Crash When Creating Image

[mlarandeau-wayfair]

It's rare, but we are seeing a handful of EXC_BAD_ACCESS KERN_INVALID_ADDRESS crashes with version 9.2.4 when Nuke attempts to create an image from Data in ImageDecoders.Default._decode(_:). We have not been able to reproduce it. I suspect this is an issue within Nuke or UIKit, but please let me know if there is something we could be doing to cause this. The pertinent stack trace is below.

Crashed: com.github.kean.Nuke.ImagePipeline
0  libdyld.dylib                  0x1865fafcc tlv_load_notification + 104
1  libdyld.dylib                  0x186600150 invocation function for block in dyld3::AllImages::runImageCallbacks(dyld3::Array<dyld3::LoadedImage> const&) + 240
2  libdyld.dylib                  0x1865ff984 dyld3::AllImages::runImageCallbacks(dyld3::Array<dyld3::LoadedImage> const&) + 140
3  libdyld.dylib                  0x186604aec dyld3::AllImages::loadImage(Diagnostics&, char const*, unsigned int, dyld3::closure::DlopenClosure const*, bool, bool, bool, bool, void const*) + 716
4  libdyld.dylib                  0x186604678 dyld3::AllImages::dlopen(Diagnostics&, char const*, bool, bool, bool, bool, bool, void const*, bool) + 872
5  libdyld.dylib                  0x186606294 dyld3::dlopen_internal(char const*, int, void*) + 368
6  libdyld.dylib                  0x1865f9590 dlopen_internal(char const*, int, void*) + 108
7  ImageIO                        0x187f09340 IIO_ReaderHandler::buildPluginList() + 204
8  ImageIO                        0x187f09200 IIO_ReaderHandler::IIO_ReaderHandler() + 64
9  ImageIO                        0x187f0b7cc invocation function for block in IIO_ReaderHandler::GetReaderHandler() + 28
10 libdispatch.dylib              0x1865d6280 _dispatch_client_callout + 16
11 libdispatch.dylib              0x18657a2f4 _dispatch_once_callout + 28
12 ImageIO                        0x187f0b7ac IIO_ReaderHandler::GetReaderHandler() + 60
13 ImageIO                        0x187e6ae50 IIOImageSource::doBindToReader() + 56
14 ImageIO                        0x187e6b4cc IIOImageSource::updatedCount() + 52
15 ImageIO                        0x187e6fe5c CGImageSourceGetCount + 156
16 UIKitCore                      0x1897c59dc _UIImageRefFromData + 268
17 UIKitCore                      0x188e0150c -[UIImage _initWithData:preserveScale:cache:scale:] + 60
18 Nuke                           0x10a0c0664 @nonobjc UIImage.init(data:scale:) + 68 (<compiler-generated>:68)
19 Nuke                           0x10a0c0610 UIImage.__allocating_init(data:scale:) + 68 (<compiler-generated>:68)
20 Nuke                           0x10a0bfcf8 static ImageDecoders.Default._decode(_:) + 198 (ImageDecoding.swift:198)
21 Nuke                           0x10a0bf03c ImageDecoders.Default._decode(_:) + 117 (ImageDecoding.swift:117)
22 Nuke                           0x10a0bedc8 ImageDecoders.Default.init(data:context:) + 96 (ImageDecoding.swift:96)
23 Nuke                           0x10a0bec7c ImageDecoders.Default.__allocating_init(data:context:) + 95 (ImageDecoding.swift:95)
24 Nuke                           0x10a0c0590 protocol witness for ImageDecoderRegistering.init(data:context:) in conformance ImageDecoders.Default + 20 (<compiler-generated>:20)
25 Nuke                           0x10a0c10dc closure #1 in ImageDecoderRegistry.register<A>(_:) + 286 (ImageDecoding.swift:286)
26 Nuke                           0x10a0c0f34 ImageDecoderRegistry.decoder(for:) + 273 (ImageDecoding.swift:273)
27 Nuke                           0x10a0ac188 implicit closure #2 in implicit closure #1 in variable initialization expression of ImagePipeline.Configuration.makeImageDecoder + 40 (<compiler-generated>:40)
28 Nuke                           0x10a0777f8 ImagePipeline.decoder(for:data:urlResponse:isCompleted:) + 638 (ImagePipeline.swift:638)
29 Nuke                           0x10a07733c ImagePipeline.decodeData(_:urlResponse:isCompleted:task:context:) + 604 (ImagePipeline.swift:604)
30 Nuke                           0x10a077034 closure #1 in closure #1 in ImagePipeline.getOriginalImage(for:) + 584 (ImagePipeline.swift:584)
31 Nuke                           0x10a077640 thunk for @escaping @callee_guaranteed (@guaranteed Data, @guaranteed NSURLResponse?, @unowned Bool, @guaranteed Task<ImageResponse, ImagePipeline.Error>) -> () + 88 (<compiler-generated>:88)
32 Nuke                           0x10a0872d8 closure #1 in Task.Publisher.subscribe<A>(_:onValue:) + 194 (Task.swift:194)
33 Nuke                           0x10a0864a8 Task.send(event:) + 144 (Task.swift:144)
34 Nuke                           0x10a085fec Task.send(value:isCompleted:) + 118 (Task.swift:118)
35 Nuke                           0x10a07969c closure #1 in closure #1 in ImagePipeline.performOriginalImageDataTask(_:context:) + 698 (ImagePipeline.swift:698)
36 Nuke                           0x10a068eec thunk for @escaping @callee_guaranteed () -> () + 52 (<compiler-generated>:52)
37 libdispatch.dylib              0x1865d5298 _dispatch_call_block_and_release + 24
38 libdispatch.dylib              0x1865d6280 _dispatch_client_callout + 16
39 libdispatch.dylib              0x18657edcc _dispatch_lane_serial_drain$VARIANT$mp + 612
40 libdispatch.dylib              0x18657f8a8 _dispatch_lane_invoke$VARIANT$mp + 424
41 libdispatch.dylib              0x186589338 _dispatch_workloop_worker_thread + 712
42 libsystem_pthread.dylib        0x1cf1815a4 _pthread_wqthread + 272
43 libsystem_pthread.dylib        0x1cf184874 start_wqthread + 8

