-05T12:16:02.000+0000

Description

After updating to ios 12 the application starts to crash randomly but often. the part from the crashlog that is probably causing it:

14  MyApplication           0x0000000104453094 -[KrollBridge evalFileOnThread:context:] + 110740 (KrollBridge.m:432)
15  MyApplication           0x0000000104459640 -[KrollInvocation invoke:] + 136768 (KrollContext.m:103)
16  MyApplication           0x000000010445bbb0 -[KrollContext invokeOnThread:method:withObject:callback:selector:] + 146352 (KrollContext.m:1065)
17  MyApplication           0x0000000104453254 -[KrollBridge evalFile:callback:selector:] + 111188 (KrollBridge.m:452)
18  MyApplication           0x00000001044540b8 -[KrollBridge didStartNewContext:] + 114872 (KrollBridge.m:0)
19  MyApplication           0x000000010445c874 -[KrollContext main] + 149620 (KrollContext.m:1262)

Full crash log:

Incident Identifier: 273DA187-754B-498B-B6A0-F9A2A48B9163
CrashReporter Key:   e54932b550f96832a65276093add14c1b2c04fbe
Hardware Model:      iPad6,7
Process:             MyApplication [471]
Path:                /private/var/containers/Bundle/Application/54E187A3-B589-428E-994F-868028FFFD5B/MyApplication.app/MyApplication
Identifier:          com.myapplication
Version:             2.7.5 (2.7.5)
Code Type:           ARM-64 (Native)
Role:                Non UI
Parent Process:      launchd [1]
Coalition:           com.myapplication [600]


Date/Time:           2018-09-18 23:24:40.4051 +0200
Launch Time:         2018-09-18 23:24:39.7584 +0200
OS Version:          iPhone OS 12.0 (16A366)
Baseband Version:    n/a
Report Version:      104

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x00000001669c89e8
VM Region Info: 0x1669c89e8 is not in any region.  Bytes after previous region: 1527548393  Bytes before following region: 82834968
      REGION TYPE                      START - END             [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      MALLOC_TINY            000000010b800000-000000010b900000 [ 1024K] rw-/rwx SM=PRV
--->  GAP OF 0x5ffc8000 BYTES
      Stack Guard            000000016b8c8000-000000016b8cc000 [   16K] ---/rwx SM=NUL

Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [471]
Triggered by Thread:  8

Thread 0 name:  Dispatch queue: com.apple.main-thread
Thread 0:
0   CoreText                        0x0000000187c476b4 ConvertSettingsToOTFeatures+ 788148 (TInlineVector<unsigned int, 30ul> const&, TFontFeatureSettingList const&, bool, TInlineVector<std::__1::pair<unsigned int, unsigned int>, 30ul>&, KerningStatus*, FeatureDefaults) + 1252
1   CoreText                        0x0000000187c47654 ConvertSettingsToOTFeatures+ 788052 (TInlineVector<unsigned int, 30ul> const&, TFontFeatureSettingList const&, bool, TInlineVector<std::__1::pair<unsigned int, unsigned int>, 30ul>&, KerningStatus*, FeatureDefaults) + 1156
2   CoreText                        0x0000000187c29b2c TOpenTypeMorph::ShapeGlyphs+ 666412 (SyncState&, bool*) + 724
3   CoreText                        0x0000000187ba8240 TShapingEngine::ShapeGlyphs+ 135744 (TRunGlue&, AnnexTableFlag, __CFString const*) + 160
4   CoreText                        0x0000000187bcea08 CTFontTransformGlyphs + 432
5   UIFoundation                    0x000000018e48684c -[NSCoreTypesetter _NSFastDrawString:length:attributes:paragraphStyle:typesetterBehavior:lineBreakMode:rect:padding:cgContext:baselineRendering:usesFontLeading:usesScreenFont:scrollable:syncAlignment:mirrored:boundingRectPointer:baselineOffsetPointer:wantsTextLineFragments:applicationFrameworkContext:] + 3120
6   UIFoundation                    0x000000018e482d44 -[NSCoreTypesetter _stringDrawingCoreTextEngineWithOriginalString:rect:padding:context:forceClipping:styledTextOptions:attributes:stringDrawingOptions:drawingContext:wantsTextLineFragments:validatedAttributedString:firstNonRenderedCharacterIndex:foundSoftHyphenAtEOL:enginePathUsed:] + 1112
7   UIFoundation                    0x000000018e501e38 __NSStringDrawingEngine + 3104
8   UIFoundation                    0x000000018e4870b0 -[NSAttributedString+ 24752 (NSExtendedStringDrawing) boundingRectWithSize:options:context:] + 568
9   UIFoundation                    0x000000018e49ee30 -[NSAttributedString+ 122416 (NSStringDrawing) size] + 76
10  MyApplication           0x0000000104512148 -[TiUILabel sizeForFont:] + 893256 (TiUILabel.m:68)
11  MyApplication           0x0000000104512278 -[TiUILabel contentWidthForWidth:] + 893560 (TiUILabel.m:87)
12  MyApplication           0x0000000104511978 -[TiUILabelProxy contentWidthForWidth:] + 891256 (TiUILabelProxy.m:17)
13  MyApplication           0x000000010447fed0 -[TiViewProxy autoWidthForSize:] + 294608 (TiViewProxy.m:876)
14  MyApplication           0x0000000104480bd8 -[TiViewProxy minimumParentWidthForSize:] + 297944 (TiViewProxy.m:1002)
15  MyApplication           0x0000000104480de0 -[TiViewProxy minimumParentHeightForSize:] + 298464 (TiViewProxy.m:1019)
16  MyApplication           0x0000000104480558 -[TiViewProxy autoHeightForSize:] + 296280 (TiViewProxy.m:950)
17  MyApplication           0x0000000104481300 -[TiViewProxy minimumParentHeightForSize:] + 299776 (TiViewProxy.m:1046)
18  MyApplication           0x00000001045cd478 -[TiUIScrollViewProxy autoHeightForSize:] + 1660024 (TiUIScrollViewProxy.m:202)
19  MyApplication           0x00000001045d04f8 -[TiUIScrollView handleContentSize] + 1672440 (TiUIScrollView.m:289)
20  MyApplication           0x00000001045d0130 __43-[TiUIScrollView setNeedsHandleContentSize]_block_invoke + 1671472 (TiUIScrollView.m:236)
21  MyApplication           0x0000000104573a9c __TiThreadPerformOnMainThread_block_invoke + 1292956 (TiBase.m:249)
22  MyApplication           0x0000000104573e74 TiThreadProcessPendingMainThreadBlocks + 1293940 (TiBase.m:357)
23  MyApplication           0x0000000104573c84 __TiThreadPerformOnMainThread_block_invoke.206 + 1293444 (TiBase.m:287)
24  libdispatch.dylib               0x000000018390a6c8 _dispatch_call_block_and_release + 24
25  libdispatch.dylib               0x000000018390b484 _dispatch_client_callout + 16
26  libdispatch.dylib               0x00000001838b79ec _dispatch_main_queue_callback_4CF$VARIANT$mp + 1068
27  CoreFoundation                  0x0000000183e611bc __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 12
28  CoreFoundation                  0x0000000183e5c084 __CFRunLoopRun + 1964
29  CoreFoundation                  0x0000000183e5b5b8 CFRunLoopRunSpecific + 436
30  GraphicsServices                0x00000001860cf584 GSEventRunModal + 100
31  UIKitCore                       0x00000001b025f558 UIApplicationMain + 212
32  MyApplication           0x000000010443ef9c main + 28572 (main.m:30)
33  libdyld.dylib                   0x000000018391bb94 start + 4

