MKMapSnapshotter crashes intermittently with EXC_BAD_ACCESS

Originator:futuretap
Number:rdar://15351647 Date Originated:30-Oct-2013 05:04 PM
Status:Resolved Resolved:iOS 8 GM (Build: 12A365)
Product:iOS SDK Product Version:7.0
Classification:Crash Reproducible:Unable
 
This code intermittently crashes:

[[[MKMapSnapshotter alloc] initWithOptions:mapSnapshotOptions] startWithCompletionHandler:^(MKMapSnapshot *snapshot, NSError *error) {
// completion Handler
}];


I did see this mostly on the Simulator so far because I haven't yet tested extensively on the device.

(lldb) bt
* thread #277: tid = 0x32906d, 0x00000000, queue = 'com.apple.maps.snapshotter, stop reason = EXC_BAD_ACCESS (code=2, address=0x0)
    frame #0: 0x00000000
    frame #1: 0x1691a145 GLEngine`gleFlushAtomicFunc + 17
    frame #2: 0x1694e6b9 GLEngine`gleDrawArraysOrElements_ExecCore + 553
    frame #3: 0x1694c382 GLEngine`glDrawElements_IMM_ES2Exec + 330
    frame #4: 0x02f89b6d OpenGLES`glDrawElements + 65
    frame #5: 0x0b458eec VectorKit`-[VGLMesh drawTrianglesWithContext:offset:count:] + 108
    frame #6: 0x0b4a93e6 VectorKit`coalesceDraw(std::__1::vector<VGLMeshLeafNode, vk_allocator<VGLMeshLeafNode> > const&, std::__1::bitset<32ul> const&, VGLCullableMesh*, VGLContext*, std::__1::shared_ptr<VGLMeshNode> const&, _NSRange) + 534
    frame #7: 0x0b4a91c2 VectorKit`-[VGLCullableMesh drawInPreparedCulls:] + 114
    frame #8: 0x0b5270bc VectorKit`-[VKRoadPainter drawRoadTiles:context:layer:withModel:scene:stencilOffset:needsTileStencil:atopTransparent:includeBorders:] + 22252
    frame #9: 0x0b449794 VectorKit`-[VKRoadMapModel drawScene:withContext:] + 260
    frame #10: 0x0b3b852f VectorKit`-[VKModelObject drawScene:withContext:pass:] + 47
    frame #11: 0x0b3b8376 VectorKit`-[VKModelObject recursiveDrawScene:whenReadyWithContext:pass:] + 150
    frame #12: 0x0b3c1f38 VectorKit`-[VKMapModel recursiveDrawScene:withContext:pass:] + 472
    frame #13: 0x0b3b7e18 VectorKit`-[VKModelObject recursiveDrawScene:withContext:pass:] + 344
    frame #14: 0x0b3d7250 VectorKit`-[VKWorld drawScene:withContext:] + 64
    frame #15: 0x0b4cb90a VectorKit`__29-[VKImageCanvas renderScene:]_block_invoke + 346
    frame #16: 0x0b44f325 VectorKit`-[VGLContext perform:] + 85
    frame #17: 0x0b4cb6bd VectorKit`-[VKImageCanvas renderScene:] + 189
    frame #18: 0x0b4ca7f1 VectorKit`__52-[VKMapSnapshotCreator mapModelWillBecomFullyDrawn:]_block_invoke + 97
    frame #19: 0x040db7f8 libdispatch.dylib`_dispatch_call_block_and_release + 15
    frame #20: 0x040f04b0 libdispatch.dylib`_dispatch_client_callout + 14
    frame #21: 0x040de07f libdispatch.dylib`_dispatch_queue_drain + 452
    frame #22: 0x040dde7a libdispatch.dylib`_dispatch_queue_invoke + 128
    frame #23: 0x040dee1f libdispatch.dylib`_dispatch_root_queue_drain + 83
    frame #24: 0x040df137 libdispatch.dylib`_dispatch_worker_thread2 + 39
    frame #25: 0x0447cdab libsystem_pthread.dylib`_pthread_wqthread + 336



Ortwin Gentz 30-Oct-2013 07:36 PM

another backtrace, also from the Simulator:

(lldb) bt
* thread #15: tid = 0x385954, 0x18ddc042, queue = 'com.apple.vectorkit.dispatch.renderqueue.0xd6804b0, stop reason = EXC_BAD_ACCESS (code=2, address=0x50)
    frame #0: 0x18ddc042
    frame #1: 0x18dd968d
    frame #2: 0x16c428f5 GLRendererFloat`gldRenderFillPolygonPtr + 90
    frame #3: 0x18dda36d
    frame #4: 0x16992145 GLEngine`gleFlushAtomicFunc + 17
    frame #5: 0x169c66b9 GLEngine`gleDrawArraysOrElements_ExecCore + 553
    frame #6: 0x169c4382 GLEngine`glDrawElements_IMM_ES2Exec + 330
    frame #7: 0x02f88b6d OpenGLES`glDrawElements + 65
    frame #8: 0x0b457eec VectorKit`-[VGLMesh drawTrianglesWithContext:offset:count:] + 108
    frame #9: 0x0b4a83e6 VectorKit`coalesceDraw(std::__1::vector<VGLMeshLeafNode, vk_allocator<VGLMeshLeafNode> > const&, std::__1::bitset<32ul> const&, VGLCullableMesh*, VGLContext*, std::__1::shared_ptr<VGLMeshNode> const&, _NSRange) + 534
    frame #10: 0x0b4a84f6 VectorKit`-[VGLCullableMesh drawInRects:numRects:context:] + 150
    frame #11: 0x0b439b4e VectorKit`-[VKPolygonMapModel renderNormalPolygonsInRenderStepSet:withWidth:minDepth:context:] + 4734
    frame #12: 0x0b4383e7 VectorKit`-[VKPolygonMapModel drawRenderStepSet:scene:withContext:] + 311
    frame #13: 0x0b43849d VectorKit`-[VKPolygonMapModel drawScene:withContext:pass:] + 125
    frame #14: 0x0b3b6d1a VectorKit`-[VKModelObject recursiveDrawScene:withContext:pass:] + 90
    frame #15: 0x0b3b6e18 VectorKit`-[VKModelObject recursiveDrawScene:withContext:pass:] + 344
    frame #16: 0x0b51eb31 VectorKit`-[VKMapRasterizer recursiveDrawScene:withContext:pass:] + 785
    frame #17: 0x0b3b6e18 VectorKit`-[VKModelObject recursiveDrawScene:withContext:pass:] + 344
    frame #18: 0x0b3c0df6 VectorKit`-[VKMapModel recursiveDrawScene:withContext:pass:] + 150
    frame #19: 0x0b3b6e18 VectorKit`-[VKModelObject recursiveDrawScene:withContext:pass:] + 344
    frame #20: 0x0b3d6250 VectorKit`-[VKWorld drawScene:withContext:] + 64
    frame #21: 0x0b3c5fcb VectorKit`-[VKScreenCanvas _renderCore:] + 443
    frame #22: 0x0b3c5c96 VectorKit`__36-[VKScreenCanvas drawWithTimestamp:]_block_invoke_2 + 70
    frame #23: 0x0b44e325 VectorKit`-[VGLContext perform:] + 85
    frame #24: 0x0b3c5c38 VectorKit`__36-[VKScreenCanvas drawWithTimestamp:]_block_invoke + 120
    frame #25: 0x040da7f8 libdispatch.dylib`_dispatch_call_block_and_release + 15
    frame #26: 0x040ef4b0 libdispatch.dylib`_dispatch_client_callout + 14
    frame #27: 0x040dd07f libdispatch.dylib`_dispatch_queue_drain + 452
    frame #28: 0x040dce7a libdispatch.dylib`_dispatch_queue_invoke + 128
    frame #29: 0x040dde1f libdispatch.dylib`_dispatch_root_queue_drain + 83
    frame #30: 0x040ddd31 libdispatch.dylib`_dispatch_worker_thread + 118
    frame #31: 0x0447a5fb libsystem_pthread.dylib`_pthread_body + 144
    frame #32: 0x0447a485 libsystem_pthread.dylib`_pthread_start + 130


Ortwin Gentz 16-Dec-2013 09:18 PM

another backtrace, from an iPhone 5s, running iOS 7.1 beta 2 (11D5115d):

