30196911: GIFReadPlugin crashes

[openradar-mirror]

Description

Summary:
We're seeing rare crashes in our app when viewing GIFs. I've never been able to reproduce, however it is one of the top crashes in our app currently. I've attached a sample. Of note, the reason I'm filing a radar is this isn't the only GIF library that appears to have this issue, it also seems to occur in FLAnimatedImage Flipboard/FLAnimatedImage#159

We've also seen the same issue with a completely separate code path (I'm mentioning this in hopes that it indicates an issue with GIFReadPlugin not our code though that obviously can't be ruled out).

The crash I attached's source is available here: https://github.com/pinterest/PINRemoteImage/blob/master/Pod/Classes/PINAnimatedImageManager.m#L397

I wrote it, it's very ugly, I'm very sorry :D

Steps to Reproduce:

Expected Results:

Actual Results:

Version:
8.2.1

Notes:

Configuration:

Attachments:

Crashlytics - plaintext stacktrace downloaded by Garrett Moon at Wed, 25 Jan 2017 23:00:51 GMT

URL: https://fabric.io/pinterest6/ios/apps/pinterest/issues/58725edb0aeb16625be36e30?time=1475305200000%3A1485388799999/sessions/249a80ec6af84d1ca797a177d173bfab_5f42b5754c004e7392069bb6a0c8e99d_0_v1

Organization: Pinterest

Platform: ios

Application: Pinterest

Version: 6.17.1 (0)

Bundle Identifier: pinterest

Issue #: 142337

Issue ID: 58725edb0aeb16625be36e30

Session ID: 249a80ec6af84d1ca797a177d173bfab_5f42b5754c004e7392069bb6a0c8e99d_0_v1

Date: 2017-02-04T04:53:03Z

OS Version: 10.2.0 (14C92)

Device: iPhone SE

RAM Free: 7.7%

Disk Free: 21.5%

#13. Crashed: PINAnimatedImage disk write queue
0 libsystem_platform.dylib 0x1915d4e60 _platform_memmove + 96
1 ImageIO 0x1943c0a74 GIFReadPlugin::copyImageBlockSet(InfoRec*, CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 3192
2 ImageIO 0x1943c0a74 GIFReadPlugin::copyImageBlockSet(InfoRec*, CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 3192
3 ImageIO 0x1943bf7c4 GIFReadPlugin::CopyImageBlockSetProc(void*, CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 124
4 ImageIO 0x19422073c IIOImageProviderInfo::copyImageBlockSetWithOptions(CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 496
5 ImageIO 0x19421e640 IIOImageProviderInfo::CopyImageBlockSetWithOptions(void*, CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 356
6 CoreGraphics 0x1939eeb24 CGImageProviderCopyImageBlockSet + 220
7 CoreGraphics 0x193c833ac imageProvider_getBytes + 88
8 CoreGraphics 0x193ab30e0 CGDataProviderCopyData + 280
9 Pinterest 0x100a46238 __94+[PINAnimatedImageManager processAnimatedImage:temporaryDirectory:infoCompletion:decodedPath:]_block_invoke.225 (PINAnimatedImageManager.m:397)
10 libdispatch.dylib 0x1913d21fc _dispatch_call_block_and_release + 24
11 libdispatch.dylib 0x1913d21bc _dispatch_client_callout + 16
12 libdispatch.dylib 0x1913e012c _dispatch_queue_serial_drain + 240
13 libdispatch.dylib 0x1913d59a4 _dispatch_queue_invoke + 652
14 libdispatch.dylib 0x1913e08d8 _dispatch_queue_override_invoke + 360
15 libdispatch.dylib 0x1913e234c _dispatch_root_queue_drain + 572
16 libdispatch.dylib 0x1913e20ac _dispatch_worker_thread3 + 124
17 libsystem_pthread.dylib 0x1915db2a0 _pthread_wqthread + 1288
18 libsystem_pthread.dylib 0x1915dad8c start_wqthread + 4

--

#0. com.apple.main-thread
0 libsystem_kernel.dylib 0x1914f9188 mach_msg_trap + 8
1 libsystem_kernel.dylib 0x1914f8ff8 mach_msg + 72
2 CoreFoundation 0x1924f65d0 __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x1924f41ec __CFRunLoopRun + 1132
4 CoreFoundation 0x1924222b8 CFRunLoopRunSpecific + 444
5 GraphicsServices 0x193ed6198 GSEventRunModal + 180
6 UIKit 0x1984697fc -[UIApplication _run] + 684
7 UIKit 0x198464534 UIApplicationMain + 208
8 Pinterest 0x10007dc48 main (main.m:47)
9 libdispatch.dylib 0x1914055b8 (Missing)

