关于野指针crash的防治上问题讨论

[erduoniba]

思路是非常好，但是在实际中，有不少问题，反而导致crash涨了非常多。
1、如果hook系统的dealloc，会调用非常多次xx_danglingPointer_dealloc，导致系统其他异常crash，而且不少；
2、如果根据类，然后进行hook其dealloc方法，不要hook一些UIView的dealloc，会出现DanglingPointStub or one of its superclasses may have overridden -updateViewConstraints without calling super or sending -updateConstraints to the view. Or, something may have dirtied layout constraints in the middle of updating them. Both are programming errors.的crash

[ValiantCat]

嗯嗯 已经意识到这个问题，hook dealloc是一个非常危险的行为，越是复杂的项目风险越大，建议开启的时候不要开启野指针防护

[renmoqiqi]

有什么好的方法在野指针防护上

[erduoniba]

1、如果hook系统的dealloc，会调用非常多次xx_danglingPointer_dealloc，导致系统其他异常crash，而且不少，大部分是这类的crash：

===============================================================

1	libobjc.A.dylib	objc_release (in libobjc.A.dylib) + 16
2	CoreFoundation	-[__NSArrayM removeObjectsInRange:] (in CoreFoundation) + 300
3	libdispatch.dylib	_dispatch_call_block_and_release (in libdispatch.dylib) + 24
4	libdispatch.dylib	_dispatch_client_callout (in libdispatch.dylib) + 16
5	libdispatch.dylib	_dispatch_lane_concurrent_drain (in libdispatch.dylib) + 872
6	libdispatch.dylib	_dispatch_lane_invoke$VARIANT$armv81 (in libdispatch.dylib) + 508
7	libdispatch.dylib	_dispatch_queue_override_invoke (in libdispatch.dylib) + 372
8	libdispatch.dylib	_dispatch_root_queue_drain (in libdispatch.dylib) + 344
9	libdispatch.dylib	_dispatch_worker_thread2 (in libdispatch.dylib) + 112
10	libsystem_pthread.dylib	_pthread_wqthread (in libsystem_pthread.dylib) + 212

===============================================================

2、如果hook了UIVIew的类的dealloc，会出现类似这样的crash，也不少：

=================================================================================

1	CoreFoundation	__exceptionPreprocess (in CoreFoundation) + 228
2	libobjc.A.dylib	objc_exception_throw (in libobjc.A.dylib) + 56
3	CoreFoundation	-[NSException initWithCoder:] (in CoreFoundation) + 0
4	UIKit	-[UIView(AdditionalLayoutSupport) _sendUpdateConstraintsIfNecessaryForSecondPass:] (in UIKit) + 364
5	UIKit	-[UIView(AdditionalLayoutSupport) _updateConstraintsIfNeededCollectingViews:forSecondPass:] (in UIKit) + 1012
6	Foundation	-[NSISEngine withBehaviors:performModifications:] (in Foundation) + 120
7	UIKit	__100-[UIView(AdditionalLayoutSupport) _updateConstraintsIfNeededWithViewForVariableChangeNotifications:]_block_invoke (in UIKit) + 92
8	UIKit	-[UIView(AdditionalLayoutSupport) _withUnsatisfiableConstraintsLoggingSuspendedIfEngineDelegateExists:] (in UIKit) + 116
9	UIKit	-[UIView(AdditionalLayoutSupport) _updateConstraintsIfNeededWithViewForVariableChangeNotifications:] (in UIKit) + 168
10	UIKit	-[UIView(AdditionalLayoutSupport) _updateConstraintsAtEngineLevelIfNeededWithViewForVariableChangeNotifications:] (in UIKit) + 428
11	UIKit	-[UIView(Hierarchy) _updateConstraintsAsNecessaryAndApplyLayoutFromEngine] (in UIKit) + 272
12	UIKit	-[UIView(CALayerDelegate) layoutSublayersOfLayer:] (in UIKit) + 1420
13	QuartzCore	-[CALayer layoutSublayers] (in QuartzCore) + 184
14	QuartzCore	CA::Layer::layout_if_needed(CA::Transaction*) (in QuartzCore) + 324
15	QuartzCore	CA::Context::commit_transaction(CA::Transaction*) (in QuartzCore) + 320
16	QuartzCore	CA::Transaction::commit() (in QuartzCore) + 580
17	QuartzCore	CA::Transaction::observer_callback(__CFRunLoopObserver*, unsigned long, void*) (in QuartzCore) + 92
18	CoreFoundation	CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION (in CoreFoundation) + 32
19	CoreFoundation	__CFRunLoopDoObservers (in CoreFoundation) + 412
20	CoreFoundation	__CFRunLoopRun (in CoreFoundation) + 1436
21	CoreFoundation	CFRunLoopRunSpecific (in CoreFoundation) + 552
22	GraphicsServices	GSEventRunModal (in GraphicsServices) + 100
23	UIKit	UIApplicationMain (in UIKit) + 236

=================================================================================
原因是：

Application threw exception NSInternalInconsistencyException: The layout constraints still need update after sending -updateViewConstraints to <PGDanglingPointStub: 0x10e004000>. PGDanglingPointStub or one of its superclasses may have overridden -updateViewConstraints without calling super or sending -updateConstraints to the view. Or, something may have dirtied layout constraints in the middle of updating them. Both are programming errors.