Thread 1:
0   libsystem_pthread.dylib         0x0000000183aefcfc start_wqthread + 0

Thread 2:
0   libsystem_pthread.dylib         0x0000000183aefcfc start_wqthread + 0

Thread 3:
0   libsystem_pthread.dylib         0x0000000183aefcfc start_wqthread + 0

Thread 4:
0   libsystem_pthread.dylib         0x0000000183aefcfc start_wqthread + 0

Thread 5 name:  com.apple.uikit.eventfetch-thread
Thread 5:
0   libsystem_kernel.dylib          0x0000000183a5ced0 mach_msg_trap + 8
1   libsystem_kernel.dylib          0x0000000183a5c3a8 mach_msg + 72
2   CoreFoundation                  0x0000000183e60fb0 __CFRunLoopServiceMachPort + 236
3   CoreFoundation                  0x0000000183e5be4c __CFRunLoopRun + 1396
4   CoreFoundation                  0x0000000183e5b5b8 CFRunLoopRunSpecific + 436
5   Foundation                      0x000000018484f6a4 -[NSRunLoop+ 34468 (NSRunLoop) runMode:beforeDate:] + 300
6   Foundation                      0x000000018484f550 -[NSRunLoop+ 34128 (NSRunLoop) runUntilDate:] + 148
7   UIKitCore                       0x00000001b01bcac0 -[UIEventFetcher threadMain] + 136
8   Foundation                      0x00000001849823b0 __NSThread__start__ + 1040
9   libsystem_pthread.dylib         0x0000000183aec2fc _pthread_body + 128
10  libsystem_pthread.dylib         0x0000000183aec25c _pthread_start + 48
11  libsystem_pthread.dylib         0x0000000183aefd08 thread_start + 4

Thread 6:
0   libsystem_pthread.dylib         0x0000000183aefcfc start_wqthread + 0

Thread 7:
0   libsystem_pthread.dylib         0x0000000183aefcfc start_wqthread + 0