#1. com.apple.uikit.eventfetch-thread
0 libsystem_kernel.dylib 0x1914f9188 mach_msg_trap + 8
1 libsystem_kernel.dylib 0x1914f8ff8 mach_msg + 72
2 CoreFoundation 0x1924f65d0 __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x1924f41ec __CFRunLoopRun + 1132
4 CoreFoundation 0x1924222b8 CFRunLoopRunSpecific + 444
5 Foundation 0x192f5f26c -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 304
6 Foundation 0x192f7fdd0 -[NSRunLoop(NSRunLoop) runUntilDate:] + 96
7 UIKit 0x198dddc38 -[UIEventFetcher threadMain] + 136
8 Foundation 0x19305ce68 NSThread__start + 1024
9 libsystem_pthread.dylib 0x1915dd850 _pthread_body + 240
10 libsystem_pthread.dylib 0x1915dd760 _pthread_body + 282
11 libsystem_pthread.dylib 0x1915dad94 thread_start + 4

#2. com.apple.NSURLConnectionLoader
0 libsystem_kernel.dylib 0x1914f9188 mach_msg_trap + 8
1 libsystem_kernel.dylib 0x1914f8ff8 mach_msg + 72
2 CoreFoundation 0x1924f65d0 __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x1924f41ec __CFRunLoopRun + 1132
4 CoreFoundation 0x1924222b8 CFRunLoopRunSpecific + 444
5 CFNetwork 0x192c278f0 +[NSURLConnection(Loader) _resourceLoadLoop:] + 336
6 Foundation 0x19305ce68 NSThread__start + 1024
7 libsystem_pthread.dylib 0x1915dd850 _pthread_body + 240
8 libsystem_pthread.dylib 0x1915dd760 _pthread_body + 282
9 libsystem_pthread.dylib 0x1915dad94 thread_start + 4

#3. com.twitter.crashlytics.ios.MachExceptionServer
0 Pinterest 0x100bb4824 CLSProcessRecordAllThreads + 565756
1 Pinterest 0x100bb4824 CLSProcessRecordAllThreads + 565756
2 Pinterest 0x100bb46e0 CLSProcessRecordAllThreads + 565432
3 Pinterest 0x100ba4ea0 CLSHandler + 501880
4 Pinterest 0x100b9fe44 CLSMachExceptionServer + 481308
5 libsystem_pthread.dylib 0x1915dd850 _pthread_body + 240
6 libsystem_pthread.dylib 0x1915dd760 _pthread_body + 282
7 libsystem_pthread.dylib 0x1915dad94 thread_start + 4

#4. AVAudioSession Notify Thread
0 libsystem_kernel.dylib 0x1914f9188 mach_msg_trap + 8
1 libsystem_kernel.dylib 0x1914f8ff8 mach_msg + 72
2 CoreFoundation 0x1924f65d0 __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x1924f41ec __CFRunLoopRun + 1132
4 CoreFoundation 0x1924222b8 CFRunLoopRunSpecific + 444
5 AVFAudio 0x1abffbd24 GenericRunLoopThread::Entry(void*) + 164
6 AVFAudio 0x1ac021d9c CAPThread::Entry(CAPThread*) + 84
7 libsystem_pthread.dylib 0x1915dd850 _pthread_body + 240
8 libsystem_pthread.dylib 0x1915dd760 _pthread_body + 282
9 libsystem_pthread.dylib 0x1915dad94 thread_start + 4

#5. ASDeallocQueue
0 libsystem_kernel.dylib 0x1914f9188 mach_msg_trap + 8
1 libsystem_kernel.dylib 0x1914f8ff8 mach_msg + 72
2 CoreFoundation 0x1924f65d0 __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x1924f41ec __CFRunLoopRun + 1132
4 CoreFoundation 0x1924222b8 CFRunLoopRunSpecific + 444
5 CoreFoundation 0x19246fb44 CFRunLoopRun + 112
6 Pinterest 0x1008dc324 -[ASDeallocQueue threadMain] (ASRunLoopQueue.mm:91)
7 Foundation 0x19305ce68 NSThread__start + 1024
8 libsystem_pthread.dylib 0x1915dd850 _pthread_body + 240
9 libsystem_pthread.dylib 0x1915dd760 _pthread_body + 282
10 libsystem_pthread.dylib 0x1915dad94 thread_start + 4

