SEGFileStorage dataFromPlist:

[leandromperez]

Hi,
We're seeing several crashes with the following stack trace:

#0	(null) in CFGetTypeID ()
#1	(null) in _CFAppendXML0 ()
#2	(null) in _CFAppendXML0 ()
#3	(null) in _CFAppendXML0 ()
#4	(null) in _CFAppendXML0 ()
#5	(null) in _CFAppendXML0 ()
#6	(null) in _CFPropertyListCreateXMLData ()
#7	(null) in CFPropertyListCreateData ()
#8	(null) in +[NSPropertyListSerialization dataWithPropertyList:format:options:error:] ()
#9	0x0000000105539cb8 in -[SEGFileStorage dataFromPlist:] at /MyApp/Pods/Analytics/Analytics/Classes/Internal/SEGFileStorage.m:149
#10	0x0000000105539c28 in -[SEGFileStorage setPlist:forKey:] at /MyApp/Pods/Analytics/Analytics/Classes/Internal/SEGFileStorage.m:140
#11	0x00000001055399f8 in -[SEGFileStorage setArray:forKey:] at /MyApp/Pods/Analytics/Analytics/Classes/Internal/SEGFileStorage.m:105
#12	0x0000000105544838 in -[SEGSegmentIntegration persistQueue] at /MyApp/Pods/Analytics/Analytics/Classes/Internal/SEGSegmentIntegration.m:630
#13	0x0000000105543964 in -[SEGSegmentIntegration queuePayload:] at /MyApp/Pods/Analytics/Analytics/Classes/Internal/SEGSegmentIntegration.m:470
#14	0x00000001055437b4 in __71-[SEGSegmentIntegration enqueueAction:dictionary:context:integrations:]_block_invoke at /MyApp/Pods/Analytics/Analytics/Classes/Internal/SEGSegmentIntegration.m:460
#15	0x00000001055386bc in __seg_dispatch_specific_block_invoke at /MyApp/Pods/Analytics/Analytics/Classes/Internal/SEGAnalyticsUtils.m:64
#16	(null) in _dispatch_call_block_and_release ()
#17	(null) in _dispatch_client_callout ()
#18	(null) in _dispatch_lane_serial_drain$VARIANT$armv81 ()
#19	(null) in _dispatch_lane_invoke$VARIANT$armv81 ()
#20	(null) in _dispatch_workloop_worker_thread ()
#21	(null) in _pthread_wqthread ()
#22	(null) in start_wqthread ()

The crashes occur in background threads.

Any ideas on what might be the issue?

• Analytics (3.7.0)
• iOS 12.x

[J-Mendes]

I'm already seeing this a lot after I've upgraded to the version 3.7.0. I can also see this happening on iOS 13 devices.

[zzzworm]

Same issue here, pls fix it!

[bsneed]

We've prioritized this and are looking into it.

[bsneed]

does anyone happen to have logs for this? The log it spits out would include the exact error it's getting ...

- (NSData *_Nullable)dataFromPlist:(nonnull id)plist
{
    NSError *error = nil;
    NSData *data = [NSPropertyListSerialization dataWithPropertyList:plist
                                                              format:NSPropertyListXMLFormat_v1_0
                                                             options:0
                                                               error:&error];
    if (error) {
        SEGLog(@"Unable to serialize data from plist object", error, plist);
    }
    return data;
}

[bsneed]

@zzzworm @J-Mendes @leandromperez

[sergiymomot]

Have the same or related crash in 3.7.0 version

1. There will be no log printed as that function crashes before SEGLog is executed
   Specifically at line
   NSData *data = [NSPropertyListSerialization dataWithPropertyList:plist ...

