iOS 14 odd pointer jump with bitwise operation leading to a crash

Question

I am debugging an odd crash with iOS 14. I added a UIColor extension to easily create colors from hex values. Up until iOS 14, this has worked just fine. With iOS 14, I am getting crashes that seem to be stemming from line 4 but end up on completely different stack trace. I know this sounds odd, but my best guess is that the hex operation overflows somehow causing the execution pointer to shift somewhere else leading to weird crashes.

// SocialsColors.swift

// Version 1:
extension UIColor {
    convenience init(hex: Int) {
        let components = (
            R: CGFloat((hex >> 16) & 0xff) / 255,
            G: CGFloat((hex >> 08) & 0xff) / 255,
            B: CGFloat((hex >> 00) & 0xff) / 255
        )
        self.init(red: components.R, green: components.G, blue: components.B, alpha: 1)
    }
}

// Version 2:
extension UIColor {
    convenience init(hex: Int) {
        let red = CGFloat(Double((hex & 0xFF0000) >> 16) / 255.0)
        let green = CGFloat(Double((hex & 0x00FF00) >> 8) / 255.0)
        let blue = CGFloat(Double(hex & 0x0000FF) / 255.0)
        self.init(red: red, green: green, blue: blue, alpha: 1)
    }
}

Here is one example crash; scroll to the bottom — how on earth can SocialsColor.swift preceed UIApplicationMain?!

Crashed: com.apple.main-thread
0  AttributeGraph                 0x1c7b83974 AGGraphGetValue + 284
1  SwiftUI                        0x1a6c15da4 AppearanceEffect.phase.getter + 32
2  SwiftUI                        0x1a6c15e28 AppearanceEffect.updateValue() + 120
3  SwiftUI                        0x1a6c162ac static AppearanceEffect.didReinsert(attribute:) + 36
4  SwiftUI                        0x1a6d18ae8 closure #1 in AGSubgraphRef.didReinsert() + 64
5  AttributeGraph                 0x1c7b75b7c AG::Subgraph::apply(unsigned int, AG::ClosureFunctionAV<void, unsigned int>) + 388
6  SwiftUI                        0x1a71da49c GraphHost.updateRemovedState() + 212
7  SwiftUI                        0x1a72a4920 _UIHostingView.updateRemovedState() + 112
8  SwiftUI                        0x1a72a6f80 _UIHostingView.didMoveToWindow() + 272
9  SwiftUI                        0x1a72a73b8 @objc _UIHostingView.didMoveToWindow() + 28
10 UIKitCore                      0x1a32d51fc -[UIView(Internal) _didMoveFromWindow:toWindow:] + 2060
11 UIKitCore                      0x1a32d4c94 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 676
12 UIKitCore                      0x1a32c89e0 __45-[UIView(Hierarchy) _postMovedFromSuperview:]_block_invoke + 140
13 UIKitCore                      0x1a32c88cc -[UIView(Hierarchy) _postMovedFromSuperview:] + 808
14 UIKitCore                      0x1a32d7618 -[UIView(Internal) _addSubview:positioned:relativeTo:] + 2136
15 UIKitCore                      0x1a26f4d68 __53-[_UINavigationParallaxTransition animateTransition:]_block_invoke_2 + 1304
16 UIKitCore                      0x1a32d0a60 +[UIView(Animation) performWithoutAnimation:] + 104
17 UIKitCore                      0x1a26f47fc __53-[_UINavigationParallaxTransition animateTransition:]_block_invoke + 260
18 UIKitCore                      0x1a32d5fd8 +[UIView _performBlockDelayingTriggeringResponderEvents:forScene:] + 252
19 UIKitCore                      0x1a26f4224 -[_UINavigationParallaxTransition animateTransition:] + 1088
20 UIKitCore                      0x1a26e408c ___UIViewControllerTransitioningRunCustomTransition_block_invoke_2 + 76
21 UIKitCore                      0x1a281d728 +[UIInputResponderController _pinInputViewsForInputResponderController:onBehalfOfResponder:duringBlock:] + 116
22 UIKitCore                      0x1a26e4004 ___UIViewControllerTransitioningRunCustomTransition_block_invoke.663 + 204
23 UIKitCore                      0x1a32d073c +[UIView(Animation) _setAlongsideAnimations:toRunByEndOfBlock:] + 204
24 UIKitCore                      0x1a26e3e48 _UIViewControllerTransitioningRunCustomTransition + 640
25 UIKitCore                      0x1a25e6ad8 -[UINavigationController _startCustomTransition:] + 3244
26 UIKitCore                      0x1a25faf20 -[UINavigationController _startDeferredTransitionIfNeeded:] + 704
27 UIKitCore                      0x1a25fc364 -[UINavigationController __viewWillLayoutSubviews] + 168
28 UIKitCore                      0x1a25de690 -[UILayoutContainerView layoutSubviews] + 228
29 UIKitCore                      0x1a32dddd4 -[UIView(CALayerDelegate) layoutSublayersOfLayer:] + 2500
30 QuartzCore                     0x1a37e7280 -[CALayer layoutSublayers] + 296
31 QuartzCore                     0x1a37e773c CA::Layer::layout_if_needed(CA::Transaction*) + 524
32 QuartzCore                     0x1a37fbb64 CA::Layer::layout_and_display_if_needed(CA::Transaction*) + 144
33 QuartzCore                     0x1a3743114 CA::Context::commit_transaction(CA::Transaction*, double, double*) + 416
34 QuartzCore                     0x1a376e418 CA::Transaction::commit() + 732
35 QuartzCore                     0x1a376f778 CA::Transaction::observer_callback(__CFRunLoopObserver*, unsigned long, void*) + 96
36 CoreFoundation                 0x1a0412444 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 36
37 CoreFoundation                 0x1a040c858 __CFRunLoopDoObservers + 576
38 CoreFoundation                 0x1a040ce08 __CFRunLoopRun + 1056
39 CoreFoundation                 0x1a040c4bc CFRunLoopRunSpecific + 600
40 GraphicsServices               0x1b6e91820 GSEventRunModal + 164
41 UIKitCore                      0x1a2db0734 -[UIApplication _run] + 1072
42 UIKitCore                      0x1a2db5e10 UIApplicationMain + 168
43 Socials                        0x102a5bf58 main + 15 (SocialsColors.swift:15)
44 libdyld.dylib                  0x1a00d3e60 start + 4

