In the blog article about how to locate crash logs I showed you where to find crash logs on the hard disk.

Analysing a crash log of course is the job of the developer. However, if you want to do a little bit of sleuthing you can identify the relevant section. With this section you can more easily reproduce the problem. Or you can use the section to Goggle if someone else has the same problem.

A crash log has 3 parts:

  • header
  • threads
  • Binary Images

The really interesting part usually is in the threads. We aren’t going to look at the Binary Images part at all.

Analysing the Header:

I was using a development application called Arbed, which crashed:

Process: Arbed [35343] 
Path: /private/var/folders/*/Arbed.app/Contents/MacOS/Arbed
Identifier: org.tempel.arbed 
Version: 1.9b6 (1.9.0.2.6) 
Code Type: X86-64 (Native) 
Parent Process: ??? [1] 
Responsible: Arbed [35343] User ID: 501
Date/Time: 2020-05-25 13:53:09.567 +0200 
OS Version: Mac OS X 10.15.5 (19F83c) 
Report Version: 12 Anonymous UUID: 7293FE3A-5A2F-CA61-3C6F-A22390FE8B35
Sleep/Wake UUID: 9ACD367D-67FC-45F2-AD47-607E6120C5A0
Time Awake Since Boot: 340000 seconds 
Time Since Wake: 3200 seconds
System Integrity Protection: enabled
Notes: Translocated Process
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Exception Type: EXCBADACCESS (SIGSEGV) 
Exception Codes: EXCI386GPFLT 
Exception Note: EXCCORPSENOTIFY
Termination Signal: Segmentation fault: 11 
Termination Reason: Namespace SIGNAL, Code 0xb 
Terminating Process: exc handler [35343]


There isn’t anything interesting here except where it says „Crashed Thread: 0“.

Analysing crashing Threads of different applications

Usually, each app has a lot of threads going on. Think of a thread as sub-process. A lot of threads seem to be internal to macOS and usually contain boring (for us) stuff.

We are now going to look at some crashing threads of crash logs.

Arbed

From the Arbed crash, I located the crashing thread:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 
com.xojo.XojoFramework 0x000000010fee056f StringMapIterator::~StringMapIterator() + 93 1 com.xojo.XojoFramework 0x000000010fee0504 StringMapIterator::~StringMapIterator() + 14 2
com.xojo.XojoFramework 0x000000010ff69571 RuntimeControl::ReleaseData() + 105 3 
org.tempel.arbed 0x000000010e527f54 Control._Exit%%o + 36 4 
com.xojo.XojoFramework 0x000000010ffe2c63 RuntimeUnlockObject + 815 5 
com.xojo.XojoFramework 0x000000010feea268 RuntimePaneDelegate::~RuntimePaneDelegate() + 28 6 
com.xojo.XojoFramework 0x000000010feea28a RuntimePaneDelegate::~RuntimePaneDelegate() + 14 7
com.xojo.XojoFramework 0x000000010feea3c3 RuntimePaneDelegate::PaneClosing(Pane*) + 71 8
com.xojo.XojoFramework 0x000000011001d711 SubPane::Close() + 173 9 
com.xojo.XojoFramework 0x000000011001d7cd SubPane::Unlock() + 143 10 
com.xojo.XojoFramework 0x000000011001d7cd SubPane::Unlock() + 143 11 
com.xojo.XojoFramework 0x000000010fee9e02 RuntimeView::UnifiedClose(bool) + 574 12 com.xojo.XojoFramework 0x000000010ffdfb75 RuntimeCloseWindow + 16 13 org.tempel.arbed 0x000000010e4bdf74 Window.Close%%o + 36 14 org.tempel.arbed 0x000000010ed89e1b RBPrjHLWin.RBPrjHLWin.!ShowProject%o%o + 5483 15 org.tempel.arbed 0x000000010e75b591 MainWin.MainWin.handleEditorDrop%%ov + 5137 16 

I cut that off a bit. The information of each thread is inverted. It starts at the bottom and goes to the top. As result the interesting bits are at the top. I can see a line with Close Window. If I had to Goggle something here it would be „StringMapIterator“.