Thread 8 name:  KrollContext<kroll$1>
Thread 8 Crashed:
0   JavaScriptCore                  0x000000018b8eb27c JSC::LLInt::setUpCall+ 7848572 (JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 292
1   JavaScriptCore                  0x000000018b8eb1a4 JSC::LLInt::setUpCall+ 7848356 (JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 76
2   JavaScriptCore                  0x000000018b1d8120 llint_entry + 29952
3   JavaScriptCore                  0x000000018b1d0a1c vmEntryToJavaScript + 300
4   JavaScriptCore                  0x000000018b8483f0 JSC::Interpreter::executeCall+ 7181296 (JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 424
5   JavaScriptCore                  0x000000018ba7a0fc JSC::boundThisNoArgsFunctionCall+ 9482492 (JSC::ExecState*) + 452
6   JavaScriptCore                  0x000000018b1d8bac llint_entry + 32652
7   JavaScriptCore                  0x000000018b1d8134 llint_entry + 29972
8   JavaScriptCore                  0x000000018b1d84e0 llint_entry + 30912
9   JavaScriptCore                  0x000000018b1d8134 llint_entry + 29972
10  JavaScriptCore                  0x000000018b1d0a1c vmEntryToJavaScript + 300
11  JavaScriptCore                  0x000000018b846fe4 JSC::Interpreter::executeProgram+ 7176164 (JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) + 9620
12  JavaScriptCore                  0x000000018ba22218 JSC::evaluate+ 9122328 (JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 316
13  JavaScriptCore                  0x000000018b1f9634 JSEvaluateScript + 472
14  MyApplication           0x0000000104453094 -[KrollBridge evalFileOnThread:context:] + 110740 (KrollBridge.m:432)
15  MyApplication           0x0000000104459640 -[KrollInvocation invoke:] + 136768 (KrollContext.m:103)
16  MyApplication           0x000000010445bbb0 -[KrollContext invokeOnThread:method:withObject:callback:selector:] + 146352 (KrollContext.m:1065)
17  MyApplication           0x0000000104453254 -[KrollBridge evalFile:callback:selector:] + 111188 (KrollBridge.m:452)
18  MyApplication           0x00000001044540b8 -[KrollBridge didStartNewContext:] + 114872 (KrollBridge.m:0)
19  MyApplication           0x000000010445c874 -[KrollContext main] + 149620 (KrollContext.m:1262)
20  Foundation                      0x00000001849823b0 __NSThread__start__ + 1040
21  libsystem_pthread.dylib         0x0000000183aec2fc _pthread_body + 128
22  libsystem_pthread.dylib         0x0000000183aec25c _pthread_start + 48
23  libsystem_pthread.dylib         0x0000000183aefd08 thread_start + 4

Thread 9:
0   libsystem_kernel.dylib          0x0000000183a5cf24 semaphore_timedwait_trap + 8
1   libdispatch.dylib               0x00000001838ac0ac _dispatch_sema4_timedwait$VARIANT$mp + 64
2   libdispatch.dylib               0x00000001838aca08 _dispatch_semaphore_wait_slow + 72
3   libdispatch.dylib               0x00000001838ba824 _dispatch_worker_thread + 352
4   libsystem_pthread.dylib         0x0000000183aec2fc _pthread_body + 128
5   libsystem_pthread.dylib         0x0000000183aec25c _pthread_start + 48
6   libsystem_pthread.dylib         0x0000000183aefd08 thread_start + 4

Thread 10 name:  JavaScriptCore bmalloc scavenger
Thread 10:
0   libsystem_kernel.dylib          0x0000000183a5cfd8 swtch_pri + 8
1   libsystem_pthread.dylib         0x0000000183aecf88 sched_yield + 16
2   JavaScriptCore                  0x000000018b1cd93c bmalloc::Mutex::lockSlowCase+ 387388 () + 108
3   JavaScriptCore                  0x000000018b1cadb8 void std::__1::condition_variable_any::wait<std::__1::unique_lock<bmalloc::Mutex> >+ 376248 (std::__1::unique_lock<bmalloc::Mutex>&) + 164
4   JavaScriptCore                  0x000000018b1cee70 bmalloc::Scavenger::threadRunLoop+ 392816 () + 176
5   JavaScriptCore                  0x000000018b1ce5a4 bmalloc::Scavenger::Scavenger+ 390564 (std::__1::lock_guard<bmalloc::Mutex>&) + 0
6   JavaScriptCore                  0x000000018b1d0050 std::__1::__thread_specific_ptr<std::__1::__thread_struct>::set_pointer+ 397392 (std::__1::__thread_struct*) + 0
7   libsystem_pthread.dylib         0x0000000183aec2fc _pthread_body + 128
8   libsystem_pthread.dylib         0x0000000183aec25c _pthread_start + 48
9   libsystem_pthread.dylib         0x0000000183aefd08 thread_start + 4