#6. Thread
0 libsystem_kernel.dylib 0x191516e1c __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1915dc9c0 _pthread_cond_wait + 640
2 libc++.1.dylib 0x190f053ec std::__1::condition_variable::wait(std::__1::unique_lockstd::__1::mutex&) + 56
3 JavaScriptCore 0x196d265b0 void std::__1::condition_variable_any::wait<std::__1::unique_lockbmalloc::Mutex >(std::__1::unique_lockbmalloc::Mutex&) + 112
4 JavaScriptCore 0x196d26524 bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::)()>::threadRunLoop() + 168
5 JavaScriptCore 0x196d26404 std::__1::__shared_ptr_emplace<std::__1::mutex, std::__1::allocatorstd::__1::mutex >::~__shared_ptr_emplace() + 10
6 JavaScriptCore 0x196d266b4 void std::__1::__thread_proxy<std::__1::tuple<void ()(bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::)()>), bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::)()>> >(void) + 92
7 libsystem_pthread.dylib 0x1915dd850 _pthread_body + 240
8 libsystem_pthread.dylib 0x1915dd760 _pthread_body + 282
9 libsystem_pthread.dylib 0x1915dad94 thread_start + 4

#7. WebThread
0 libsystem_kernel.dylib 0x1914f9188 mach_msg_trap + 8
1 libsystem_kernel.dylib 0x1914f8ff8 mach_msg + 72
2 CoreFoundation 0x1924f65d0 __CFRunLoopServiceMachPort + 192
3 CoreFoundation 0x1924f41ec __CFRunLoopRun + 1132
4 CoreFoundation 0x1924222b8 CFRunLoopRunSpecific + 444
5 WebCore 0x197027660 RunWebThread(void*) + 456
6 libsystem_pthread.dylib 0x1915dd850 _pthread_body + 240
7 libsystem_pthread.dylib 0x1915dd760 _pthread_body + 282
8 libsystem_pthread.dylib 0x1915dad94 thread_start + 4

#8. JIT Worklist Worker Thread
0 libsystem_kernel.dylib 0x191516e1c __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1915dc9c0 _pthread_cond_wait + 640
2 libc++.1.dylib 0x190f053ec std::__1::condition_variable::wait(std::__1::unique_lockstd::__1::mutex&) + 56
3 JavaScriptCore 0x196d0ed44 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 2132
4 JavaScriptCore 0x196ae6a38 JSC::JITWorklist::runThread() + 192
5 JavaScriptCore 0x196ae6e88 WTF::Vector<WTF::RefPtrJSC::JITWorklist::Plan, 32ul, WTF::CrashOnOverflow, 16ul>::expandCapacity(unsigned long, WTF::RefPtrJSC::JITWorklist::Plan) + 14
6 JavaScriptCore 0x19645709c WTF::threadEntryPoint(void) + 212
7 JavaScriptCore 0x196456fac WTF::wtfThreadEntryPoint(void*) + 24
8 libsystem_pthread.dylib 0x1915dd850 _pthread_body + 240
9 libsystem_pthread.dylib 0x1915dd760 _pthread_body + 282
10 libsystem_pthread.dylib 0x1915dad94 thread_start + 4

#9. WTF Parallel Helper Thread
0 libsystem_kernel.dylib 0x191516e1c __psynch_cvwait + 8
1 libsystem_pthread.dylib 0x1915dc9c0 _pthread_cond_wait + 640
2 libc++.1.dylib 0x190f053ec std::__1::condition_variable::wait(std::__1::unique_lockstd::__1::mutex&) + 56
3 JavaScriptCore 0x196d0ed44 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 2132
4 JavaScriptCore 0x196d0e2c8 WTF::ParallelHelperPool::waitForClientWithTask(WTF::LockerWTF::LockBase const&) + 288
5 JavaScriptCore 0x196d0e068 WTF::ParallelHelperPool::helperThreadBody() + 76
6 JavaScriptCore 0x19645709c WTF::threadEntryPoint(void*) + 212
7 JavaScriptCore 0x196456fac WTF::wtfThreadEntryPoint(void*) + 24
8 libsystem_pthread.dylib 0x1915dd850 _pthread_body + 240
9 libsystem_pthread.dylib 0x1915dd760 _pthread_body + 282
10 libsystem_pthread.dylib 0x1915dad94 thread_start + 4

#10. Deadlock Detection Thread
0 libsystem_kernel.dylib 0x191517314 __semwait_signal + 8
1 libsystem_c.dylib 0x19143525c nanosleep + 212
2 Foundation 0x19305c118 +[NSThread sleepForTimeInterval:] + 136
3 Pinterest 0x1000f7118 +[PIDeadlockDetector detectionThreadLoop:] (PIDeadlockDetector.m:133)
4 Foundation 0x19305ce68 NSThread__start + 1024
5 libsystem_pthread.dylib 0x1915dd850 _pthread_body + 240
6 libsystem_pthread.dylib 0x1915dd760 _pthread_body + 282
7 libsystem_pthread.dylib 0x1915dad94 thread_start + 4