JWildfire

After installing a beta of Catalina I had a not-so-nice crash in my fractal app JWildfire:

Application Specific Information:
*** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '-[NSCompositeAppearance _callCoreUIWithBlock:options:]: unrecognized selector sent to instance 0x6000022c4580'
abort() called
terminating with uncaught exception of type NSException

Thread 21 Crashed:: Java: AWT-EventQueue-0 0 libsystem_kernel.dylib 0x00007fff6ed4f33a pthreadkill + 10
1 libsystempthread.dylib 0x00007fff6ee0be60 pthreadkill + 430
2 libsystemc.dylib 0x00007fff6ecd6808 abort + 120
3 libc++abi.dylib 0x00007fff6bf36458 abortmessage + 231
4 libc++abi.dylib 0x00007fff6bf278bf demanglingterminate_handler() + 262 5 libobjc.A.dylib 0x00007fff6da625a9 objcterminate() + 96
6 libc++abi.dylib 0x00007fff6bf35887 std::terminate(void ()()) + 8 7 libc++abi.dylib 0x00007fff6bf381a2 cxxabiv1::failed_throw(cxxabiv1::_cxaexception) + 27
8 libc++abi.dylib 0x00007fff6bf38169 _cxathrow + 113
9 libobjc.A.dylib 0x00007fff6da606ed objcexceptionthrow + 350 10 com.apple.CoreFoundation 0x00007fff34d06c77 -[NSObject(NSObject) doesNotRecognizeSelector:] + 132 11 com.apple.CoreFoundation 0x00007fff34bec44b forwarding + 1427 12 com.apple.CoreFoundation 0x00007fff34bebe28 CFforwardingprep0 + 120
13 com.apple.java.JavaRuntimeSupport 0x00007fff3952a4bf -[JRSUIRenderer hitTest:inBounds:atPoint:] + 211
14 com.apple.java.JavaRuntimeSupport 0x00007fff39528d38 GetScrollBarHitPart + 42
15 libosxui.dylib 0x000000010b5d5410 JavaapplelafJRSUIControl_getNativeHitPart + 156


The part with the Application Specific Information is from the header. Then I fished out the crashing thread. There is a bit with exceptions and pthreads. The interesting word here is „GetScrollBarHitPart“. Whenever I tried to move a scrollbar the app crashed. This seems to be a bug in the system theme that the Java app JWildfire uses. Now I have to use another theme, which looks even more odd on Catalina.

Evernote

When looking for crash logs I found a lot of crashes from Evernote. Like 10 crashes a day. As I hadn’t noticed the desktop app of Evernote crashing those crashes must have come from a helper app.

Thread 1 Crashed:: Dispatch queue: com.apple.corespotlight.requests 
0 libsystem_kernel.dylib 0x00007fff6ed4f33a _pthreadkill + 10 
1 libsystempthread.dylib 0x00007fff6ee0be60 pthreadkill + 430 
2 libsystem_c.dylib 0x00007fff6ecd6808 abort + 120 
3 com.evernote.CoreNote 0x000000010aec2fa7 -[ENAccountContext(Migration) considerMigrationWithParams:] + 1169 
4 com.evernote.CoreNote 0x000000010ae91335 -[ENAccountContext initWithParams:] + 1714 
5 com.evernote.CoreNote 0x000000010afa1713 +[ENEvernoteAccountFactory _accountContextWithConfiguration:migrationDelgate:completion:] + 1088 
6 com.evernote.CoreNote 0x000000010afa18b6 +[ENEvernoteAccountFactory accountsWithConfiguration:migrationDelgate:completion:] + 188 
7 com.evernote.AppExtensionCommon 0x000000010b3dc83c 0x10b3c5000 + 96316 
8 com.evernote.AppExtensionCommon 0x000000010b3dc27a 0x10b3c5000 + 94842 
9 com.evernote.Evernote.EvernoteSpotlight 0x000000010adc372f 0x10adc2000 + 5935 
10 com.evernote.Evernote.EvernoteSpotlight 0x000000010adc328f 0x10adc2000 + 4751 
11 com.apple.CoreSpotlight 0x00007fff366f20c6 _63-[MDRemoteExtensionContext performJob:acknowledgementHandler:]blockinvoke_2 + 1928 
12 libdispatch.dylib 0x00007fff6ebad6c4 dispatchcallblockand_release + 12 
13 libdispatch.dylib 0x00007fff6ebae658 dispatchclient_callout + 8 
14 libdispatch.dylib 0x00007fff6ebb3c44 dispatchlaneserialdrain + 597 
15 libdispatch.dylib 0x00007fff6ebb45d6 dispatchlane_invoke + 363 
16 libdispatch.dylib 0x00007fff6ebbdc09 dispatchworkloopworkerthread + 596 
17 libsystem_pthread.dylib 0x00007fff6ee08a3d pthreadwqthread + 290 
18 libsystempthread.dylib 0x00007fff6ee07b77 startwqthread + 15


