-
復(fù)現(xiàn)步驟 （UIWebView）
微博：
未命名.gif
美團(tuán)：
meituan.gif
- 堆棧信息
Exception Type: EXC_BAD_ACCESS (SIGBUS)
Exception Codes: 0x00000000 at 0x000000098363da90
Crashed Thread: 0
Thread 0 name: Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0 libobjc.A.dylib objc_msgSend + 28
1 UIKit +[UIViewController _viewControllerForFullScreenPresentationFromView:] + 40
2 UIKit -[UIWebFileUploadPanel _presentFullscreenViewController:animated:] + 88
3 UIKit __51-[UIDocumentMenuViewController _dismissWithOption:]_block_invoke.220 + 92
4 UIKit -[UIPresentationController transitionDidFinish:] + 1324
5 UIKit __56-[UIPresentationController runTransitionForCurrentState]_block_invoke_2 + 188
6 UIKit -[_UIViewControllerTransitionContext completeTransition:] + 116
7 UIKit -[UITransitionView notifyDidCompleteTransition:] + 252
8 UIKit -[UITransitionView _didCompleteTransition:] + 1240
9 UIKit -[UITransitionView _transitionDidStop:finished:] + 124
10 UIKit -[UIViewAnimationState sendDelegateAnimationDidStop:finished:] + 312
11 UIKit -[UIViewAnimationState animationDidStop:finished:] + 160
12 QuartzCore CA::Layer::run_animation_callbacks(void*) + 260
13 libdispatch.dylib _dispatch_client_callout + 16
14 libdispatch.dylib _dispatch_main_queue_callback_4CF + 1000
15 CoreFoundation __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 12
16 CoreFoundation __CFRunLoopRun + 1660
17 CoreFoundation CFRunLoopRunSpecific + 444
18 GraphicsServices GSEventRunModal + 180
19 UIKit -[UIApplication _run] + 684
20 UIKit UIApplicationMain + 208
21 moma main (main.m:15)
22 libdyld.dylib start + 4
-
原因
在一個(gè)可以上傳圖片照片的wenView頁(yè)面中喚起UIWebFileUploadPanel的同時(shí)將web頁(yè)面pop掉悔雹，這時(shí)UIWebFileUploadPanel對(duì)象中持有的documentView(documentView是一個(gè)assign類(lèi)型)就會(huì)變?yōu)橐爸羔樞埠螅偃ピL(fǎng)問(wèn)這個(gè)野指針就會(huì)crash阱飘。
-
解決方案
hook住UIWebFileUploadPanel中documentView的set方法，用一個(gè)weak對(duì)象持有它井辆，理論上當(dāng)web頁(yè)面消失之后這個(gè)weak對(duì)象會(huì)自動(dòng)被置為nil。通過(guò)這個(gè)原理來(lái)判斷documentView對(duì)象是否已經(jīng)被銷(xiāo)毀，如果已經(jīng)被銷(xiāo)毀則不再做后續(xù)操作填大，避免野指針crash的發(fā)生。
- Code
#import <objc/runtime.h>
__weak id privateDocumentView = nil;
@implementation NSObject (DEFFixWebFileUploadPannelCrash)
+ (void)load
{
static dispatch_once_t onceToken;
dispatch_once(&onceToken, ^{
NSString *fileUploadPanel = @"UIWebFileUploadPanel";
Class fileUploadCls = NSClassFromString(fileUploadPanel);
SEL panelSetterSwizzedSel = NSSelectorFromString(@"setDocumentView:");
SEL panelSwizzedSel = NSSelectorFromString(@"_presentFullscreenViewController:animated:");
SEL overrideSelector = @selector(p_presentFullscreenViewController:animated:);
SEL orerrideSetDocumentSel = @selector(p_setDocumentView:);
SwizzledMethod(fileUploadCls, self, panelSwizzedSel, overrideSelector);
SwizzledMethod(fileUploadCls, self, panelSetterSwizzedSel, orerrideSetDocumentSel);
});
}
- (void)p_presentFullscreenViewController:(id)controller animated:(BOOL)animated
{
if (!privateDocumentView) {
return;
}
[self p_presentFullscreenViewController:controller animated:animated];
}
- (void)p_setDocumentView:(id)documentView
{
privateDocumentView = documentView;
[self p_setDocumentView:documentView];
}
@end