#11. Thread
0 libsystem_kernel.dylib 0x191517a88 __workq_kernreturn + 8
1 libsystem_pthread.dylib 0x1915db344 _pthread_wqthread + 1452
2 libsystem_pthread.dylib 0x1915dad8c start_wqthread + 4

#12. Serial animated image processing queue.
0 libsystem_kernel.dylib 0x1914f91c4 semaphore_wait_trap + 8
1 libdispatch.dylib 0x1913e4df8 _dispatch_group_wait_slow + 304
2 Pinterest 0x100a449a4 +[PINAnimatedImageManager processAnimatedImage:temporaryDirectory:infoCompletion:decodedPath:] (PINAnimatedImageManager.m:415)
3 Pinterest 0x100a42e80 __78-[PINAnimatedImageManager animatedPathForImageData:infoCompletion:completion:]_block_invoke.84 (PINAnimatedImageManager.m:166)
4 libdispatch.dylib 0x1913d21fc _dispatch_call_block_and_release + 24
5 libdispatch.dylib 0x1913d21bc _dispatch_client_callout + 16
6 libdispatch.dylib 0x1913e03dc _dispatch_queue_serial_drain + 928
7 libdispatch.dylib 0x1913d59a4 _dispatch_queue_invoke + 652
8 libdispatch.dylib 0x1913e08d8 _dispatch_queue_override_invoke + 360
9 libdispatch.dylib 0x1913e234c _dispatch_root_queue_drain + 572
10 libdispatch.dylib 0x1913e20ac _dispatch_worker_thread3 + 124
11 libsystem_pthread.dylib 0x1915db2a0 _pthread_wqthread + 1288
12 libsystem_pthread.dylib 0x1915dad8c start_wqthread + 4

#13. Crashed: PINAnimatedImage disk write queue
0 libsystem_platform.dylib 0x1915d4e60 _platform_memmove + 96
1 ImageIO 0x1943c0a74 GIFReadPlugin::copyImageBlockSet(InfoRec*, CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 3192
2 ImageIO 0x1943c0a74 GIFReadPlugin::copyImageBlockSet(InfoRec*, CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 3192
3 ImageIO 0x1943bf7c4 GIFReadPlugin::CopyImageBlockSetProc(void*, CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 124
4 ImageIO 0x19422073c IIOImageProviderInfo::copyImageBlockSetWithOptions(CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 496
5 ImageIO 0x19421e640 IIOImageProviderInfo::CopyImageBlockSetWithOptions(void*, CGImageProvider*, CGRect, CGSize, __CFDictionary const*) + 356
6 CoreGraphics 0x1939eeb24 CGImageProviderCopyImageBlockSet + 220
7 CoreGraphics 0x193c833ac imageProvider_getBytes + 88
8 CoreGraphics 0x193ab30e0 CGDataProviderCopyData + 280
9 Pinterest 0x100a46238 __94+[PINAnimatedImageManager processAnimatedImage:temporaryDirectory:infoCompletion:decodedPath:]_block_invoke.225 (PINAnimatedImageManager.m:397)
10 libdispatch.dylib 0x1913d21fc _dispatch_call_block_and_release + 24
11 libdispatch.dylib 0x1913d21bc _dispatch_client_callout + 16
12 libdispatch.dylib 0x1913e012c _dispatch_queue_serial_drain + 240
13 libdispatch.dylib 0x1913d59a4 _dispatch_queue_invoke + 652
14 libdispatch.dylib 0x1913e08d8 _dispatch_queue_override_invoke + 360
15 libdispatch.dylib 0x1913e234c _dispatch_root_queue_drain + 572
16 libdispatch.dylib 0x1913e20ac _dispatch_worker_thread3 + 124
17 libsystem_pthread.dylib 0x1915db2a0 _pthread_wqthread + 1288
18 libsystem_pthread.dylib 0x1915dad8c start_wqthread + 4

#14. Thread
0 libsystem_kernel.dylib 0x191517a88 __workq_kernreturn + 8
1 libsystem_pthread.dylib 0x1915db344 _pthread_wqthread + 1452
2 libsystem_pthread.dylib 0x1915dad8c start_wqthread + 4

#15. Thread
0 libsystem_kernel.dylib 0x191517a88 __workq_kernreturn + 8
1 libsystem_pthread.dylib 0x1915db344 _pthread_wqthread + 1452
2 libsystem_pthread.dylib 0x1915dad8c start_wqthread + 4