There isn’t anything helpful in here. If I wanted to do some Goggling I would do that with „ENAccountContext initWithParams“ or „ENEvernoteAccountFactory“. If the crashes continue to occur as often as they did in the last days I'll need to contact support.

Mail Archiver 1

Of course, I make nice hard crashes in my own app, too:

Application Specific Information: Assertion failed: (count >= 0), function providerfordestinationskipforward, file /BuildRoot/Library/Caches/com.apple.xbs/Sources/CoreGraphics/CoreGraphics-1249.2/CoreGraphics/DataManagers/CGDataProviderForDestination.c, line 574.
Thread 5 Crashed: 
0 libsystem_kernel.dylib 0x00007fff7738d23e _pthread kill + 10 
1 libsystem pthread.dylib 0x00007fff77443c1c pthreadkill + 285 
2 libsystem c.dylib 0x00007fff772f61c9 abort + 127 
3 libsystem c.dylib 0x00007fff772be868 _assert rtn + 320 
4 com.apple.CoreGraphics 0x00007fff4a7ad9e2 provider for destination skip forward + 228 
5 com.apple.CoreGraphics 0x00007fff4a44e20b CGAccessSessionGetChunksAtPosition + 195 
6 com.apple.CoreGraphics 0x00007fff4a44d843 img raw read + 1425 
7 com.apple.CoreGraphics 0x00007fff4a495d4e img interpolate read + 724 
8 com.apple.CoreGraphics 0x00007fff4a44b9c6 img data lock + 7610 
9 com.apple.CoreGraphics 0x00007fff4a445e13 CGSImageDataLock + 1256 
10 com.apple.CoreGraphics 0x00007fff4a4458ae RIPImageDataInitializeShared + 207 
11 com.apple.CoreGraphics 0x00007fff4a44543e RIPImageCacheGetRetained + 661 
12 com.apple.CoreGraphics 0x00007fff4a444f64 ripcAcquireRIPImageData + 293
13 com.apple.CoreGraphics 0x00007fff4a4442d9 ripcDrawImage + 707 
14 com.apple.CoreGraphics 0x00007fff4a444006 CGContextDelegateDrawImage + 41 
15 com.apple.CoreGraphics 0x00007fff4a4437e4 CGContextDrawImageWithOptions + 432 
16 com.apple.CoreGraphics 0x00007fff4a44361f CGContextDrawImage + 51 
17 com.apple.CoreGraphics 0x00007fff4a4f1cab CGPDFDrawingContextDrawImage + 237 
18 com.apple.CoreGraphics 0x00007fff4a5b5e91 opDo + 96
19 com.apple.CoreGraphics 0x00007fff4a4b2b2d pdfscannerhandlexname + 141 
20 com.apple.CoreGraphics 0x00007fff4a4b1dc4 CGPDFScannerScan + 368 
21 com.apple.CoreGraphics 0x00007fff4a4af4ee CGPDFDrawingContextDrawPage + 634 
22 com.apple.CoreGraphics 0x00007fff4a4af242 pdfpagedrawincontext + 125 
23 com.apple.CoreGraphics 0x00007fff4a4af0ff CGContextDrawPDFPageWithDrawingCallbacks + 162 
24 com.apple.CoreGraphics 0x00007fff4a4af057 CGContextDrawPDFPage + 34 
25 com.apple.PDFKit 0x00007fff548efefc -[PDFPage drawWithBox:inContext:withRotation:withAntialiasing:isThumbnail:withAnnotations:withBookmark:withDelegate:] + 1018
26 com.apple.PDFKit 0x00007fff548efaf3 -[PDFPage drawWithBox:inContext:isThumbnail:] + 92
27 MBSMacControlsPDFKitPlugin_19856.dylib 0x000000010ca7366f RenderPage(REALobjectStruct, double, long long, REALobjectStruct) + 847 28 com.mothsoftware.mailarchiverx 0x0000000104958e15 PDFPageMBS.Render%o%of8i8o + 101