Thread 11 name:  WTF::AutomaticThread
Thread 11:
0   libsystem_kernel.dylib          0x0000000183a67f0c __psynch_cvwait + 8
1   libsystem_pthread.dylib         0x0000000183ae4d48 _pthread_cond_wait$VARIANT$mp + 636
2   JavaScriptCore                  0x000000018b1b8f34 WTF::ThreadCondition::timedWait+ 302900 (WTF::Mutex&, WTF::WallTime) + 148
3   JavaScriptCore                  0x000000018b1a00f4 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void + 200948 ()> const&, WTF::TimeWithDynamicClockType const&) + 2004
4   JavaScriptCore                  0x000000018b179a38 bool WTF::Condition::waitUntil<WTF::Lock>+ 43576 (WTF::Lock&, WTF::TimeWithDynamicClockType const&) + 184
5   JavaScriptCore                  0x000000018b179dd8 WTF::Function<void ()>::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0>::call+ 44504 () + 216
6   JavaScriptCore                  0x000000018b1b714c WTF::Thread::entryPoint+ 295244 (WTF::Thread::NewThreadContext*) + 256
7   JavaScriptCore                  0x000000018b1b86b4 WTF::wtfThreadEntryPoint+ 300724 (void*) + 12
8   libsystem_pthread.dylib         0x0000000183aec2fc _pthread_body + 128
9   libsystem_pthread.dylib         0x0000000183aec25c _pthread_start + 48
10  libsystem_pthread.dylib         0x0000000183aefd08 thread_start + 4

Thread 12 name:  JSC Heap Collector Thread
Thread 12:
0   libsystem_kernel.dylib          0x0000000183a67f0c __psynch_cvwait + 8
1   libsystem_pthread.dylib         0x0000000183ae4d48 _pthread_cond_wait$VARIANT$mp + 636
2   JavaScriptCore                  0x000000018b1b8f34 WTF::ThreadCondition::timedWait+ 302900 (WTF::Mutex&, WTF::WallTime) + 148
3   JavaScriptCore                  0x000000018b1a00f4 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void + 200948 ()> const&, WTF::TimeWithDynamicClockType const&) + 2004
4   JavaScriptCore                  0x000000018b179a38 bool WTF::Condition::waitUntil<WTF::Lock>+ 43576 (WTF::Lock&, WTF::TimeWithDynamicClockType const&) + 184
5   JavaScriptCore                  0x000000018b179dd8 WTF::Function<void ()>::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0>::call+ 44504 () + 216
6   JavaScriptCore                  0x000000018b1b714c WTF::Thread::entryPoint+ 295244 (WTF::Thread::NewThreadContext*) + 256
7   JavaScriptCore                  0x000000018b1b86b4 WTF::wtfThreadEntryPoint+ 300724 (void*) + 12
8   libsystem_pthread.dylib         0x0000000183aec2fc _pthread_body + 128
9   libsystem_pthread.dylib         0x0000000183aec25c _pthread_start + 48
10  libsystem_pthread.dylib         0x0000000183aefd08 thread_start + 4

Thread 8 crashed with ARM Thread State (64-bit):
    x0: 0x0000000106dee4e8   x1: 0x0000000106dee4e8   x2: 0x0000000000000000   x3: 0x00000001b43d8668
    x4: 0x0000000106de5bc0   x5: 0x0000000000000001   x6: 0x000000016be21208   x7: 0x0000000000000000
    x8: 0x000000000bd0513d   x9: 0x00000001081a0000  x10: 0x000000018ba47638  x11: 0x0000000000000000
   x12: 0x0000000000000002  x13: 0x0000000040000000  x14: 0x0000000000000000  x15: 0x0000000108259600
   x16: 0x0000000183addd60  x17: 0x0000000000000cf3  x18: 0x0000000000000000  x19: 0x000000016be21370
   x20: 0x000000016be213f0  x21: 0x00000001b43d8668  x22: 0x0000000106e00000  x23: 0x0000000106e00000
   x24: 0x0000000108207930  x25: 0x000000016be21670  x26: 0x0000000000000000  x27: 0xffff000000000000
   x28: 0xffff000000000002   fp: 0x000000016be21360   lr: 0x000000018b8eb1a4
    sp: 0x000000016be212f0   pc: 0x000000018b8eb27c cpsr: 0x80000000

Attachments

File	Date	Size
Bildschirmfoto 2018-09-24 um 10.19.33.png	2018-09-24T08:21:22.000+0000	951155

Comments

Sharif AbuDarda 2018-09-19

Hello, This looks to a case of a non-reproducible issue on our end. Usually, this could be caused by old code being updated to the new release. Make sure you remove all event listeners in window close. This is a standard recommendation. In any case, Could you provide a standalone test case that regenerates the issue? Also, Look for other reported JIRA ticket on the same problem. Maybe someone solved it on their end. Thanks.
Bar Bruy 2018-09-20

Hi, My app crashes in less then a minute. and in my app its very-reproducible. It happens without leaving the initial window. I was doing repetitive http calls. How do you mean "Old code being updated"? => the current app in the app store crashes on ios12 with titanium sdk 7.2. => During development it also crashes (ios12 and sdk 7.4) => It only crashes on real devices. "Make sure you remove all event listeners in window close" => In my app all eventlisteners are removed on window close How can I add more extensive logging to pinpoint the problem? I'll try to create a reproducible testproject. Thanks, Bart
Rene Pot 2018-09-20

Hi [~bar b], do you by any chance use run-on-main-thread?

