Passing in nil to commitWithCompletion block on FIRWriteBatch causes crash 10/10 times

[lukegeiger]

[REQUIRED] Step 2: Describe your environment

• Xcode version:9.2
• Firebase SDK version: 4.8.2
• Firebase Component: Firestore
• Component version: 0.10.0

[REQUIRED] Step 3: Describe the problem

passing in nil to commitWithCompletion block causes crash 10/10 times

Steps to reproduce:

pass in nil to commitWithCompletion

#0. Crashed: com.apple.main-thread
0  Odysseus                       0x1041fc5f4 __48-[FSTFirestoreClient writeMutations:completion:]_block_invoke_2 + 4368352756
1  libdispatch.dylib              0x185cc6a54 _dispatch_call_block_and_release + 24
2  libdispatch.dylib              0x185cc6a14 _dispatch_client_callout + 16
3  libdispatch.dylib              0x185cd3698 _dispatch_main_queue_callback_4CF$VARIANT$mp + 1016
4  CoreFoundation                 0x1862f2544 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 12
5  CoreFoundation                 0x1862f0120 __CFRunLoopRun + 2012
6  CoreFoundation                 0x18620fe58 CFRunLoopRunSpecific + 436
7  GraphicsServices               0x1880bcf84 GSEventRunModal + 100
8  UIKit                          0x18f96467c UIApplicationMain + 236
9  Odysseus                       0x1040694a8 main (main.m:14)
10 libdyld.dylib                  0x185d2c56c start + 4

--

#0. Crashed: com.apple.main-thread
0  Odysseus                       0x1041fc5f4 __48-[FSTFirestoreClient writeMutations:completion:]_block_invoke_2 + 4368352756
1  libdispatch.dylib              0x185cc6a54 _dispatch_call_block_and_release + 24
2  libdispatch.dylib              0x185cc6a14 _dispatch_client_callout + 16
3  libdispatch.dylib              0x185cd3698 _dispatch_main_queue_callback_4CF$VARIANT$mp + 1016
4  CoreFoundation                 0x1862f2544 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 12
5  CoreFoundation                 0x1862f0120 __CFRunLoopRun + 2012
6  CoreFoundation                 0x18620fe58 CFRunLoopRunSpecific + 436
7  GraphicsServices               0x1880bcf84 GSEventRunModal + 100
8  UIKit                          0x18f96467c UIApplicationMain + 236
9  Odysseus                       0x1040694a8 main (main.m:14)
10 libdyld.dylib                  0x185d2c56c start + 4

#1. com.apple.uikit.eventfetch-thread
0  libsystem_kernel.dylib         0x185e3b568 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x185e3b3e0 mach_msg + 72
2  CoreFoundation                 0x1862f2308 __CFRunLoopServiceMachPort + 196
3  CoreFoundation                 0x1862efed4 __CFRunLoopRun + 1424
4  CoreFoundation                 0x18620fe58 CFRunLoopRunSpecific + 436
5  Foundation                     0x186c45594 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 304
6  Foundation                     0x186c649ac -[NSRunLoop(NSRunLoop) runUntilDate:] + 96
7  UIKit                          0x1904ce7b8 -[UIEventFetcher threadMain] + 136
8  Foundation                     0x186d470f4 __NSThread__start__ + 996
9  libsystem_pthread.dylib        0x185f702b4 _pthread_body + 308
10 libsystem_pthread.dylib        0x185f70180 _pthread_body + 310
11 libsystem_pthread.dylib        0x185f6eb74 thread_start + 4

#2. com.twitter.crashlytics.ios.MachExceptionServer
0  Odysseus                       0x10410f668 CLSProcessRecordAllThreads (CLSProcess.c:376)
1  Odysseus                       0x10410f668 CLSProcessRecordAllThreads (CLSProcess.c:376)
2  Odysseus                       0x10410f518 CLSProcessRecordAllThreads (CLSProcess.c:407)
3  Odysseus                       0x1040ff3b0 CLSHandler (CLSHandler.m:26)
4  Odysseus                       0x1040fa3cc CLSMachExceptionServer (CLSMachException.c:446)
5  libsystem_pthread.dylib        0x185f702b4 _pthread_body + 308
6  libsystem_pthread.dylib        0x185f70180 _pthread_body + 310
7  libsystem_pthread.dylib        0x185f6eb74 thread_start + 4

