-[NSResponder _tryRetain]坠机

Question

，我收到了来自用户的崩溃。：

Crashed Thread:        0

Exception Type:        EXC_BAD_INSTRUCTION (SIGILL)
Exception Codes:       0x0000000000000001, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Illegal instruction: 4
Termination Reason:    Namespace SIGNAL, Code 0x4
Terminating Process:   exc handler [79055]

Thread 0 Crashed:
0   com.apple.AppKit                0x00007fff30cc820a -[NSResponder _tryRetain] + 92
1   libobjc.A.dylib                 0x00007fff693a1e1d objc_loadWeakRetained + 351
2   libobjc.A.dylib                 0x00007fff693a3adc objc_loadWeak + 15
3   com.apple.AppKit                0x00007fff3075605a -[NSTableRowData ensureGroupRowIndexes] + 256
4   com.apple.AppKit                0x00007fff306e8161 -[NSTableView _isGroupRow:] + 106
5   com.apple.AppKit                0x00007fff30807219 -[NSTableView _sendDelegateHeightOfRow:] + 144
6   com.apple.AppKit                0x00007fff307f01cb -[NSTableView _safeSendDelegateHeightOfRow:] + 79
7   com.apple.AppKit                0x00007fff307f00f7 -[NSTableView _uncachedRectHeightOfRow:] + 274
8   com.apple.AppKit                0x00007fff307efe8c -[_NSTableRowHeightStorage _cacheRowHeights] + 52
9   com.apple.AppKit                0x00007fff3068a77d -[_NSTableRowHeightStorage _ensureRowHeights] + 57
10  com.apple.AppKit                0x00007fff3068a6cf -[_NSTableRowHeightStorage computeTableHeightForNumberOfRows:] + 80
11  com.apple.AppKit                0x00007fff30689b93 -[NSTableView _minimumFrameSize] + 73
12  com.apple.AppKit                0x00007fff3068918c -[NSTableView tile] + 285
13  com.apple.AppKit                0x00007fff306b014e -[NSTableView bounds] + 100
14  com.apple.AppKit                0x00007fff3065d920 -[NSView(NSInternal) _setLayerNeedsDisplayInViewRect:] + 171
15  com.apple.AppKit                0x00007fff306136b5 -[NSView setNeedsDisplayInRect:] + 767
16  com.apple.AppKit                0x00007fff30682a18 -[NSTableView _tileAndRedisplayAll] + 217
17  com.apple.CoreFoundation        0x00007fff3342c35f __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 12
18  com.apple.CoreFoundation        0x00007fff334bcc73 ___CFXRegistrationPost1_block_invoke + 63
19  com.apple.CoreFoundation        0x00007fff334bc308 _CFXRegistrationPost1 + 372
20  com.apple.CoreFoundation        0x00007fff334349be ___CFXNotificationPost_block_invoke + 97
21  com.apple.CoreFoundation        0x00007fff3339cce2 -[_CFXNotificationRegistrar find:object:observer:enumerator:] + 1575
22  com.apple.CoreFoundation        0x00007fff3339c172 _CFXNotificationPost + 1351
23  com.apple.Foundation            0x00007fff35a6336b -[NSNotificationCenter postNotificationName:object:userInfo:] + 59
My App Code

这个(来自另一个用户)：

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_INSTRUCTION (SIGILL)
Exception Codes:       0x0000000000000001, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Illegal instruction: 4
Termination Reason:    Namespace SIGNAL, Code 0x4
Terminating Process:   exc handler [68319]

Application Specific Information:
Refcount overflow in NSResponder or subclass. Too many unbalanced -retains!

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.AppKit                0x00007fff3a50820a -[NSResponder _tryRetain] + 92
1   libobjc.A.dylib                 0x00007fff72d7ae1d objc_loadWeakRetained + 351
2   libobjc.A.dylib                 0x00007fff72d7cadc objc_loadWeak + 15
3   com.apple.AppKit                0x00007fff39fa1f0b -[NSTableRowData rowViewAtRow:createIfNeeded:] + 47
4   com.apple.AppKit                0x00007fff3a05577b -[NSTableView viewAtColumn:row:makeIfNecessary:] + 29
    My App Code

下面的消息第一眼就吓到我了.