Bar Bruy 2018-09-20

Hi, Rene Pot, I've tried both run-on-main-thread true and false. the crashes seem slightly different then the one i first logged. +run-on-main-thread: true+

   Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
   Exception Subtype: KERN_INVALID_ADDRESS at 0x00000001636559e8
   VM Region Info: 0x1636559e8 is not in any region.  Bytes after previous region: 1493899753  Bytes before following region: 199173656
         REGION TYPE                      START - END             [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
         MALLOC_LARGE           000000010a598000-000000010a5a4000 [   48K] rw-/rwx SM=PRV  
   --->  GAP OF 0x64ea4000 BYTES
         Stack Guard            000000016f448000-000000016f44c000 [   16K] ---/rwx SM=NUL  
   
   Termination Signal: Segmentation fault: 11
   Termination Reason: Namespace SIGNAL, Code 0xb
   Terminating Process: exc handler [710]
   Triggered by Thread:  0
   
   Thread 0 name:  Dispatch queue: com.apple.main-thread
   Thread 0 Crashed:
   0   JavaScriptCore                	0x000000018b8eb27c JSC::LLInt::setUpCall+ 7848572 (JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 292
   1   JavaScriptCore                	0x000000018b8eb1a4 JSC::LLInt::setUpCall+ 7848356 (JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 76
   2   JavaScriptCore                	0x000000018b1d8120 llint_entry + 29952
   3   JavaScriptCore                	0x000000018b1d80cc llint_entry + 29868
   4   JavaScriptCore                	0x000000018b1d80cc llint_entry + 29868
   5   JavaScriptCore                	0x000000018b1d0a1c vmEntryToJavaScript + 300
   6   JavaScriptCore                	0x000000018b8483f0 JSC::Interpreter::executeCall+ 7181296 (JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 424
   7   JavaScriptCore                	0x000000018ba7a0fc JSC::boundThisNoArgsFunctionCall+ 9482492 (JSC::ExecState*) + 452
   8   JavaScriptCore                	0x000000018b1d0b94 vmEntryToNative + 308
   9   JavaScriptCore                	0x000000018b84844c JSC::Interpreter::executeCall+ 7181388 (JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 516
   10  JavaScriptCore                	0x000000018b9ff068 JSC::profiledCall+ 8978536 (JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 172
   11  JavaScriptCore                	0x000000018b206284 JSObjectCallAsFunction + 368
   12  Chapps Rental Inspector       	0x00000001008e7678 __65-[KrollObject invokeCallbackForKey:withObject:thisObject:onDone:]_block_invoke + 194168 (KrollObject.m:1103)
   13  libdispatch.dylib             	0x000000018390a6c8 _dispatch_call_block_and_release + 24
   14  libdispatch.dylib             	0x000000018390b484 _dispatch_client_callout + 16
   15  libdispatch.dylib             	0x00000001838b79ec _dispatch_main_queue_callback_4CF$VARIANT$mp + 1068
   16  CoreFoundation                	0x0000000183e611bc __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 12
   17  CoreFoundation                	0x0000000183e5c084 __CFRunLoopRun + 1964
   18  CoreFoundation                	0x0000000183e5b5b8 CFRunLoopRunSpecific + 436
   19  GraphicsServices              	0x00000001860cf584 GSEventRunModal + 100
   20  UIKitCore                     	0x00000001b025f558 UIApplicationMain + 212
   21  Chapps Rental Inspector       	0x00000001008bdd3c main + 23868 (main.m:30)
   22  libdyld.dylib                 	0x000000018391bb94 start + 4

run-on-main-thread false:

   Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
   Exception Subtype: KERN_INVALID_ADDRESS at 0x00000001655559e8
   VM Region Info: 0x1655559e8 is not in any region.  Bytes after previous region: 1524783593  Bytes before following region: 134473240
         REGION TYPE                      START - END             [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
         MALLOC_LARGE           000000010a71c000-000000010a730000 [   80K] rw-/rwx SM=PRV  
   --->  GAP OF 0x62e64000 BYTES
         Stack Guard            000000016d594000-000000016d598000 [   16K] ---/rwx SM=NUL  
   
   Termination Signal: Segmentation fault: 11
   Termination Reason: Namespace SIGNAL, Code 0xb
   Terminating Process: exc handler [715]
   Triggered by Thread:  6
   
   Thread 0 name:  Dispatch queue: com.apple.main-thread
   Thread 0:
   0   libsystem_kernel.dylib        	0x0000000183a5ced0 mach_msg_trap + 8
   1   libsystem_kernel.dylib        	0x0000000183a5c3a8 mach_msg + 72
   2   CoreFoundation                	0x0000000183e60fb0 __CFRunLoopServiceMachPort + 236
   3   CoreFoundation                	0x0000000183e5be4c __CFRunLoopRun + 1396
   4   CoreFoundation                	0x0000000183e5b5b8 CFRunLoopRunSpecific + 436
   5   GraphicsServices              	0x00000001860cf584 GSEventRunModal + 100
   6   UIKitCore                     	0x00000001b025f558 UIApplicationMain + 212
   7   Chapps Rental Inspector       	0x0000000102772f9c main + 28572 (main.m:30)
   8   libdyld.dylib                 	0x000000018391bb94 start + 4
   
   Thread 1:
   0   libsystem_pthread.dylib       	0x0000000183aefcfc start_wqthread + 0
   