2. My crash stack trace is almost the same with this error:
   EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x0000b5d617be5490

0  libobjc.A.dylib                0x1b5f2b028 objc_retain + 8 
1  CoreFoundation                 0x1b60c8208 -[__NSArrayM replaceObjectsInRange:withObjects:count:] + 172
2  CoreFoundation                 0x1b6159048 _CFAppendXML0 + 2684
3  CoreFoundation                 0x1b6159170 _CFAppendXML0 + 2980
4  CoreFoundation                 0x1b6159170 _CFAppendXML0 + 2980
5  CoreFoundation                 0x1b6158ed8 _CFAppendXML0 + 2316
6  CoreFoundation                 0x1b6155464 _CFPropertyListCreateXMLData + 184
7  CoreFoundation                 0x1b61574d4 CFPropertyListCreateData + 216
8  Foundation                     0x1b64d7e20 +[NSPropertyListSerialization dataWithPropertyList:format:options:error:] + 48
9  Analytics                      0x1031da318 -[SEGFileStorage dataFromPlist:] + 149 (SEGFileStorage.m:149)

3. Happens in both background and foreground

[bsneed]

@sergiymomot ah, thanks for the clarification. I'd guess something is getting added that can't be deserialized maybe. are you seeing this locally, or just seeing it in your crash reporting tools?

[sergiymomot]

@bsneed Only in Crashlytics
Couldn't reproduce it locally

It happened for about 100 users in a month, so it is pretty rare, but still annoying
Also it happens once per person from what I see, so it might be a one-time data mismatch

[zzzworm]

I just catch the log from debug. see:

2019-11-14 13:39:13.612370+0800 Himalaya[18617:4501255] Running: registeredForRemoteNotificationsWithDeviceToken: with arguments (
{length = 32, bytes = 0xce20a703 2ee2772d 76809052 5b0e7968 ... 42e21076 87612780 }
) on integration: Segment.io
2019-11-14 13:39:13.622064+0800 Himalaya[18617:4501247] 💛 13:39:13.6200:IterableAPIInternal:register(token:appName:pushServicePlatform:notificationsEnabled:onSuccess:onFailure:):180: sending registerToken request with args [AnyHashable("preferUserId"): true, AnyHashable("userId"): "913808", AnyHashable("device"): ["platform": "APNS_SANDBOX", "dataFields": ["userInterfaceIdiom": "Phone", "localizedModel": "iPhone", "identifierForVendor": "C2F1BFE4-3AFF-4D6F-9732-1C8EEFE4B78C", "appBuild": "3226", "systemVersion": "13.2", "iterableSdkVersion": "6.1.2", "deviceId": "F68CC888-CADC-455D-99BA-EBA98AAC728F", "model": "iPhone", "systemName": "iOS", "appPackageName": "com.ximalaya.xmlyi", "appVersion": "2.3.70", "notificationsEnabled": true], "applicationName": "himalaya_dev", "token": "ce20a7032ee2772d768090525b0e79686000fad7652d83e042e2107687612780"]]
2019-11-14 13:39:13.625564+0800 Himalaya[18617:4501380] Running: identify: with arguments (
"<SEGIdentifyPayload: 0x12b23fee0>"
) on integration: Segment.io
2019-11-14 13:39:13.629688+0800 Himalaya[18617:4501380] push granted
2019-11-14 13:39:13.630061+0800 Himalaya[18617:4500956] didRegisterForRemoteNotificationsWithDeviceToken ce20a7032ee2772d768090525b0e79686000fad7652d83e042e2107687612780
2019-11-14 13:39:13.631347+0800 Himalaya[18617:4500956] !!!! push token ce20a7032ee2772d768090525b0e79686000fad7652d83e042e2107687612780
2019-11-14 13:39:13.635543+0800 Himalaya[18617:4501379] Running: registeredForRemoteNotificationsWithDeviceToken: with arguments (
{length = 32, bytes = 0xce20a703 2ee2772d 76809052 5b0e7968 ... 42e21076 87612780 }
) on integration: Segment.io
2019-11-14 13:39:13.637265+0800 Himalaya[18617:4501230] *** -[CFString _fastCharacterContents]: message sent to deallocated instance 0x12b23a310

and the crash stack:

Thread 11 Queue : io.segment.analytics.segmentio (serial)
#0 0x00000001a7da7270 in forwarding.cold.2 ()
#1 0x00000001a7d4c184 in forwarding ()
#2 0x00000001a7d4e3f0 in _CF_forwarding_prep_0 ()
#3 0x00000001a7cb58dc in _appendEscapedString ()
#4 0x00000001a7cb4c04 in _CFAppendXML0 ()
#5 0x00000001a7cb56e0 in _CFAppendXML0 ()
#6 0x00000001a7cb56e0 in _CFAppendXML0 ()
#7 0x00000001a7cb56e0 in _CFAppendXML0 ()
#8 0x00000001a7cb5448 in _CFAppendXML0 ()
#9 0x00000001a7cb1938 in _CFPropertyListCreateXMLData ()
#10 0x00000001a7cb39e4 in CFPropertyListCreateData ()
#11 0x00000001a803adc4 in +[NSPropertyListSerialization dataWithPropertyList:format:options:error:] ()
#12 0x0000000104226f58 in -[SEGFileStorage dataFromPlist:] ()
#13 0x0000000104226ec8 in -[SEGFileStorage setPlist:forKey:] ()
#14 0x0000000104226c98 in -[SEGFileStorage setArray:forKey:] ()
#15 0x00000001042317ac in -[SEGSegmentIntegration persistQueue] ()
#16 0x000000010423096c in -[SEGSegmentIntegration queuePayload:] ()
#17 0x000000010423083c in __71-[SEGSegmentIntegration enqueueAction:dictionary:context:integrations:]_block_invoke ()
#18 0x00000001042259c4 in __seg_dispatch_specific_block_invoke ()
#19 0x00000001094dde1c in _dispatch_call_block_and_release ()
#20 0x00000001094df27c in _dispatch_client_callout ()
#21 0x00000001094e690c in _dispatch_lane_serial_drain ()
#22 0x00000001094e74fc in _dispatch_lane_invoke ()
#23 0x00000001094f24dc in _dispatch_workloop_worker_thread ()
#24 0x00000001a7a53a94 in _pthread_wqthread ()

other stacks:

Thread 1 Queue : com.apple.main-thread (serial)
#0 0x00000001a7b10c04 in mach_msg_trap ()
#1 0x00000001a7b10020 in mach_msg ()
#2 0x00000001a7cc2aa8 in __CFRunLoopServiceMachPort ()
#3 0x00000001a7cbd940 in __CFRunLoopRun ()
#4 0x00000001a7cbd084 in CFRunLoopRunSpecific ()
#5 0x00000001b1f0b534 in GSEventRunModal ()
#6 0x00000001abe2d698 in UIApplicationMain ()
#7 0x000000010415c9dc in main at /Users/nali/Documents/studyspace/XMIProjects/xmlyi/xmlyi/Resources/Other-Sources/main.m:16
#8 0x00000001a7b3ce18 in start ()
Thread 3#0 0x00000001a7b33ab4 in __workq_kernreturn ()
gputools.smt_poll.0x10d802080 (4)#0 0x00000001a7b33278 in __semwait_signal ()
#1 0x00000001a79df748 in nanosleep ()
#2 0x00000001a79df618 in usleep ()
#3 0x00000001096c8764 in smt_poll_thread_entry(void*) ()
#4 0x00000001a7a51d50 in _pthread_start ()
gputools.smt_poll.0x10d906490 (5)#0 0x00000001a7b33278 in __semwait_signal ()
#1 0x00000001a79df748 in nanosleep ()
#2 0x00000001a79df618 in usleep ()
#3 0x0000000107ccc88c in ___lldb_unnamed_symbol1787$$libMTLCapture.dylib ()
#4 0x00000001a7a51d50 in _pthread_start ()
Thread 6#0 0x00000001a7b33ab4 in __workq_kernreturn ()
Thread 7 Queue : com.apple.NSURLSession-work (serial)
#0 0x00000001bb22b818 in uniquing_table_stack_retain ()
#1 0x00000001bb22c5ac in add_stack_to_ptr ()
#2 0x00000001bb22d040 in stack_logging_lite_malloc ()
#3 0x00000001a7a3a25c in default_zone_malloc ()
#4 0x00000001a7a37728 in malloc_zone_malloc ()
#5 0x00000001a7c606dc in CFAllocatorAllocate ()
#6 0x00000001a7cfb744 in __CFStrAllocateMutableContents ()
#7 0x00000001a7cfafec in __CFStringChangeSizeMultiple ()
#8 0x00000001a7ce8998 in CFStringCreateMutableCopy ()
#9 0x00000001ab0f2568 in ___lldb_unnamed_symbol5991$$CFNetwork ()
#10 0x00000001ab0386e0 in ___lldb_unnamed_symbol2368$$CFNetwork ()
#11 0x00000001ab1b58f8 in ___lldb_unnamed_symbol10931$$CFNetwork ()
#12 0x00000001ab05e770 in ___lldb_unnamed_symbol3070$$CFNetwork ()
#13 0x00000001aafd0e4c in ___lldb_unnamed_symbol299$$CFNetwork ()
#14 0x00000001aafceb6c in ___lldb_unnamed_symbol251$$CFNetwork ()
#15 0x00000001ab0611dc in ___lldb_unnamed_symbol3167$$CFNetwork ()
#16 0x00000001094eda18 in _dispatch_block_async_invoke2 ()
#17 0x00000001094df27c in _dispatch_client_callout ()
#18 0x00000001094e690c in _dispatch_lane_serial_drain ()
#19 0x00000001094e7538 in _dispatch_lane_invoke ()
#20 0x00000001094f24dc in _dispatch_workloop_worker_thread ()
#21 0x00000001a7a53a94 in _pthread_wqthread ()
Thread 8#0 0x00000001a7b33ab4 in __workq_kernreturn ()
com.apple.uikit.eventfetch-thread (9)#0 0x00000001a7b10c04 in mach_msg_trap ()
#1 0x00000001a7b10020 in mach_msg ()
#2 0x00000001a7cc2aa8 in __CFRunLoopServiceMachPort ()
#3 0x00000001a7cbd940 in __CFRunLoopRun ()
#4 0x00000001a7cbd084 in CFRunLoopRunSpecific ()
#5 0x00000001a80023d0 in -[NSRunLoop(NSRunLoop) runMode:beforeDate:] ()
#6 0x00000001a80022a8 in -[NSRunLoop(NSRunLoop) runUntilDate:] ()
#7 0x00000001abec9170 in -[UIEventFetcher threadMain] ()
#8 0x00000001a8001034 in -[NSThread main] ()
#9 0x00000001a813ca8c in NSThread__start ()
#10 0x00000001a7a51d50 in _pthread_start ()
Thread 11 Queue : io.segment.analytics.segmentio (serial)
#0 0x00000001a7da7270 in forwarding.cold.2 ()
#1 0x00000001a7d4c184 in forwarding ()
#2 0x00000001a7d4e3f0 in _CF_forwarding_prep_0 ()