[kean]

Hi, crash is in UIImage.init(data:scale:) which makes me think it's not related to the Nuke code. It simply passes the loaded data to UIKit.

[mlarandeau-wayfair]

That's what I was thinking too. I came across some suggestions online about locking/unlocking an NSLock before/after the call to UIImage(data:scale:). I've never worked with NSLock myself, so I'm not familiar with the implications of using one here.

We are just monitoring this at the moment as it is incredibly rare. But I wanted to bring it to your attention sooner rather than later in case it became a bigger issue. If I don't see a significant rise in crashes over the next week or so, I plan on just closing this issue.

[kean]

Synchronization used to be needed in iOS 9 but is not anymore. I removed it about 2 years ago.

The crash is in libdyld.dylib which is interesting. I would keep it open for now. I'll try to investigate, and maybe someone will also have some insights.

[kean]

We are just monitoring this at the moment as it is incredibly rare.

Hey, @mlarandeau-wayfair. Any updates on the status? I want to try and help and fix it if possible or make sure the root cause isn't in Nuke.

[mlarandeau-wayfair]

This continues to be a very rare occurrence and we haven't seen the issue at all in the last two weeks. No new information or insights. We are still monitoring this, but not too concerned right now.

[kean]

Hey, @mlarandeau-wayfair. Any updates?

[mlarandeau-wayfair]

We still see this every once and while, but only at a rate of about 2 times a month. Considering our number of users and the number of images we download, this is an exceedingly rare event and low on our priority list.

I should point out that we are still using v9.3.1. We plan on updating to v10 in the near future.

[letko-dmitry]

Got the same thing.
Not much useful information and it looks like it's up to OS.
The only interesting trace relates to communication with Local Authentication framework at the same time.