   Thread 2:
   0   libsystem_pthread.dylib       	0x0000000183aefcfc start_wqthread + 0
   
   Thread 3:
   0   libsystem_pthread.dylib       	0x0000000183aefcfc start_wqthread + 0
   
   Thread 4 name:  com.apple.uikit.eventfetch-thread
   Thread 4:
   0   libsystem_kernel.dylib        	0x0000000183a5ced0 mach_msg_trap + 8
   1   libsystem_kernel.dylib        	0x0000000183a5c3a8 mach_msg + 72
   2   CoreFoundation                	0x0000000183e60fb0 __CFRunLoopServiceMachPort + 236
   3   CoreFoundation                	0x0000000183e5be4c __CFRunLoopRun + 1396
   4   CoreFoundation                	0x0000000183e5b5b8 CFRunLoopRunSpecific + 436
   5   Foundation                    	0x000000018484f6a4 -[NSRunLoop+ 34468 (NSRunLoop) runMode:beforeDate:] + 300
   6   Foundation                    	0x000000018484f550 -[NSRunLoop+ 34128 (NSRunLoop) runUntilDate:] + 148
   7   UIKitCore                     	0x00000001b01bcac0 -[UIEventFetcher threadMain] + 136
   8   Foundation                    	0x00000001849823b0 __NSThread__start__ + 1040
   9   libsystem_pthread.dylib       	0x0000000183aec2fc _pthread_body + 128
   10  libsystem_pthread.dylib       	0x0000000183aec25c _pthread_start + 48
   11  libsystem_pthread.dylib       	0x0000000183aefd08 thread_start + 4
   
   Thread 5:
   0   libsystem_pthread.dylib       	0x0000000183aefcfc start_wqthread + 0
   
   Thread 6 name:  KrollContext<kroll$1>
   Thread 6 Crashed:
   0   JavaScriptCore                	0x000000018b8eb27c JSC::LLInt::setUpCall+ 7848572 (JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 292
   1   JavaScriptCore                	0x000000018b8eb1a4 JSC::LLInt::setUpCall+ 7848356 (JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 76
   2   JavaScriptCore                	0x000000018b1d8120 llint_entry + 29952
   3   JavaScriptCore                	0x000000018b1d80cc llint_entry + 29868
   4   JavaScriptCore                	0x000000018b1d80cc llint_entry + 29868
   5   JavaScriptCore                	0x000000018b1d0a1c vmEntryToJavaScript + 300
   6   JavaScriptCore                	0x000000018b8483f0 JSC::Interpreter::executeCall+ 7181296 (JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 424
   7   JavaScriptCore                	0x000000018ba7a0fc JSC::boundThisNoArgsFunctionCall+ 9482492 (JSC::ExecState*) + 452
   8   JavaScriptCore                	0x000000018b1d0b94 vmEntryToNative + 308
   9   JavaScriptCore                	0x000000018b84844c JSC::Interpreter::executeCall+ 7181388 (JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 516
   10  JavaScriptCore                	0x000000018b9ff068 JSC::profiledCall+ 8978536 (JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 172
   11  JavaScriptCore                	0x000000018b206284 JSObjectCallAsFunction + 368
   12  Chapps Rental Inspector       	0x000000010279e4d0 -[KrollObject invokeCallbackForKey:withObject:thisObject:onDone:] + 206032 (KrollObject.m:1103)
   13  CoreFoundation                	0x0000000183eda660 __invoking___ + 144
   14  CoreFoundation                	0x0000000183db6980 -[NSInvocation invoke] + 292
   15  CoreFoundation                	0x0000000183db7564 -[NSInvocation invokeWithTarget:] + 60
   16  Chapps Rental Inspector       	0x00000001027936b0 -[ExpandedInvocationOperation main] + 161456 (KrollContext.m:1528)
   17  Foundation                    	0x000000018486619c -[__NSOperationInternal _start:] + 740
   18  Chapps Rental Inspector       	0x000000010278f6fc -[KrollContext invoke:] + 145148 (KrollContext.m:985)
   19  Chapps Rental Inspector       	0x0000000102790d50 -[KrollContext main] + 150864 (KrollContext.m:1355)
   20  Foundation                    	0x00000001849823b0 __NSThread__start__ + 1040
   21  libsystem_pthread.dylib       	0x0000000183aec2fc _pthread_body + 128
   22  libsystem_pthread.dylib       	0x0000000183aec25c _pthread_start + 48
   23  libsystem_pthread.dylib       	0x0000000183aefd08 thread_start + 4

Bar Bruy 2018-09-20

I've created a test program that will crash on a real device with ios 12 This does not crash on a simulator with ios12, and it will also not crash on a real device with ios 11 it is a loop * downloading json from a public api. * parse the json * insert it into a db on a real device with ios12 this crashes random between 600 to 1500 cycles. on the simulator with ios12 it did not even crash after 30 000 cycles on a ipad2 with ios 9 it did not even crash after 5 000 cycles