#3 0x00000001a7cb58dc in _appendEscapedString ()
#4 0x00000001a7cb4c04 in _CFAppendXML0 ()
#5 0x00000001a7cb56e0 in _CFAppendXML0 ()
#6 0x00000001a7cb56e0 in _CFAppendXML0 ()
#7 0x00000001a7cb56e0 in _CFAppendXML0 ()
#8 0x00000001a7cb5448 in _CFAppendXML0 ()
#9 0x00000001a7cb1938 in _CFPropertyListCreateXMLData ()
#10 0x00000001a7cb39e4 in CFPropertyListCreateData ()
#11 0x00000001a803adc4 in +[NSPropertyListSerialization dataWithPropertyList:format:options:error:] ()
#12 0x0000000104226f58 in -[SEGFileStorage dataFromPlist:] ()
#13 0x0000000104226ec8 in -[SEGFileStorage setPlist:forKey:] ()
#14 0x0000000104226c98 in -[SEGFileStorage setArray:forKey:] ()
#15 0x00000001042317ac in -[SEGSegmentIntegration persistQueue] ()
#16 0x000000010423096c in -[SEGSegmentIntegration queuePayload:] ()
#17 0x000000010423083c in __71-[SEGSegmentIntegration enqueueAction:dictionary:context:integrations:]_block_invoke ()
#18 0x00000001042259c4 in __seg_dispatch_specific_block_invoke ()
#19 0x00000001094dde1c in _dispatch_call_block_and_release ()
#20 0x00000001094df27c in _dispatch_client_callout ()
#21 0x00000001094e690c in _dispatch_lane_serial_drain ()
#22 0x00000001094e74fc in _dispatch_lane_invoke ()
#23 0x00000001094f24dc in _dispatch_workloop_worker_thread ()
#24 0x00000001a7a53a94 in _pthread_wqthread ()
Thread 12#0 0x00000001a7b33ab4 in __workq_kernreturn ()
Thread 13 Queue : com.apple.CFNetwork.LoaderQ (serial)
#0 0x00000001a7b338f0 in __ulock_wait ()
#1 0x00000001a7a4d040 in _os_unfair_lock_lock_slow ()
#2 0x00000001bb22b5d4 in uniquing_table_stack_retain ()
#3 0x00000001bb22c5ac in add_stack_to_ptr ()
#4 0x00000001bb22c444 in stack_logging_lite_memalign ()
#5 0x00000001a7a3a624 in default_zone_memalign ()
#6 0x00000001a7a37e30 in malloc_zone_memalign ()
#7 0x00000001a7a7a2a8 in AutoreleasePoolPage::autoreleaseFullPage(objc_object*, AutoreleasePoolPage*) ()
#8 0x00000001a7d54970 in _CFAutoreleasePoolPush ()
#9 0x00000001a800e5ac in -[NSAutoreleasePool init] ()
#10 0x00000001ab0eb6a8 in ___lldb_unnamed_symbol5830$$CFNetwork ()
#11 0x00000001ab0ebaa4 in ___lldb_unnamed_symbol5834$$CFNetwork ()
#12 0x00000001ab0e99f0 in ___lldb_unnamed_symbol5819$$CFNetwork ()
#13 0x00000001ab0e7ef8 in ___lldb_unnamed_symbol5817$$CFNetwork ()
#14 0x00000001ab111e4c in ___lldb_unnamed_symbol6717$$CFNetwork ()
#15 0x00000001ab1da2c4 in ___lldb_unnamed_symbol11867$$CFNetwork ()
#16 0x00000001094dde1c in _dispatch_call_block_and_release ()
#17 0x00000001094df27c in _dispatch_client_callout ()
#18 0x00000001094e690c in _dispatch_lane_serial_drain ()
#19 0x00000001094e7538 in _dispatch_lane_invoke ()
#20 0x00000001094e16bc in _dispatch_workloop_stealer_invoke ()
#21 0x00000001094e88ec in _dispatch_workloop_invoke2 ()
#22 0x00000001094e82a0 in _dispatch_workloop_invoke ()
#23 0x00000001094f24dc in _dispatch_workloop_worker_thread ()
#24 0x00000001a7a53a94 in _pthread_wqthread ()
Thread 14#0 0x00000001a7b33278 in __semwait_signal ()
#1 0x00000001a79df748 in nanosleep ()
#2 0x00000001a79df538 in sleep ()
#3 0x00000001045577a4 in monitorCachedData at /Users/stephen/Documents/Work/Bugtags/Bugtags-iOS-SDK/Bugtags/Bugtags/Crash/KSCrash/Recording/KSCrashCachedData.c:161
#4 0x00000001a7a51d50 in _pthread_start ()
com.apple.NSURLConnectionLoader (15)#0 0x00000001a7b10c04 in mach_msg_trap ()