目前先试试hook经常用的自定义非UIView类没有导致新的crash。需要看看效果。@renmoqiqi

[renmoqiqi]

1、如果hook系统的dealloc，会调用非常多次xx_danglingPointer_dealloc，导致系统其他异常crash，而且不少，大部分是这类的crash：

===============================================================

1 libobjc.A.dylib objc_release (in libobjc.A.dylib) + 16
2 CoreFoundation -[__NSArrayM removeObjectsInRange:] (in CoreFoundation) + 300
3 libdispatch.dylib _dispatch_call_block_and_release (in libdispatch.dylib) + 24
4 libdispatch.dylib _dispatch_client_callout (in libdispatch.dylib) + 16
5 libdispatch.dylib _dispatch_lane_concurrent_drain (in libdispatch.dylib) + 872
6 libdispatch.dylib _dispatch_lane_invoke$VARIANT$armv81 (in libdispatch.dylib) + 508
7 libdispatch.dylib _dispatch_queue_override_invoke (in libdispatch.dylib) + 372
8 libdispatch.dylib _dispatch_root_queue_drain (in libdispatch.dylib) + 344
9 libdispatch.dylib _dispatch_worker_thread2 (in libdispatch.dylib) + 112
10 libsystem_pthread.dylib _pthread_wqthread (in libsystem_pthread.dylib) + 212

2、如果hook了UIVIew的类的dealloc，会出现类似这样的crash，也不少：

1 CoreFoundation __exceptionPreprocess (in CoreFoundation) + 228
2 libobjc.A.dylib objc_exception_throw (in libobjc.A.dylib) + 56
3 CoreFoundation -[NSException initWithCoder:] (in CoreFoundation) + 0
4 UIKit -[UIView(AdditionalLayoutSupport) _sendUpdateConstraintsIfNecessaryForSecondPass:] (in UIKit) + 364
5 UIKit -[UIView(AdditionalLayoutSupport) _updateConstraintsIfNeededCollectingViews:forSecondPass:] (in UIKit) + 1012
6 Foundation -[NSISEngine withBehaviors:performModifications:] (in Foundation) + 120
7 UIKit __100-[UIView(AdditionalLayoutSupport) _updateConstraintsIfNeededWithViewForVariableChangeNotifications:]_block_invoke (in UIKit) + 92
8 UIKit -[UIView(AdditionalLayoutSupport) _withUnsatisfiableConstraintsLoggingSuspendedIfEngineDelegateExists:] (in UIKit) + 116
9 UIKit -[UIView(AdditionalLayoutSupport) _updateConstraintsIfNeededWithViewForVariableChangeNotifications:] (in UIKit) + 168
10 UIKit -[UIView(AdditionalLayoutSupport) _updateConstraintsAtEngineLevelIfNeededWithViewForVariableChangeNotifications:] (in UIKit) + 428
11 UIKit -[UIView(Hierarchy) _updateConstraintsAsNecessaryAndApplyLayoutFromEngine] (in UIKit) + 272
12 UIKit -[UIView(CALayerDelegate) layoutSublayersOfLayer:] (in UIKit) + 1420
13 QuartzCore -[CALayer layoutSublayers] (in QuartzCore) + 184
14 QuartzCore CA::Layer::layout_if_needed(CA::Transaction*) (in QuartzCore) + 324
15 QuartzCore CA::Context::commit_transaction(CA::Transaction*) (in QuartzCore) + 320
16 QuartzCore CA::Transaction::commit() (in QuartzCore) + 580
17 QuartzCore CA::Transaction::observer_callback(__CFRunLoopObserver*, unsigned long, void*) (in QuartzCore) + 92
18 CoreFoundation CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION (in CoreFoundation) + 32
19 CoreFoundation __CFRunLoopDoObservers (in CoreFoundation) + 412
20 CoreFoundation __CFRunLoopRun (in CoreFoundation) + 1436
21 CoreFoundation CFRunLoopRunSpecific (in CoreFoundation) + 552
22 GraphicsServices GSEventRunModal (in GraphicsServices) + 100
23 UIKit UIApplicationMain (in UIKit) + 236

原因是：

Application threw exception NSInternalInconsistencyException: The layout constraints still need update after sending -updateViewConstraints to <PGDanglingPointStub: 0x10e004000>. PGDanglingPointStub or one of its superclasses may have overridden -updateViewConstraints without calling super or sending -updateConstraints to the view. Or, something may have dirtied layout constraints in the middle of updating them. Both are programming errors.  
目前现试试hook经常用的自定义非UIView类没有导致新的crash。需要看看效果。@renmoqiqi

期待你的试研结果

[ValiantCat]

暂时无解，我目前在的大型项目也很没使用野指针防护

[puyang0521]

我们项目中，涉及到非常多的线程读写，为了确保在主线程进行UI布局，就hook了layoutSubviews的方法。
目前bugly上频繁出现类似这样的bug。直观上看，应该就是可变字典的重复释放导致的，但是Debug无法复现。

