• 復(fù)現(xiàn)步驟 （UIWebView）

  微博：

未命名.gif

美團(tuán)：

meituan.gif

• 堆棧信息

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: 0x00000000 at 0x000000098363da90
Crashed Thread:  0
 
Thread 0 name:  Dispatch queue: com.apple.main-thread
 
Thread 0 Crashed:
0   libobjc.A.dylib                 objc_msgSend + 28
1   UIKit                           +[UIViewController _viewControllerForFullScreenPresentationFromView:] + 40
2   UIKit                           -[UIWebFileUploadPanel _presentFullscreenViewController:animated:] + 88
3   UIKit                           __51-[UIDocumentMenuViewController _dismissWithOption:]_block_invoke.220 + 92
4   UIKit                           -[UIPresentationController transitionDidFinish:] + 1324
5   UIKit                           __56-[UIPresentationController runTransitionForCurrentState]_block_invoke_2 + 188
6   UIKit                           -[_UIViewControllerTransitionContext completeTransition:] + 116
7   UIKit                           -[UITransitionView notifyDidCompleteTransition:] + 252
8   UIKit                           -[UITransitionView _didCompleteTransition:] + 1240
9   UIKit                           -[UITransitionView _transitionDidStop:finished:] + 124
10  UIKit                           -[UIViewAnimationState sendDelegateAnimationDidStop:finished:] + 312
11  UIKit                           -[UIViewAnimationState animationDidStop:finished:] + 160
12  QuartzCore                      CA::Layer::run_animation_callbacks(void*) + 260
13  libdispatch.dylib               _dispatch_client_callout + 16
14  libdispatch.dylib               _dispatch_main_queue_callback_4CF + 1000
15  CoreFoundation                  __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 12
16  CoreFoundation                  __CFRunLoopRun + 1660
17  CoreFoundation                  CFRunLoopRunSpecific + 444
18  GraphicsServices                GSEventRunModal + 180
19  UIKit                           -[UIApplication _run] + 684
20  UIKit                           UIApplicationMain + 208
21  moma                            main (main.m:15)
22  libdyld.dylib                   start + 4

• 原因

  在一個(gè)可以上傳圖片照片的wenView頁(yè)面中喚起UIWebFileUploadPanel的同時(shí)將web頁(yè)面pop掉，這時(shí)UIWebFileUploadPanel對(duì)象中持有的documentView(documentView是一個(gè)assign類(lèi)型)就會(huì)變?yōu)橐爸羔?，再去訪問(wèn)這個(gè)野指針就會(huì)crash。

• 解決方案

  hook住UIWebFileUploadPanel中documentView的set方法，用一個(gè)weak對(duì)象持有它，理論上當(dāng)web頁(yè)面消失之后這個(gè)weak對(duì)象會(huì)自動(dòng)被置為nil。通過(guò)這個(gè)原理來(lái)判斷documentView對(duì)象是否已經(jīng)被銷(xiāo)毀，如果已經(jīng)被銷(xiāo)毀則不再做后續(xù)操作，避免野指針crash的發(fā)生。

• Code

#import <objc/runtime.h>

__weak id privateDocumentView = nil;

@implementation NSObject (DEFFixWebFileUploadPannelCrash)

+ (void)load
{
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        NSString *fileUploadPanel = @"UIWebFileUploadPanel";
        Class fileUploadCls = NSClassFromString(fileUploadPanel);
        SEL panelSetterSwizzedSel = NSSelectorFromString(@"setDocumentView:");
        SEL panelSwizzedSel = NSSelectorFromString(@"_presentFullscreenViewController:animated:");
        
        SEL overrideSelector = @selector(p_presentFullscreenViewController:animated:);
        SEL orerrideSetDocumentSel = @selector(p_setDocumentView:);
        
        SwizzledMethod(fileUploadCls, self, panelSwizzedSel, overrideSelector);
        SwizzledMethod(fileUploadCls, self, panelSetterSwizzedSel, orerrideSetDocumentSel);
    });
}

- (void)p_presentFullscreenViewController:(id)controller animated:(BOOL)animated
{
    if (!privateDocumentView) {
        return;
    }
    [self p_presentFullscreenViewController:controller animated:animated];
}

- (void)p_setDocumentView:(id)documentView
{
    privateDocumentView = documentView;
    [self p_setDocumentView:documentView];
}

@end