iOS 14.4.2
Nuke 10.4.1

Crashed: com.github.kean.Nuke.ImagePipeline
0  libobjc.A.dylib                0x23c90 objc_retain + 16
1  CoreFoundation                 0x5cfd4 __NSDictionaryI_new + 456
2  CoreFoundation                 0x8c04 +[NSDictionary dictionaryWithObjects:forKeys:count:] + 56
3  RawCamera                      0x543ec GetRawPluginsInfo
4  RawCamera                      0x62a44 CopyRawPluginsInfoArray
5  ImageIO                        0x13f370 IIO_ReaderHandler::buildPluginList() + 252
6  ImageIO                        0x13f200 IIO_ReaderHandler::IIO_ReaderHandler() + 64
7  ImageIO                        0x1417cc invocation function for block in IIO_ReaderHandler::GetReaderHandler() + 28
8  libdispatch.dylib              0x61280 _dispatch_client_callout + 16
9  libdispatch.dylib              0x52f4 _dispatch_once_callout + 28
10 ImageIO                        0x1417ac IIO_ReaderHandler::GetReaderHandler() + 60
11 ImageIO                        0xa0e50 IIOImageSource::doBindToReader() + 56
12 ImageIO                        0xa14cc IIOImageSource::updatedCount() + 52
13 ImageIO                        0xa5e5c CGImageSourceGetCount + 156
14 UIKitCore                      0x10eb9dc _UIImageRefFromData + 268
15 UIKitCore                      0x72750c -[UIImage _initWithData:preserveScale:cache:scale:] + 60
16 Nuke                           0x27200 makeImage #1 () in ImageDecoders.Default._decode(_:) + 4402311680 (<compiler-generated>:4402311680)
17 Nuke                           0x3a92c thunk for @callee_guaranteed () -> (@owned UIImage?, @error @owned Error) + 4402391340 (<compiler-generated>:4402391340)
18 Nuke                           0x2ae80 partial apply for thunk for @callee_guaranteed () -> (@owned UIImage?, @error @owned Error) + 4402327168 (<compiler-generated>:4402327168)
19 libswiftObjectiveC.dylib       0x1f40 autoreleasepool<A>(invoking:) + 56
20 Nuke                           0x26c04 ImageDecoders.Default._decode(_:) + 151 (ImageDecoding.swift:151)
21 Nuke                           0x29cec specialized ImageDecoders.Default.init(data:context:) + 112 (ImageDecoding.swift:112)
22 Nuke                           0x28554 specialized closure #1 in ImageDecoderRegistry.register<A>(_:) + 341 (ImageDecoding.swift:341)
23 Nuke                           0x33d2c implicit closure #2 in implicit closure #1 in variable initialization expression of ImagePipeline.Configuration.makeImageDecoder + 329 (ImageDecoding.swift:329)
24 Nuke                           0x360dc protocol witness for ImagePipelineDelegate.imageDecoder(for:pipeline:) in conformance ImagePipelineDefaultDelegate + 4402372828 (<compiler-generated>:4402372828)
25 Nuke                           0x577f0 TaskFetchDecodedImage.decoder(data:urlResponse:isCompleted:) + 82 (TaskFetchDecodedImage.swift:82)
26 Nuke                           0x572ec TaskFetchDecodedImage.didReceiveData(_:urlResponse:isCompleted:) + 39 (TaskFetchDecodedImage.swift:39)
27 Nuke                           0x57f50 partial apply for closure #1 in TaskFetchDecodedImage.start() + 13 (TaskFetchDecodedImage.swift:13)
28 Nuke                           0x5bcdc thunk for @escaping @callee_guaranteed (@guaranteed Data, @guaranteed NSURLResponse?, @unowned Bool) -> () + 4402527452 (<compiler-generated>:4402527452)
29 Nuke                           0x5e814 specialized closure #1 in Task.Publisher.subscribe<A>(_:onValue:) + 259 (Task.swift:259)
30 Nuke                           0x5dd2c specialized Task.send(event:) + 186 (Task.swift:186)
31 Nuke                           0x5a0d4 TaskFetchOriginalImageData.dataTaskDidFinish(error:) + 161 (Task.swift:161)
32 Nuke                           0x5b078 partial apply for closure #1 in closure #2 in TaskFetchOriginalImageData.loadData(urlRequest:finish:) + 4402524280 (<compiler-generated>:4402524280)
33 Nuke                           0x373f8 thunk for @escaping @callee_guaranteed () -> () + 4402377720 (<compiler-generated>:4402377720)
34 libdispatch.dylib              0x60298 _dispatch_call_block_and_release + 24
35 libdispatch.dylib              0x61280 _dispatch_client_callout + 16
36 libdispatch.dylib              0x9dcc _dispatch_lane_serial_drain$VARIANT$mp + 612
37 libdispatch.dylib              0xa8a8 _dispatch_lane_invoke$VARIANT$mp + 424
38 libdispatch.dylib              0x14338 _dispatch_workloop_worker_thread + 712
39 libsystem_pthread.dylib        0xa5a4 _pthread_wqthread + 272
40 libsystem_pthread.dylib        0xd874 start_wqthread + 8

0  libsystem_kernel.dylib         0x4644 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x3a48 mach_msg + 72
2  libdispatch.dylib              0x1984c _dispatch_mach_send_and_wait_for_reply + 528
3  libdispatch.dylib              0x19be0 dispatch_mach_send_with_result_and_wait_for_reply$VARIANT$mp + 52
4  libxpc.dylib                   0xc114 xpc_connection_send_message_with_reply_sync + 236
5  Foundation                     0x20eb78 __NSXPCCONNECTION_IS_WAITING_FOR_A_SYNCHRONOUS_REPLY__ + 12
6  Foundation                     0x12f54 -[NSXPCConnection _sendInvocation:orArguments:count:methodSignature:selector:withProxy:] + 2428
7  CoreFoundation                 0x11cd04 ___forwarding___ + 648
8  CoreFoundation                 0x11ef8c _CF_forwarding_prep_0 + 92
9  LocalAuthentication            0x5460 __52-[LAClient evaluatePolicy:options:uiDelegate:reply:]_block_invoke + 204
10 LocalAuthentication            0x40cc -[LAClient _performSyncCallId:finally:] + 440
11 LocalAuthentication            0x534c -[LAClient evaluatePolicy:options:uiDelegate:reply:] + 432
12 LocalAuthentication            0x5940 -[LAClient evaluatePolicy:options:reply:] + 104
13 LocalAuthentication            0xb9e0 __51-[LAContext _evaluatePolicy:options:log:cid:reply:]_block_invoke + 148

[kean]

I'm going to close it because I don't think there is anything I can do on the framework level to address it. Any suggestions are welcome.