iOS Cronet Crash

[吴凯凯]

I see that there are a few crashes

I get some information(API MISUSE: Over-release of an object) from crash_info , and I found that the release com.apple.CFFileDescriptor queue by analyzing the App coredump. 

In my app,  only  Cronet uses CFFileDescriptor. So I suspect it's Cronet problem.

[shuai yan]

I got the same crash in my app, and i can confirm, this crash is triggered by CFFileDescriptor.

Looking forward to the answer.

[shuai yan]

Now, by modifying the cronet_test, you can reproduce the crash stably on my Mac, as follows:

1. Add the test case to cronet_http_test.mm as follow :

TEST_F(HttpTest, LibdispatchCrash) { 

   NSURL* url = net::NSURLWithGURL(GURL("http://localhost:9988")); 

   [Cronet setRequestFilterBlock:^(NSURLRequest* request) { 

     if ([request.URL isEqual:url]) { 

       return YES; 

      };

      return NO; 

     }]; 

   while (1) { 

      NSURLSessionDataTask* task = [session_ dataTaskWithURL:url]; 

      StartDataTaskAndWaitForCompletion(task); 

     };

 }

2. iOS-simulator：iPhone12+iOS14.4；

3. macOS-version: 11.2.3 (20D91), i tried to reproduce on Mac OS10.15, but failed.

[Chidera Olibie]

Hi, 

I was unable to reproduce the issue using Chrome version: 93.0.4531.0 and the iOS simulator for iPhone12+iOS14.4, can you confirm if you see experience the crashes?

[吴凯凯]

I fix this crash, but very trick~   

[Hao Chen]

Hi，

   How did you fix the crash? These crashes are still annoying us.

[Chidera Olibie]

Hi, could you please file a bug via https://bugs.chromium.org/p/chromium/issues/list with the word "Cronet" in the summary line. Add the stack trace and other relevant information to enable us to debug this properly.

Thanks.

[shuai yan]

I fix this crash ，but very trick too. Get the dispatch_queue which over released and forced change its ref count to INT_MAX.

No need to worry about memory leak，because it could be destroyed when app exists.

[Динар Хайруллин]

Hi, thx for your fix. Could you tell please how you get over released dispatch_queue and how exactly you change its ref count, is it dispatch_retain(queue) or somehow else? And maybe when you changing its ref count?

i always get 18 446 744 073 709 551 615 retainCount for my dispatch_queue_global_t queue, or should i create dispatch_queue_t queue? 

пятница, 10 декабря 2021 г. в 17:13:12 UTC+3, yanshua...@gmail.com:

[shuai yan]

maybe fishhook can help you.

if you wanna better performance, try to calculate offsets to fetch the queue。

And there is a good message, Bytedance has announced its solution，ref: https://xie.infoq.cn/article/fc1ebf4518facd24f0df61f83