#1 0x00000001a7b10020 in mach_msg ()
#2 0x00000001a7cc2aa8 in __CFRunLoopServiceMachPort ()
#3 0x00000001a7cbd940 in __CFRunLoopRun ()
#4 0x00000001a7cbd084 in CFRunLoopRunSpecific ()
#5 0x00000001aafbcf18 in ___lldb_unnamed_symbol3$$CFNetwork ()
#6 0x00000001a8001034 in -[NSThread main] ()
#7 0x00000001a813ca8c in NSThread__start ()
#8 0x00000001a7a51d50 in _pthread_start ()
Thread 16#0 0x00000001a7b33ab4 in __workq_kernreturn ()
Thread 17#0 0x00000001a7b32ccc in __psynch_cvwait ()
#1 0x00000001a7a554fc in _pthread_cond_wait ()
#2 0x00000001059177d4 in ::wait() at /Users/vercity/Desktop/mars-1.2.2/mars/comm/unix/thread/condition.h:73
#3 0x000000010591768c in ::wait() at /Users/vercity/Desktop/mars-1.2.2/mars/comm/unix/thread/condition.h:94
#4 0x0000000105915398 in ::__async_log_thread() at /Users/vercity/Desktop/mars-1.2.2/mars/log/src/appender.cc:619
#5 0x00000001059186e8 in ::start_routine() at /Users/vercity/Desktop/mars-1.2.2/mars/comm/unix/thread/thread.h:411
#6 0x00000001a7a51d50 in _pthread_start ()
Thread 18#0 0x00000001a7b33ab4 in __workq_kernreturn ()
Thread 19#0 0x00000001a7b33ab4 in __workq_kernreturn ()
Realm notification listener (20)Thread 21#0 0x00000001a7b33ab4 in __workq_kernreturn ()
Thread 22 Queue : com.google.fira.worker (serial)
#0 0x00000001a9a1f3b4 in ___lldb_unnamed_symbol365$$libsqlite3.dylib ()
#1 0x00000001a99e0860 in sqlite3_column_type ()
#2 0x00000001047359e4 in -[APMSqliteStore valueAtColumn:forStatement:] ()
#3 0x000000010473450c in -[APMSqliteStore recordsForQuery:parameterValues:error:withFilter:] ()
#4 0x000000010473428c in -[APMSqliteStore recordsForQuery:parameterValues:error:] ()
#5 0x0000000104701954 in -[APMDatabase allDataTypesFromTableWithName:tableLimit:error:createDataTypeBlock:] ()
#6 0x00000001046fa658 in -[APMDatabase userAttributesIncludingInternal:error:] ()
#7 0x000000010470d3e4 in __42-[APMMeasurement writeEventOnWorkerQueue:]_block_invoke.1214 ()
#8 0x0000000104734928 in -[APMSqliteStore performTransaction:] ()
#9 0x000000010470c430 in -[APMMeasurement writeEventOnWorkerQueue:] ()
#10 0x000000010470bbe0 in -[APMMeasurement handleEventOnWorkerQueue:] ()
#11 0x00000001047203b4 in __51-[APMScheduler scheduleOnWorkerQueueBlockID:block:]_block_invoke ()
#12 0x00000001094dde1c in _dispatch_call_block_and_release ()
#13 0x00000001094df27c in _dispatch_client_callout ()
#14 0x00000001094e690c in _dispatch_lane_serial_drain ()
#15 0x00000001094e74fc in _dispatch_lane_invoke ()
#16 0x00000001094f24dc in _dispatch_workloop_worker_thread ()
#17 0x00000001a7a53a94 in _pthread_wqthread ()
Thread 25#0 0x00000001a7a59c74 in start_wqthread ()
Thread 26#0 0x00000001a7a59c74 in start_wqthread ()
Thread 27#0 0x00000001a7b33ab4 in __workq_kernreturn ()

[bsneed]

I'll leave this open until we push out a beta containing the fix.

[sergiymomot]

@bsneed The fix using try/catch you pushed didn't work as the issue is not related to unhandled exception. It still crashes for me in production.

[bsneed]

@sergiymomot please try master. Follow on changes remove the usage of the plots serialization stuff. It would really be helpful if you continue to see it to grab the counts of the payload you’re attempting to serialize. I’m flying blind without data.

[zzzworm]

Any update on this issue? Did master solve this crash?