   Titanium.App.idleTimerDisabled = true;
   
   var window = Ti.UI.createWindow({ keepScreenOn: true, layout: 'vertical' });
   
   var label = Ti.UI.createLabel({ text: 'starting downloads...', left: 8, right: 8, height: Ti.UI.SIZE, top: 50 });
   window.add(label);
   
   var row = Ti.UI.createTableViewRow({ title: 'Starting downloads ...' });
   var table = Ti.UI.createTableView({ width: Ti.UI.FILL, height: Ti.UI.FILL, data: [row] });
   window.add(table);
   window.open();
   
   function log(message) {
       var row = Ti.UI.createTableViewRow({ title: message });
       table.insertRowBefore(0, row, false);
       label.text = counter;
       Ti.API.info(message);
   }
   
   var xhr = null;
   var counter = 0;
   createDb();
   download();
   
   function download() {
       var url = "https://api.openbrewerydb.org/breweries";
       xhr = Ti.Network.createHTTPClient({
           onload: downloadSuccess,
           onerror: downloadFailed,
           timeout: 5000
       });
       xhr.open("GET", url);
       xhr.send();
   };
   
   function downloadFailed(response) {
       counter++;
       var errorMessage = response != null && response.error != null ? response.error : 'No error info';
       log('Download error ' + errorMessage);
       //setTimeout(download, 50); //I use the setTimeout so the ui gets rendered, if you just execute download(); it will also crash
       download();
   };
   
   function downloadSuccess(response) {
       counter++;
       var message = "";
       if (response && response.success && xhr && xhr.responseText) {
           log('download success: ' + counter);
           databaseInsert(JSON.parse(xhr.responseText));
       } else {
           log('web request failed');
           Ti.API.warning(message);
       }
       download();
   };
   
   function createDb() {
       var db = Ti.Database.open('MyDatabase.sqlite3');
       db.execute(
           'CREATE TABLE IF NOT EXISTS myTable(' +
           'id INTEGER PRIMARY KEY,' +
           'jsonObject TEXT' +
           ');'
       );
       db.close();
   }
   
   function databaseInsert(jsonObject) {
       var db = Ti.Database.open('MyDatabase.sqlite3');
       db.execute('insert into myTable ' +
           '(jsonObject) ' +
           'VALUES(?)',
           JSON.stringify(jsonObject)
       );
       db.close();
   }

***Edit 21/09*** Changed testcode so the UI does not freeze

Gertjan Smits 2018-09-21
Bar Bruy 2018-09-21

@Gertjan Smits Did you try this on an actual device running ios12? For me this code freeses the ui but does not crash on device with ios 11. It does not crash on the simulator with ios12 But it does crash on an actual device running ios12
Gertjan Smits 2018-09-21

I am testing on a iPhone 6, 7, 8 Plus and an iPad Pro 12.9 - all running iOS 12. What do you mean with crash exactly? For me a crash and a freeze are 2 different things. *Freeze* stops the UI, but you still see the app. *Crash* kills the app and you have to restart it again. The issues we have with are apps are _crashes_. Your issue seems to be about _freezes_. (both should be fixed obviously - but they might not be the same)
Nikos Poulios 2018-09-21

Testing on iPhone SE iOS 12 device, I get the impression that setTimeout causes UI freezes and databaseInsert (without setTimeout) causes crashes
Bar Bruy 2018-09-21

@Gerjansmits My actual app crashes (not freezes) on ios 12. *the testcode I provided kills(crashes) the app after 600-1600 cycles. running on a ipad pro 12.9 with ios12 => @Gerjansmits can you also try to change the "setTimeout(download,..)" with direct invocation: "download()"? @Nikos Poulios My ipad pro 12.9 (ios12) also crashes with the setTimeout
Gertjan Smits 2018-09-21

I just explicitly set the run-on-main-thread to false, which causes the *crash*! Before it was on true which resulted in a *freeze*. So I guess the issue is the same, only that this flag changes the symptom a bit. <property name="run-on-main-thread" type="bool">false</property>
Nikos Poulios 2018-09-21

@Bar Bruy yes it certainly crashes with the setTimeout. What I mean is that when there is call to databaseInsert app tends to crash and if there is no call to databaseInsert the app tends to freeze when setTimeout is there. With no setTimeout and no databaseInsert, app seems to work ok...Gertjan might be right though and all the above are different final results of the same issue

Bar Bruy 2018-09-21

Dear appcelerator, and fellow developers that have the same (or simular) issues, The test project I created freezes the ui, and this can cause confusion to what to problem is. I've updated the testcode, the UI does not freeze anymore. (previously I animated the table inserts) so once again to summarize: * code crashes (ios 12 device) * code works fine on (ios 11 device/simulator) and (ios 12 simulator) * run-on-main-thread true or false does not affect the crashing Test project:

    Titanium.App.idleTimerDisabled = true;
    
    var window = Ti.UI.createWindow({ keepScreenOn: true, layout: 'vertical' });
    
    var label = Ti.UI.createLabel({ text: 'starting downloads...', left: 8, right: 8, height: Ti.UI.SIZE, top: 50 });
    window.add(label);
    
    var row = Ti.UI.createTableViewRow({ title: 'Starting downloads ...' });
    var table = Ti.UI.createTableView({ width: Ti.UI.FILL, height: Ti.UI.FILL, data: [row] });
    window.add(table);
    window.open();
    
    function log(message) {
        var row = Ti.UI.createTableViewRow({ title: message });
        table.insertRowBefore(0, row, false);
        label.text = counter;
        Ti.API.info(message);
    }
    
    var xhr = null;
    var counter = 0;
    createDb();
    download();
    
    function download() {
        var url = "https://api.openbrewerydb.org/breweries";
        xhr = Ti.Network.createHTTPClient({
            onload: downloadSuccess,
            onerror: downloadFailed,
            timeout: 5000
        });
        xhr.open("GET", url);
        xhr.send();
    };
    
    function downloadFailed(response) {
        counter++;
        var errorMessage = response != null && response.error != null ? response.error : 'No error info';
        log('Download error ' + errorMessage);
        //setTimeout(download, 50); //I use the setTimeout so the ui gets rendered, if you just execute download(); it will also crash
        download();
    };
    
    function downloadSuccess(response) {
        counter++;
        var message = "";
        if (response && response.success && xhr && xhr.responseText) {
            log('download success: ' + counter);
            databaseInsert(JSON.parse(xhr.responseText));
        } else {
            log('web request failed');
            Ti.API.warning(message);
        }
        download();
    };
    
    function createDb() {
        var db = Ti.Database.open('MyDatabase.sqlite3');
        db.execute(
            'CREATE TABLE IF NOT EXISTS myTable(' +
            'id INTEGER PRIMARY KEY,' +
            'jsonObject TEXT' +
            ');'
        );
        db.close();
    }
    
    function databaseInsert(jsonObject) {
        var db = Ti.Database.open('MyDatabase.sqlite3');
        db.execute('insert into myTable ' +
            '(jsonObject) ' +
            'VALUES(?)',
            JSON.stringify(jsonObject)
        );
        db.close();
    }

Nikos Poulios 2018-09-21

Yes now it is more clear the crash issue (sorry for the confusion but there are other tickets for apparently another issue concerning setTimeout and app freezes). It should also be noted that the code above works ok on iOS 12 using Titanium 6.3.0.GA
Hans Knöchel 2018-09-22

Please follow TIMOB-26296 for details on this issue, thank you!
Christian Clare 2018-09-24

Hans - TIMOB-26296 isn't visible... is that an internal Jira? Really need to know what the definitive Jira is for the iOS 12 random crashing issue - it is affecting our production app
Bar Bruy 2018-09-24

@Hans, i also cannot navigate in any way to TIMOB-26296 or don't know how to. I would like to know if I need to go to the app store with a nightly build or if I can fix it in code. thx for your help. Bart
Hans Knöchel 2018-09-24

Sorry, it's TIMOB-26391!
Nikos Poulios 2018-09-24

@Hans are you sure this is a duplicate of TIMOB-26391? As discussed in the comments above, issue is about app crashes not freezes and not related to setTimeout or setInterval, example code seems to crash on databaseInsert and regardless of run-on-main-thread
Hans Knöchel 2018-09-24

[~nipoul] The initial author only provided sql-related samples, which we can reproduce in the same way as TIMOB-26391. I agree that the initial log is rather about labels, but it seems like there is no isolated test-case for that. *EDIT*: Reopening for now, but we require a test-case to reproduce and fix it. And to confirm: Does <use-jscore-framework>false</use-jscore-framework> help? We noticed this during our investigations and it may also apply here.
Nikos Poulios 2018-09-24
Hans Knöchel 2018-09-24

That is not the test-case for this issue, it's another one (the one I linked). This one is about a label inside a scroll-view that crashes when laying out. If that sounds familiar, please provide a test from your app as this will reproduce it.
Hans Knöchel 2018-09-24

If the latest test-case is what's been looked for, it's a leak in the Ti.UI.TableView method "insertRowBefore" where the data is not correctly released. See the attachment for details. !Bildschirmfoto 2018-09-24 um 10.19.33.png|thumbnail!
Nikos Poulios 2018-09-24
Nikos Poulios 2018-09-24
Vijay Singh 2018-10-01

Hey Guys, I guess this issue has been fixed with changes of TIMOB-26391. Can you please verify at your end and confirm? Thanks!
Nikos Poulios 2018-10-01

We indeed did not have this issue again after disabling the jscrore framework
Jan Vennemann 2018-10-02

[~nipoul], with the fix from TIMOB-26391 you can enable jscore framework again. If you don't mind testing with your app and let us know if the issue is fixed with jscore enabled, that would be greatly appreciated! Thanks!
Nikos Poulios 2018-10-03

@Jan OK we will test as soon as possible and let you know
Bar Bruy 2018-10-04

I tested my apps, 7.4.1 doesn't crash. Good job!
Nikos Poulios 2018-10-04

Issue seems to be resolved on our apps too.Nice!
Jan Vennemann 2018-10-05

Closing as duplicate of TIMOB-26391

JSON Source