Any idea what could be going wrong?

One thing I did notice was that in a few locations, I was calling the initializer with a hex larger than 6 characters! I wonder if this could have been the culprit?

// Passing in a value that's larger than 6 nibbles (7x4 = 28 bits!)
UIColor(hex: 0xdE6E6E6)

The reason is not here. Would you show ContentView or, better, provide minimal reproducible example? — Asperi, Sep 24 '20 at 03:10
Any luck on this? I'm getting a similar crash, stack trace looks almost the same but on a custom swipe to dismiss action when dismiss a child from a UINavigationController — Richard Ash, Oct 02 '20 at 03:19
I tried correcting the casting, but the issue still persists; I am going to convert them to use the Apple's default version and see what happens next. Would appreciate any more help! — Zorayr, Oct 02 '20 at 18:15
@Asperi so far, I have not been able to reproduce this issue locally. My suspicion is that it only occurs when compiling with prod flags. — Zorayr, Oct 02 '20 at 18:16
@Asperi think passing in 7 nibbles could have been the culprit? It doesn't reproduce, but I found these by accident in a handful of cases in my codebase. Otherwise, my current approach is to remove all bitwise operations/delete the extension and use some simple RGB based solution to see if indeed the extension was the culprit. — Zorayr, Oct 14 '20 at 20:44
@Zorayr no i didn't unfortunately! But found a workaround where the crash rate was reduced to essentially zero. It may have been something with how I was using SDWebImageSwiftUI — Richard Ash, Oct 15 '20 at 22:36
@ignaciohugog We switched from using their swiftui implementation, WebImage, to the version that wraps the UIKit version, AnimatedImage! — Richard Ash, Dec 01 '20 at 00:45

iOS 14 odd pointer jump with bitwise operation leading to a crash

0 Answers0