#3. com.apple.NSURLConnectionLoader
0  libsystem_kernel.dylib         0x185e3b568 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x185e3b3e0 mach_msg + 72
2  CoreFoundation                 0x1862f2308 __CFRunLoopServiceMachPort + 196
3  CoreFoundation                 0x1862efed4 __CFRunLoopRun + 1424
4  CoreFoundation                 0x18620fe58 CFRunLoopRunSpecific + 436
5  CFNetwork                      0x186aff128 -[__CoreSchedulingSetRunnable runForever] + 780
6  Foundation                     0x186d470f4 __NSThread__start__ + 996
7  libsystem_pthread.dylib        0x185f702b4 _pthread_body + 308
8  libsystem_pthread.dylib        0x185f70180 _pthread_body + 310
9  libsystem_pthread.dylib        0x185f6eb74 thread_start + 4

#4. Thread
0  libsystem_kernel.dylib         0x185e5c0f0 __psynch_cvwait + 8
1  libsystem_pthread.dylib        0x185f72ce4 _pthread_cond_wait$VARIANT$mp + 640
2  libc++.1.dylib                 0x185513ea4 std::__1::condition_variable::wait(std::__1::unique_lock<std::__1::mutex>&) + 24
3  JavaScriptCore                 0x18d6b3f2c void std::__1::condition_variable_any::wait<std::__1::unique_lock<bmalloc::Mutex> >(std::__1::unique_lock<bmalloc::Mutex>&) + 96
4  JavaScriptCore                 0x18d6b3e54 bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>::threadRunLoop() + 172
5  JavaScriptCore                 0x18d6b41b8 void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void (*)(bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>*), bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>*> >(void*) + 44
6  libsystem_pthread.dylib        0x185f702b4 _pthread_body + 308
7  libsystem_pthread.dylib        0x185f70180 _pthread_body + 310
8  libsystem_pthread.dylib        0x185f6eb74 thread_start + 4

#5. WebThread
0  libsystem_kernel.dylib         0x185e3b568 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x185e3b3e0 mach_msg + 72
2  CoreFoundation                 0x1862f2308 __CFRunLoopServiceMachPort + 196
3  CoreFoundation                 0x1862efed4 __CFRunLoopRun + 1424
4  CoreFoundation                 0x18620fe58 CFRunLoopRunSpecific + 436
5  WebCore                        0x18e180a34 RunWebThread(void*) + 560
6  libsystem_pthread.dylib        0x185f702b4 _pthread_body + 308
7  libsystem_pthread.dylib        0x185f70180 _pthread_body + 310
8  libsystem_pthread.dylib        0x185f6eb74 thread_start + 4

#6. Thread
0  libsystem_kernel.dylib         0x185e5cd80 __workq_kernreturn + 8
1  libsystem_pthread.dylib        0x185f6f080 _pthread_wqthread + 1288
2  libsystem_pthread.dylib        0x185f6eb6c start_wqthread + 4

#7. Thread
0  libsystem_kernel.dylib         0x185e5cd80 __workq_kernreturn + 8
1  libsystem_pthread.dylib        0x185f6f080 _pthread_wqthread + 1288
2  libsystem_pthread.dylib        0x185f6eb6c start_wqthread + 4

#8. Thread
0  libsystem_kernel.dylib         0x185e5cd80 __workq_kernreturn + 8
1  libsystem_pthread.dylib        0x185f6eeec _pthread_wqthread + 884
2  libsystem_pthread.dylib        0x185f6eb6c start_wqthread + 4