* thread #754: tid = 0x5fa9b, 0x3943d5e2 libobjc.A.dylib`objc_msgSend + 2, queue = 'com.apple.maps.snapshotter', stop reason = EXC_BAD_ACCESS (code=1, address=0x20)
  * frame #0: 0x3943d5e2 libobjc.A.dylib`objc_msgSend + 2
    frame #1: 0x002f2b1a WhereTo`___lldb_unnamed_function104$$WhereTo + 310
    frame #2: 0x002ed80e WhereTo`___lldb_unnamed_function73$$WhereTo + 258
    frame #3: 0x002e6d1a WhereTo`___lldb_unnamed_function5$$WhereTo + 914
    frame #4: 0x002eb762 WhereTo`___lldb_unnamed_function36$$WhereTo + 158
    frame #5: 0x2f4f95f8 Foundation`-[NSNotificationCenter removeObserver:] + 28
    frame #6: 0x369c21ea VectorKit`-[VKTileSource dealloc] + 54
    frame #7: 0x369c21b0 VectorKit`-[VKTileSetBackedTileSource dealloc] + 172
    frame #8: 0x36a69b70 VectorKit`-[VKLabelTileSource dealloc] + 40
    frame #9: 0x39442b6a libobjc.A.dylib`objc_object::sidetable_release(bool) + 174
    frame #10: 0x36a69d6c VectorKit`-[VKTileProvider dealloc] + 360
    frame #11: 0x39442b6a libobjc.A.dylib`objc_object::sidetable_release(bool) + 174
    frame #12: 0x36a697ae VectorKit`-[VKMapModel dealloc] + 218
    frame #13: 0x39442b6a libobjc.A.dylib`objc_object::sidetable_release(bool) + 174
    frame #14: 0x36a695f8 VectorKit`-[VKMapCameraController dealloc] + 44
    frame #15: 0x39442b6a libobjc.A.dylib`objc_object::sidetable_release(bool) + 174
    frame #16: 0x36b46024 VectorKit`-[VKMapSnapshotCreator dealloc] + 240
    frame #17: 0x39442b6a libobjc.A.dylib`objc_object::sidetable_release(bool) + 174
    frame #18: 0x3996aac4 libsystem_blocks.dylib`_Block_release + 216
    frame #19: 0x3993dd04 libdispatch.dylib`_dispatch_queue_drain + 488
    frame #20: 0x3993dd04 libdispatch.dylib`_dispatch_queue_drain + 488
    frame #21: 0x3993acb6 libdispatch.dylib`_dispatch_queue_invoke + 42
    frame #22: 0x3993e638 libdispatch.dylib`_dispatch_root_queue_drain + 76
    frame #23: 0x3993e8dc libdispatch.dylib`_dispatch_worker_thread2 + 56
    frame #24: 0x39a69c12 libsystem_pthread.dylib`_pthread_wqthread + 298



Ortwin Gentz 17-Feb-2014 07:03 PM

Another backtrace (from the Simulator, iOS 7.1 beta 5 SDK):