我怀疑和交换layoutSubviews方法有关，但是无法断定。我不知道对于这类的问题bugly给出的信息是否足够准确

[chanbendong]

1、如果hook系统的dealloc，会调用非常多次xx_danglingPointer_dealloc，导致系统其他异常crash，而且不少，大部分是这类的crash：

===============================================================

1 libobjc.A.dylib objc_release (in libobjc.A.dylib) + 16
2 CoreFoundation -[__NSArrayM removeObjectsInRange:] (in CoreFoundation) + 300
3 libdispatch.dylib _dispatch_call_block_and_release (in libdispatch.dylib) + 24
4 libdispatch.dylib _dispatch_client_callout (in libdispatch.dylib) + 16
5 libdispatch.dylib _dispatch_lane_concurrent_drain (in libdispatch.dylib) + 872
6 libdispatch.dylib _dispatch_lane_invoke$VARIANT$armv81 (in libdispatch.dylib) + 508
7 libdispatch.dylib _dispatch_queue_override_invoke (in libdispatch.dylib) + 372
8 libdispatch.dylib _dispatch_root_queue_drain (in libdispatch.dylib) + 344
9 libdispatch.dylib _dispatch_worker_thread2 (in libdispatch.dylib) + 112
10 libsystem_pthread.dylib _pthread_wqthread (in libsystem_pthread.dylib) + 212

2、如果hook了UIVIew的类的dealloc，会出现类似这样的crash，也不少：

1 CoreFoundation __exceptionPreprocess (in CoreFoundation) + 228
2 libobjc.A.dylib objc_exception_throw (in libobjc.A.dylib) + 56
3 CoreFoundation -[NSException initWithCoder:] (in CoreFoundation) + 0
4 UIKit -[UIView(AdditionalLayoutSupport) _sendUpdateConstraintsIfNecessaryForSecondPass:] (in UIKit) + 364
5 UIKit -[UIView(AdditionalLayoutSupport) _updateConstraintsIfNeededCollectingViews:forSecondPass:] (in UIKit) + 1012
6 Foundation -[NSISEngine withBehaviors:performModifications:] (in Foundation) + 120
7 UIKit __100-[UIView(AdditionalLayoutSupport) _updateConstraintsIfNeededWithViewForVariableChangeNotifications:]_block_invoke (in UIKit) + 92
8 UIKit -[UIView(AdditionalLayoutSupport) _withUnsatisfiableConstraintsLoggingSuspendedIfEngineDelegateExists:] (in UIKit) + 116
9 UIKit -[UIView(AdditionalLayoutSupport) _updateConstraintsIfNeededWithViewForVariableChangeNotifications:] (in UIKit) + 168
10 UIKit -[UIView(AdditionalLayoutSupport) _updateConstraintsAtEngineLevelIfNeededWithViewForVariableChangeNotifications:] (in UIKit) + 428
11 UIKit -[UIView(Hierarchy) _updateConstraintsAsNecessaryAndApplyLayoutFromEngine] (in UIKit) + 272
12 UIKit -[UIView(CALayerDelegate) layoutSublayersOfLayer:] (in UIKit) + 1420
13 QuartzCore -[CALayer layoutSublayers] (in QuartzCore) + 184
14 QuartzCore CA::Layer::layout_if_needed(CA::Transaction*) (in QuartzCore) + 324
15 QuartzCore CA::Context::commit_transaction(CA::Transaction*) (in QuartzCore) + 320
16 QuartzCore CA::Transaction::commit() (in QuartzCore) + 580
17 QuartzCore CA::Transaction::observer_callback(__CFRunLoopObserver*, unsigned long, void*) (in QuartzCore) + 92
18 CoreFoundation CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION (in CoreFoundation) + 32
19 CoreFoundation __CFRunLoopDoObservers (in CoreFoundation) + 412
20 CoreFoundation __CFRunLoopRun (in CoreFoundation) + 1436
21 CoreFoundation CFRunLoopRunSpecific (in CoreFoundation) + 552
22 GraphicsServices GSEventRunModal (in GraphicsServices) + 100
23 UIKit UIApplicationMain (in UIKit) + 236
================================================================================= 原因是：

Application threw exception NSInternalInconsistencyException: The layout constraints still need update after sending -updateViewConstraints to <PGDanglingPointStub: 0x10e004000>. PGDanglingPointStub or one of its superclasses may have overridden -updateViewConstraints without calling super or sending -updateConstraints to the view. Or, something may have dirtied layout constraints in the middle of updating them. Both are programming errors.  
目前现试试hook经常用的自定义非UIView类没有导致新的crash。需要看看效果。@renmoqiqi

其实可以只防御自定义，定义一个白名单就可以，可以通过dyld去获取自定义类。但是我这边是有另外的问题，在list存取的时候经常发生野指针崩溃，这个就奇怪

[ValiantCat]

个人建议废弃掉这个功能，以前编写这个项目的时候对野指针的认知有限。目前看起来这个方案是非常不合适并且没有意义的