Again we see some boring lines with „pthread kill“. But then we see „CGAccessSessionGetChunksAtPosition“ and way down is something about a PDFPage. Mail Archiver is rendering a PDF and because of a bug in macOS the app is having a crash. macOS shouldn’t crash at all here, but it should exit gracefully. Mail Archiver has a workaround to deal with such PDFs.

Mail Archiver 2

Dealing with files is complicated, too:

CFRetain() called with NULL Thread 5 Crashed: 
0 com.apple.CoreFoundation 0x00007fff377dfc4e CFRetain.cold.1 + 14 
1 com.apple.CoreFoundation 0x00007fff37632459 CFRetain + 106 
2 com.apple.CoreServicesInternal 0x00007fff501999db CreateByResolvingAliasFile(_CFAllocator const, __CFURL const, unsigned long, unsigned char, __CFError) + 54 
3 com.apple.CoreServicesInternal 0x00007fff50199801 URLCreateByResolvingAliasFile + 48
4 com.apple.Foundation 0x00007fff39de80e6 -[NSURL initByResolvingAliasFileAtURL:options:error:] + 269
5 com.apple.Foundation 0x00007fff39de7fc9 +[NSURL URLByResolvingAliasFileAtURL:options:error:] + 61
6 com.xojo.XojoFramework 0x000000010ee5fc07 FolderItemImpNSURL::FolderItemImpNSURL(NSURL*, bool) + 81
7 com.xojo.XojoFramework 0x000000010ee61c15 FolderItemImpNSURL::GetChildByName(string, long) + 131
8 com.xojo.XojoFramework 0x000000010efc1e93 0x10edc5000 + 2084499
9 com.mothsoftware.mailarchiverx 0x000000010b44b488 FolderItem.Child%o%osb + 136
10 com.mothsoftware.mailarchiverx 0x000000010cc84057 reportPrinter.getFile%o%oosb + 695
11 com.mothsoftware.mailarchiverx 0x000000010cc8ad72 reportPrinter.getPDFFilePath%o%o + 8562
12 com.mothsoftware.mailarchiverx 0x000000010cc83294 reportPrinter.printTemplate%%o + 1668
13 com.mothsoftware.mailarchiverx 0x000000010c99a8f9 WriteMessageToPDF.Constructor%%osobbi8sss + 9225
14 com.mothsoftware.mailarchiverx 0x000000010c99602e WriteMessageToDatabase.Constructor%%osooss + 11102
15 com.mothsoftware.mailarchiverx 0x000000010c2bf7e8 MailParser.parse%i8%o + 17304
16 com.mothsoftware.mailarchiverx 0x000000010cd9c355 ArchiveThread.Archive%%o + 17685
17 com.mothsoftware.mailarchiverx 0x000000010cd931a5 ArchiveThread.EventRun%%o + 117 
18 com.xojo.XojoFramework 0x000000010f03c860 0x10edc5000 + 2586720 
19 com.xojo.XojoFramework 0x000000010eef6345 0x10edc5000 + 1250117 
20 libsystem_pthread.dylib 0x00007fff6ef5ae65 pthreadstart + 148 21 libsystempthread.dylib 0x00007fff6ef5683b threadstart + 15

There are some boring lines with „CFRetain“. But „_URLCreateByResolvingAliasFile“ gives the hint what is happening here: macOS has problems resolving the file for an alias. This type of bug makes me think that the Apple developers are only interested in emojis.

Conclusion

We now had a look at 5 different crash logs. Not in every crash log there is something interesting to see. The Evernote crash log was an example of that. Of course, in my own app dealing with hard crashes is somewhat easier as I'm familiar with the code. Looking at the crashes of Arbed and JWildfire I was at least able to have an idea what action was causing the crash.