应用程序特定信息: NSResponder或子类中的刷新溢出。太多不平衡的-retains！

终于成功地将崩溃复制到了测试项目：中。

@implementation AppDelegate

NSString * const SIFTFilePresentationViewIdentifier = @"sift:file presentation";

- (void)applicationDidFinishLaunching:(NSNotification *)aNotification {
    [self registerCells];// < - - - Commenting only this line fixes the issue.

    self.outlineView.delegate = self;
    self.outlineView.dataSource = self;
}

- (void)registerCells {
    NSNib *nib = [[NSNib alloc] initWithNibNamed:@"SIFTFileView" bundle:nil];
    [self.outlineView registerNib:nib forIdentifier:SIFTFilePresentationViewIdentifier];
}

- (NSInteger)outlineView:(NSOutlineView *)outlineView numberOfChildrenOfItem:(id)item {
    if (item == nil) {
        //Works fine:
        //10.14.5 (18F132)
        //MacBook Pro (15-inch, 2017)

        //Crashes:
        //10.15.1 (19B88)
        //MacBook Pro (15-inch, 2018)

        //2^25 = 33554432
        return 33560000;
    } else {
        return 0;
    }
}

- (id)outlineView:(NSOutlineView *)outlineView child:(NSInteger)index ofItem:(id)item {
    if (item == nil) {
        return @"321";
    } else {
        return nil;
    }
}

- (BOOL)outlineView:(NSOutlineView *)outlineView isItemExpandable:(id)item {
    return item == nil;
}

- (BOOL)outlineView:(NSOutlineView *)outlineView isGroupItem:(id)item {// < - - - Commenting only this method fixes the issue.
    return item == nil;
}

@end

项目复制了问题： https://github.com/Vladimir-Nn/NSTableViewRefcountOverflow

网络上的一些相关讨论：

NSParagraphStyle有一个19位的内联保留计数，没有溢出保护(也就是说，如果您保留它太多，然后调用某些版本，它就会被错误地释放)。这在Xcode (rdar://16008112)中偶尔会崩溃。

https://forums.swift.org/t/shrinking-the-heap-object-header/1078

--我看不到LWJGL代码中有任何内存管理会导致溢出。因此，崩溃似乎起源于firstResponder方法内部。如果在早期版本的MacOS中没有发生这种情况，我猜它可能是操作系统错误，或者是该方法工作方式上的某种行为改变。

http://forum.lwjgl.org/index.php?topic=6951.msg36545#msg36545

我不明白为什么这会崩溃，我们只是要求一个NSTextView自己滚动。

我在崩溃报告中确实注意到，NSResponder或子类中有一个刷新溢出的信息文本。太多不平衡的-retains！- @asmagill，你认为这个块应该从弱引用到自我吗？我很难想象这很重要，因为我们记录了很多东西，而且我不相信我们以前见过这起坠机事件。

https://github.com/Hammerspoon/hammerspoon/issues/2206

操作系统版本: Mac 10.15.1 (19B88)

我认为这是NSTableView的一个内部缺陷。如果你有什么想法，请告诉我。

Answer 1

我认为这是NSTableView内部的bug。

在我的例子中，只注释下面的方法解决了这个问题。

- (BOOL)outlineView:(NSOutlineView *)outlineView isGroupItem:(id)item {
    return item == nil;
}

因此，我使用outlineView:isGroupItem: method为NSTableViewDelegate创建了两个对象，并且没有它。所有其他的电话，我只是代理“前”委托。

- (void)updateInterfaceOfOutlineView {
    NSOutlineView *outlineView = self.outlineView;
    for (NSUInteger rowIndex = 0; rowIndex < outlineView.numberOfRows; rowIndex++) {
        @autoreleasepool {//Adding this autoreleasepool also increased the amount of possible rows in table.
            NSView *itemView = [outlineView viewAtColumn:0 row:rowIndex makeIfNecessary:NO];
            if(itemView && [itemView respondsToSelector:@selector(updateInterface)]) {
                [(id<SelectedItemView>)itemView updateInterface];
            }
        }
    }
}

遗留代码..。别太挑剔了。