(lldb) bt
* thread #30: tid = 0xecebe, 0x00000001194c9a11 libGLProgrammability.dylib`glvmRasterOpRead + 833, queue = 'com.apple.maps.snapshotter', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
  * frame #0: 0x00000001194c9a11 libGLProgrammability.dylib`glvmRasterOpRead + 833
    frame #1: 0x00000001194c41ac libGLProgrammability.dylib`glvmInterpretFPTransformFour + 4668
    frame #2: 0x0000000119620cde GLRendererFloat`gldLLVMFPTransform2x2 + 1118
    frame #3: 0x000000011961ff76 GLRendererFloat`gldMergeScanlines2x2 + 726
    frame #4: 0x000000011caef6b8
    frame #5: 0x000000011961cf18 GLRendererFloat`gldRenderFillPolygonPtr + 89
    frame #6: 0x000000011caf071a
    frame #7: 0x000000011939c4ed GLEngine`gleDrawArraysOrElements_ExecCore + 1024
    frame #8: 0x0000000119398a69 GLEngine`glDrawArrays_ES2Exec + 289
    frame #9: 0x000000010cdc1290 VectorKit`-[VKRasterMapModel drawScene:withContext:] + 816
    frame #10: 0x000000010cdb23f2 VectorKit`-[VKModelObject recursiveDrawScene:whenReadyWithContext:pass:] + 146
    frame #11: 0x000000010cdbaecf VectorKit`-[VKMapModel recursiveDrawScene:withContext:pass:] + 431
    frame #12: 0x000000010cdb1eef VectorKit`-[VKModelObject recursiveDrawScene:withContext:pass:] + 287
    frame #13: 0x000000010cea1b3f VectorKit`__29-[VKImageCanvas renderScene:]_block_invoke + 319
    frame #14: 0x000000010ce352e0 VectorKit`-[VGLContext perform:] + 80
    frame #15: 0x000000010cea1937 VectorKit`-[VKImageCanvas renderScene:] + 167
    frame #16: 0x000000010cea0cab VectorKit`__52-[VKMapSnapshotCreator mapModelWillBecomFullyDrawn:]_block_invoke + 91
    frame #17: 0x000000010522a851 libdispatch.dylib`_dispatch_call_block_and_release + 12
    frame #18: 0x000000010523d72d libdispatch.dylib`_dispatch_client_callout + 8
    frame #19: 0x000000010522cdcf libdispatch.dylib`_dispatch_queue_drain + 481
    frame #20: 0x000000010522cb94 libdispatch.dylib`_dispatch_queue_invoke + 112
    frame #21: 0x000000010522d9fc libdispatch.dylib`_dispatch_root_queue_drain + 81
    frame #22: 0x000000010522dd12 libdispatch.dylib`_dispatch_worker_thread2 + 40
    frame #23: 0x000000010558cef8 libsystem_pthread.dylib`_pthread_wqthread + 314



Ortwin Gentz 21-Feb-2014 05:40 PM

Another backtrace (iPhone 5s running iOS 7.1 beta 5):