#9. LS bundle proxy for current process
0  libsystem_kernel.dylib         0x185e3b568 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x185e3b3e0 mach_msg + 72
2  libdispatch.dylib              0x185ce0068 _dispatch_mach_msg_send + 752
3  libdispatch.dylib              0x185cdf6b8 _dispatch_mach_send_drain + 480
4  libdispatch.dylib              0x185cdc448 _dispatch_mach_send_msg + 456
5  libdispatch.dylib              0x185cdc728 _dispatch_mach_send_and_wait_for_reply + 284
6  libdispatch.dylib              0x185cdcd3c dispatch_mach_send_with_result_and_wait_for_reply$VARIANT$mp + 56
7  libxpc.dylib                   0x185fabd7c xpc_connection_send_message_with_reply_sync + 196
8  Foundation                     0x186e6df84 __NSXPCCONNECTION_IS_WAITING_FOR_A_SYNCHRONOUS_REPLY__ + 12
9  Foundation                     0x186e6d70c -[NSXPCConnection _sendInvocation:orArguments:count:methodSignature:selector:withProxy:] + 3604
10 CoreFoundation                 0x18634f9c8 ___forwarding___ + 540
11 CoreFoundation                 0x186234ecc _CF_forwarding_prep_0 + 92
12 MobileCoreServices             0x18815d00c __59-[_LSXPCQueryResolver _resolveQueries:XPCConnection:error:]_block_invoke + 176
13 MobileCoreServices             0x18815cd98 -[_LSXPCQueryResolver _resolveQueries:XPCConnection:error:] + 872
14 MobileCoreServices             0x18815bb04 -[_LSQueryContext(Internal) _resolveQueries:cachingStrategy:XPCConnection:error:] + 444
15 MobileCoreServices             0x18815b810 -[_LSQueryContext(QueryResolution) resolveQueries:cachingStrategy:error:] + 84
16 MobileCoreServices             0x1881a99cc __45+[LSBundleProxy bundleProxyForCurrentProcess]_block_invoke_2 + 276
17 libdispatch.dylib              0x185cc6a14 _dispatch_client_callout + 16
18 libdispatch.dylib              0x185ccf618 _dispatch_queue_barrier_sync_invoke_and_complete + 56
19 MobileCoreServices             0x1881a97e4 +[LSBundleProxy bundleProxyForCurrentProcess] + 152
20 Foundation                     0x186cc2da8 -[NSBundle appStoreReceiptURL] + 104
21 Odysseus                       0x1041941dc +[FIRAAEU appStoreRURL] + 4367925724
22 Odysseus                       0x1041944cc +[FIRAAEU isASRS] + 4367926476
23 Odysseus                       0x104194268 +[FIRAAEU isFAS] + 4367925864
24 Odysseus                       0x104173dd0 -[FIRAMeasurement createRawEventMetadataWithUserAttributes:] + 4367793616
25 Odysseus                       0x104171a18 __43-[FIRAMeasurement writeEventOnWorkerQueue:]_block_invoke.1030 + 4367784472
26 Odysseus                       0x104153e6c -[FIRASqliteStore performTransaction:] + 4367662700
27 Odysseus                       0x104170868 -[FIRAMeasurement writeEventOnWorkerQueue:] + 4367779944
28 Odysseus                       0x104170158 -[FIRAMeasurement handleEventOnWorkerQueue:] + 4367778136
29 Odysseus                       0x104182070 __52-[FIRAScheduler scheduleOnWorkerQueueBlockID:block:]_block_invoke + 4367851632
30 libdispatch.dylib              0x185cc6a54 _dispatch_call_block_and_release + 24
31 libdispatch.dylib              0x185cc6a14 _dispatch_client_callout + 16
32 libdispatch.dylib              0x185cd096c _dispatch_queue_serial_drain$VARIANT$mp + 528
33 libdispatch.dylib              0x185cd12fc _dispatch_queue_invoke$VARIANT$mp + 340
34 libdispatch.dylib              0x185cd1d20 _dispatch_root_queue_drain_deferred_wlh$VARIANT$mp + 404
35 libdispatch.dylib              0x185cda03c _dispatch_workloop_worker_thread$VARIANT$mp + 644
36 libsystem_pthread.dylib        0x185f6ef1c _pthread_wqthread + 932
37 libsystem_pthread.dylib        0x185f6eb6c start_wqthread + 4

#10. Thread
0  libsystem_kernel.dylib         0x185e5cd80 __workq_kernreturn + 8
1  libsystem_pthread.dylib        0x185f6eeec _pthread_wqthread + 884
2  libsystem_pthread.dylib        0x185f6eb6c start_wqthread + 4

#11. Thread
0  libsystem_kernel.dylib         0x185e5cd80 __workq_kernreturn + 8
1  libsystem_pthread.dylib        0x185f6eeec _pthread_wqthread + 884
2  libsystem_pthread.dylib        0x185f6eb6c start_wqthread + 4

[wilhuff]

Are you somehow passing an empty batch in here?

[lukegeiger]

@wilhuff I am sure I am not passing an empty batch.

[morganchen12]

@lukegeiger can you share the code you're running that reproduces the crash without an empty batch?

For reference, the code path that was causing the crash shouldn't be hit if the batch contains any changes.

[wilhuff]

The thing is that #746 fixes the only unguarded call to completion in FSTFirestoreClient and it's exactly in the method that's pointed out in the stack trace:

0  Odysseus                       0x1041fc5f4 __48-[FSTFirestoreClient writeMutations:completion:]_block_invoke_2 + 4368352756

[wilhuff]

Can you verify this fixes what you're doing by adding this to podfile temporarily?

pod 'FirebaseFirestore', :git => 'https://github.com/firebase/firebase-ios-sdk.git', :branch => 'master'
pod 'FirebaseCore', :git => 'https://github.com/firebase/firebase-ios-sdk.git', :branch => 'master'

[lukegeiger]

hey @wilhuff the project wont compile when I add those. Keep on getting this error

#include "Firestore/core/include/firebase/firestore/geo_point.h" geo_point file not found

and @morganchen12 the code path is something like this

FIRWriteBatch *batch =  [self.defaultFirestore batch];

[batch update:<a model object>]

[batch commitWithCompletion:nil];