#16. Thread
0 libsystem_pthread.dylib 0x1915dad88 start_wqthread + 126

#17. com.pinterest.PINDiskCache.trash
0 libsystem_kernel.dylib 0x191516b88 __open + 8
1 libsystem_kernel.dylib 0x191515690 open + 16
2 CoreServicesInternal 0x1a871c094 ftsattr_read + 136
3 CoreServicesInternal 0x1a8718dc8 _GetDirectoryURLs(_CFURLEnumerator*) + 1180
4 CoreServicesInternal 0x1a871811c _URLEnumeratorGetNextURL + 144
5 Foundation 0x193005c54 -[NSFileManager contentsOfDirectoryAtURL:includingPropertiesForKeys:options:error:] + 296
6 Pinterest 0x100a2f440 __26+[PINDiskCache emptyTrash]_block_invoke (PINDiskCache.m:309)
7 libdispatch.dylib 0x1913d21fc _dispatch_call_block_and_release + 24
8 libdispatch.dylib 0x1913d21bc _dispatch_client_callout + 16
9 libdispatch.dylib 0x1913e03dc _dispatch_queue_serial_drain + 928
10 libdispatch.dylib 0x1913d59a4 _dispatch_queue_invoke + 652
11 libdispatch.dylib 0x1913e234c _dispatch_root_queue_drain + 572
12 libdispatch.dylib 0x1913e20ac _dispatch_worker_thread3 + 124
13 libsystem_pthread.dylib 0x1915db2a0 _pthread_wqthread + 1288
14 libsystem_pthread.dylib 0x1915dad8c start_wqthread + 4

#18. org.AsyncDisplayKit.ASDisplayLayer.displayQueue
0 CoreGraphics 0x193b89358 argb32_sample_argb32 + 1572
1 CoreGraphics 0x193b91bf4 argb32_image + 1324
2 CoreGraphics 0x193c1e7f4 ripl_Mark + 32
3 CoreGraphics 0x193c1b404 RIPLayerBltImage + 972
4 CoreGraphics 0x193b7b9c0 ripc_DrawImage + 756
5 CoreGraphics 0x193b6ba14 CGContextDrawImageWithOptions + 636
6 UIKit 0x19840f7b0 -[UIImage drawInRect:blendMode:alpha:] + 1436
7 Pinterest 0x1008b6b5c +[ASImageNode createContentsForkey:isCancelled:] (ASImageNode.mm:461)
8 Pinterest 0x1008b687c +[ASImageNode contentsForkey:isCancelled:] (ASImageNode.mm:404)
9 Pinterest 0x1008b6628 -[ASImageNode displayWithParameters:isCancelled:] (ASImageNode.mm:378)
10 Pinterest 0x100895024 __90-[ASDisplayNode(AsyncDisplay) _displayBlockWithAsynchronous:isCancelledBlock:rasterizing:]_block_invoke.60 (ASDisplayNode+AsyncDisplay.mm:238)
11 Pinterest 0x100861eec __71-[_ASAsyncTransaction addOperationWithBlock:priority:queue:completion:]_block_invoke (_ASAsyncTransaction.mm:432)
12 Pinterest 0x10086116c ___ZN23ASAsyncTransactionQueue9GroupImpl8scheduleElPU28objcproto17OS_dispatch_queue8NSObjectU13block_pointerFvvE_block_invoke (_ASAsyncTransaction.mm:253)
13 libdispatch.dylib 0x1913d21fc _dispatch_call_block_and_release + 24
14 libdispatch.dylib 0x1913d21bc _dispatch_client_callout + 16
15 libdispatch.dylib 0x1913def94 _dispatch_continuation_pop + 576
16 libdispatch.dylib 0x1913dec58 _dispatch_async_redirect_invoke + 628
17 libdispatch.dylib 0x1913e234c _dispatch_root_queue_drain + 572
18 libdispatch.dylib 0x1913e20ac _dispatch_worker_thread3 + 124
19 libsystem_pthread.dylib 0x1915db2a0 _pthread_wqthread + 1288
20 libsystem_pthread.dylib 0x1915dad8c start_wqthread + 4

#19. Thread
0 libsystem_kernel.dylib 0x191517a88 __workq_kernreturn + 8
1 libsystem_pthread.dylib 0x1915db344 _pthread_wqthread + 1452
2 libsystem_pthread.dylib 0x1915dad8c start_wqthread + 4

Product Version:
Created: 2017-01-25T23:29:22.415100
Originated: 2017-01-25T00:00:00
Open Radar Link: http://www.openradar.me/30196911