* thread #5: tid = 0x46522, 0x0000000193c5c1dc libobjc.A.dylib`objc_msgSend + 28, queue = 'com.apple.maps.snapshotter', stop reason = EXC_BAD_ACCESS (code=1, address=0x8e072627f9104d09)
  * frame #0: 0x0000000193c5c1dc libobjc.A.dylib`objc_msgSend + 28
    frame #1: 0x00000001934d9f9c libc++.1.dylib`std::__1::__shared_weak_count::__release_shared() + 64
    frame #2: 0x0000000190a02184 VectorKit`std::__1::__tree<std::__1::pair<std::__1::pair<std::__1::shared_ptr<vk::ShieldArtwork>, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::shared_ptr<vk::LabelIcon> >, std::__1::__map_value_compare<std::__1::pair<std::__1::shared_ptr<vk::ShieldArtwork>, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::shared_ptr<vk::LabelIcon>, std::__1::less<std::__1::pair<std::__1::shared_ptr<vk::ShieldArtwork>, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > >, true>, vk_allocator<std::__1::pair<std::__1::pair<std::__1::shared_ptr<vk::ShieldArtwork>, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::shared_ptr<vk::LabelIcon> > > >::destroy(std::__1::__tree_node<std::__1::pair<std::__1::pair<std::__1::shared_ptr<vk::ShieldArtwork>, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::shared_ptr<vk::LabelIcon> >, void*>*) + 80
    frame #3: 0x0000000190a02004 VectorKit`vk::LabelStyle::~LabelStyle() + 88
    frame #4: 0x00000001934d9f9c libc++.1.dylib`std::__1::__shared_weak_count::__release_shared() + 64
    frame #5: 0x00000001909faa34 VectorKit`vk::RoadLabelFeature::~RoadLabelFeature() + 176
    frame #6: 0x00000001934d9f9c libc++.1.dylib`std::__1::__shared_weak_count::__release_shared() + 64
    frame #7: 0x0000000190a438e8 VectorKit`vk::InfoLabel::~InfoLabel() + 120
    frame #8: 0x00000001934d9f9c libc++.1.dylib`std::__1::__shared_weak_count::__release_shared() + 64
    frame #9: 0x00000001909ebdc4 VectorKit`std::__1::__tree<std::__1::shared_ptr<vk::InfoLabel>, std::__1::less<std::__1::shared_ptr<vk::InfoLabel> >, vk_allocator<std::__1::shared_ptr<vk::InfoLabel> > >::destroy(std::__1::__tree_node<std::__1::shared_ptr<vk::InfoLabel>, void*>*) + 48
    frame #10: 0x00000001909ebdb0 VectorKit`std::__1::__tree<std::__1::shared_ptr<vk::InfoLabel>, std::__1::less<std::__1::shared_ptr<vk::InfoLabel> >, vk_allocator<std::__1::shared_ptr<vk::InfoLabel> > >::destroy(std::__1::__tree_node<std::__1::shared_ptr<vk::InfoLabel>, void*>*) + 28
    frame #11: 0x00000001909ebdb0 VectorKit`std::__1::__tree<std::__1::shared_ptr<vk::InfoLabel>, std::__1::less<std::__1::shared_ptr<vk::InfoLabel> >, vk_allocator<std::__1::shared_ptr<vk::InfoLabel> > >::destroy(std::__1::__tree_node<std::__1::shared_ptr<vk::InfoLabel>, void*>*) + 28
    frame #12: 0x00000001909ebdb8 VectorKit`std::__1::__tree<std::__1::shared_ptr<vk::InfoLabel>, std::__1::less<std::__1::shared_ptr<vk::InfoLabel> >, vk_allocator<std::__1::shared_ptr<vk::InfoLabel> > >::destroy(std::__1::__tree_node<std::__1::shared_ptr<vk::InfoLabel>, void*>*) + 36
    frame #13: 0x00000001909fae98 VectorKit`vk::InfoMapTile::~InfoMapTile() + 44
    frame #14: 0x00000001934d9f9c libc++.1.dylib`std::__1::__shared_weak_count::__release_shared() + 64
    frame #15: 0x00000001909ff73c VectorKit`vk::LabelManager::~LabelManager() + 992
    frame #16: 0x00000001934d9f9c libc++.1.dylib`std::__1::__shared_weak_count::__release_shared() + 64
    frame #17: 0x0000000193c4aaa8 libobjc.A.dylib`object_cxxDestructFromClass(objc_object*, objc_class*) + 168
    frame #18: 0x0000000193c55020 libobjc.A.dylib`objc_destructInstance + 44
    frame #19: 0x0000000193c55094 libobjc.A.dylib`object_dispose + 28
    frame #20: 0x00000001909fd0c4 VectorKit`-[VKModelObject dealloc] + 420
    frame #21: 0x00000001909ff278 VectorKit`-[VKLabelModel dealloc] + 192
    frame #22: 0x0000000190974120 VectorKit`-[VKModelObject_DrawPass dealloc] + 48
    frame #23: 0x0000000187499ed4 CoreFoundation`CFRelease + 468
    frame #24: 0x00000001874a62c0 CoreFoundation`-[__NSArrayM dealloc] + 156
    frame #25: 0x00000001909fd08c VectorKit`-[VKModelObject dealloc] + 364
    frame #26: 0x00000001909fd720 VectorKit`-[VKMapModel dealloc] + 1212
    frame #27: 0x0000000190974120 VectorKit`-[VKModelObject_DrawPass dealloc] + 48
    frame #28: 0x0000000187499ed4 CoreFoundation`CFRelease + 468
    frame #29: 0x00000001874a62c0 CoreFoundation`-[__NSArrayM dealloc] + 156
    frame #30: 0x00000001909fd08c VectorKit`-[VKModelObject dealloc] + 364
    frame #31: 0x00000001909fceec VectorKit`-[VKWorld dealloc] + 76
    frame #32: 0x0000000190ae355c VectorKit`-[VKImageCanvas dealloc] + 168
    frame #33: 0x0000000190b05938 VectorKit`__destroy_helper_block_26579 + 40
    frame #34: 0x0000000194287908 libsystem_blocks.dylib`_Block_release + 256
    frame #35: 0x000000019424d30c libdispatch.dylib`_dispatch_source_cancel_callout + 44
    frame #36: 0x0000000194241ad0 libdispatch.dylib`_dispatch_source_invoke + 308
    frame #37: 0x0000000194246454 libdispatch.dylib`_dispatch_queue_drain + 556
    frame #38: 0x00000001942424c0 libdispatch.dylib`_dispatch_queue_invoke + 68
    frame #39: 0x00000001942470f4 libdispatch.dylib`_dispatch_root_queue_drain + 104
    frame #40: 0x00000001942474fc libdispatch.dylib`_dispatch_worker_thread2 + 76
    frame #41: 0x00000001943d56bc libsystem_pthread.dylib`_pthread_wqthread + 356

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!