Parsing iOS Crash files (1)

Parsing iOS Crash files (1)
In the process of developing a program, no matter how careful we are, we will always encounter a program crash. When you confidently present your App in front of a group of people for functional rehearsals, smooth operations are relentlessly interrupted by Crash. Lenovo said when he launched the Smartisan OS that he had prepared 10 mobile phones. If there was a problem with one, he would have changed one. If there were 10 phones, he would not have done it. Now, let's talk about the composition of the iOSCrash file and common analysis tools. We recommend you take a look at the WWDC 2010 video named "Understanding Crash Reports on iPhone OS". This video details the structure of the Crash file. If you do not have time to read this article, read the following. 1. The Crash file structure when the program runs the Crash program, the system will record the running information of the last run time and store it in a file, that is, what we call the Crash file. IOS Crash logs are generally composed of the following six parts. 1. Unique Identifier of the Process Information Incident Idnetifier crash report, unique Key value corresponding to different crashcrashcrashreporter Key Identifiers (not the real device UDID, in order to protect user privacy, Apple will no longer be able to obtain iOS6 ). This value is the same for apps of the same version on the same device. The Hardware Model indicates the device type in which a Crash occurs. "iPad4, 4" indicates that the iPad AirProcess represents the name of the Crash process, which is usually the name of our App, [] It is the storage location of the IDPath executable program of the process on the mobile phone. Note that the path is XXX. app/XXX, XXX. the app is actually a Bundle, and the real executable file is actually XXX in the Bundle. If you are interested, you can check the relevant information by yourself, I will introduce Identifier to your App's Indentifier later, usually "com. xxx. yyy ", xxx represents your company's domain name, yyy represents an AppVersion of the current App version, by Info. the two fields in plist are composed of cfbundle‑versionstring and CFBundleVersionCode Type. The CPU architecture of the current App is Parent Process when The parent process of the previous process. Because iOS apps are generally single-process, generally the parent process is launchd 2, Basic Information Date/Time Crash occurrence Time, the Readable string OS Version system Version. The number in () indicates the format of the Report Version Crash log of the Bulid. Currently, it is basically 104, different versions may contain different fields. 3. Exception (very important) Exception Type Exception Subtype: exception subtype Crashed Thread exception Thread number 4. Thread Backtrace the Crash call stack of the Thread where the Crash occurs. The top one indicates the position where the exception is thrown, you can see the order of API calls in sequence. The information indicates that row 323 of xxxViewController appears in this Crash, and the error function call is orderCountLoadFailed. 5. When the Thread State Crash occurs, the Thread State is usually obtained based on the Crash stack. 6. Binary Images Crash: all the libraries loaded by the App at the moment. The first line is the information of the executable file of the App when the Crash occurs. It can be seen that armv7 is used, the package of executable files must be uuid-bit c0f ...... Cd65: when parsing Crash, the uuid of the dsym file must be the same as this to complete the symbolic parsing of Crash. Ii. Common Crash types 1. Watchdog timeout Exception Code: 0x8badf00d, which is not intuitive. You can read it as "eat bad food", which means don't block main thread followed by a description below: application Specific Information: com. xxx. yyy failed to resume in time for such Crash, we should check whether the App Initialization is correct and whether the network is requested in the main thread, or other time-consuming things get stuck in the normal initialization process. Generally, the system allows an App to start up to 5 S for corresponding user events. If it exceeds 5 S, the App will be terminated by the system. There are time requirements for Launch, resume, suspend, and quit. In the Highlight Thread, we can see the position called when it is terminated. Add the row number to xxxAppDelegate. PS. For ease of debugging, the system will temporarily disable Watchdog when connecting to Xcode for debugging. Therefore, the normal startup mode is required to detect such problems. 2. User force-quit Exception Codes: 0xdeadfa11, and deadfall are forced to quit, which is not the same as what we usually call killing background tasks, generally, you can press the power button when the system fails to respond due to a program bug. When the screen shows a shutdown confirmation screen, press the Home Key to close the current program. 3. The Low Memory termination structure is not the same as the general Crash structure. It usually consists of Free pages, Wired Pages, Purgeable pages, and largest process. Colleagues will list information about all processes running in the system at the current time. For more information about Memory warning, see my previous article titled IOS Memory warning level. During App running, when the system memory is insufficient, a warning is often triggered, and the suspended program in the background is terminated. If the memory is insufficient, the current foreground process is terminated. After receiving the memory warning, we should release as much memory as possible. Crash can also be seen as a protection for apps. 4. Crash due to bugs the Crash caused by a program bug is often strange and difficult to generalize. In most cases, the Crash log can be used to locate the problem. Of course, some difficult cases cannot be ruled out to see where the problem occurs for half a day. You can only look at your skills. You can always find clues. If you cannot see it, you can still turn to Google. Some people may encounter the same Bug as you. 3. Common Exception Type & Exception Code 1 and Exception Type 1) EXC_BAD_ACCESS this type of Excpetion is the longest Crash we encounter. It is usually used to access the memory without modifying the access. In general, "()" after EXC_BAD_ACCESS also carries supplementary information. SIGSEGV: Usually because objects are released repeatedly, this type is rarely seen after switching to ARC. SIGABRT: receives the Abort signal to exit. Generally, containers in the Foundation library perform some checks to ensure the normal status. For example, if nil is inserted into the array, this type of error occurs. SEGV :( Segmentation Violation) indicates invalid memory address, such as null pointer, uninitialized pointer, stack overflow, etc.; SIGBUS: Bus Error, different from SIGSEGV, SIGSEGV is accessing an Invalid Address, while SIGBUS is accessing a valid address, but bus access is abnormal (such as address alignment problems) SIGILL: Try to execute an invalid command, it may not be recognized or has no permission. 2) EXC_BAD_INSTRUCTION. This type of exception is usually caused by the execution of illegal commands by the thread. 3) EXC_ARITHMETIC will throw this kind of Exception 2. Exception Code 0 xbaaaaaad this type of log means that this Crash log is not a real Crash, it only contains the running status of the entire system at a certain time point. Generally, you can press the Home Key and volume key at the same time. The user may accidentally trigger 0xbad22222. When the VOIP program is activated too frequently in the background, the system may terminate the program 0x8badf00d. As described earlier, the program startup or recovery time is too long and the watch dog terminates the 0xc00010ff program to execute a large number of CPU-and GPU-consuming operations, resulting in overheating of the device, system overheating is triggered. The 0xdead10cc Program terminated by the system also occupies system resources when it is returned to the background. As mentioned earlier, the address book ended by the system 0xdeadfa11, the program does not respond to user forced shutdown 3. Obtain the Crash Path 1. The local machine connects to the test machine through xCode and can directly read all the Crash logs on the machine in the Device. 2. itunes connect uses the itunes connect background to obtain the Crash logs reported by users. 3. The third-party Crash collection system has many excellent third-party Crash collection systems, which greatly facilitate the Crash collection and even provide the symbolic Crash log function. Crashlytics and Flurry are commonly used. Iv. Appendix Apple official documentation: Understanding and Analyzing iOS Application Crash Reports Technical Note TN2123 CrashReporter https://developer.apple.com/library/ios/qa/qa1592/_index.html WWDC video: Understanding Crash Reports on iPhone OS Crash logging is the time when the Crash occurs, the function call stack and thread information are written into the file. Generally, the hexadecimal address is directly written. If it is not symbolic, it is basically difficult to obtain useful information. In the next article, we will talk about the symbolic Crash log, in layman's terms, Crash logs are converted into readable formats.