ios - iOS 中的 "effective power"问题是由于内存管理错误吗？

Question

iOS 中最近的“有效功率”错误是一条充满特定字符的文本消息(“لُّبُلُلainّبُررً ॣ ॣh ॣ ॣ 冗”)iOS 错误，当在 iOS 上作为通知发送和查看时，会导致手机重置。

我的问题是这是否是由于 iOS 内存管理中的一些错误。据我了解，当 iOS 设备接收数据时，它是 NSData 的形式。文本通常采用 UTF-8(unicode 8 位编码)的形式，然后 iOS 系统使用 iOS 使用的任何 unicode 库解析 UTF-8 数据。

是否有可能在此转换中的某处，这些字符，因为它们非常不常见并且具有非常长的 unicode 签名，导致某种缓冲区溢出？然后 iOS 可能会通过重置手机来终止此进程，以避免任何类型的系统故障。

这是一篇关于该主题的文章的链接:

http://www.techradar.com/us/news/phone-and-communications/mobile-phones/this-single-text-message-is-crashing-people-s-iphones-here-s-the-fix-1295019

任何回复/见解都会有所帮助。

Answer 1

这是一篇著名的(在俄罗斯 :) 俄罗斯 IT 网站上的文章。

http://habrahabr.ru/post/259007/

作者调查了这个问题，下面你可以看到他得到的崩溃堆栈跟踪。这是他的结论(我翻译了我认为对讨论很重要的部分):

The last documented function call is CTLineCreateWithAttributedString, which gives us nothing. The crash itself occurs inside of CopyFromStorage(TRunGlue&, long) method, and (judging by the assembly code) it happens during copying of a byte array of length long n from one part of memory to another (movq 0x90(%rax), %rdx).

I suppose it occurs because of some differences in calculating length of arabic strings in two different parts of the program. I might be mistaken, please correct me if I'm wrong.

这是堆栈跟踪:

* thread #1: tid = 0xf611cd, 0x00000001120ce5f3 CoreText`CopyFromStorage(TRunGlue&, long) + 28, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x90)
        frame #0: 0x00000001120ce5f3 CoreText`CopyFromStorage(TRunGlue&, long) + 28
        frame #1: 0x00000001120ce283 CoreText`TRunGlue::RotateGlyphs(CFRange, long) + 527
        frame #2: 0x000000011212b71b CoreText`OpenTypeShapingEngine::ApplyScriptShaping(unsigned int*) + 465
        frame #3: 0x00000001120d0201 CoreText`TOpenTypeMorph::ApplyShapingEngine(OTL::GSUB&, OTL::GlyphLookups&, unsigned int*, CFRange, bool&) + 739
        frame #4: 0x00000001120d1007 CoreText`TOpenTypeMorph::ShapeGlyphs(bool&) + 331
        frame #5: 0x0000000112056c4e CoreText`TShapingEngine::ShapeGlyphs(TLine&, TCharStream const*) + 264
        frame #6: 0x000000011205c48b CoreText`TTypesetter::FinishEncoding(std::__1::tuple*, unsigned int, unsigned char> const&, TLine&, signed char) + 127
        frame #7: 0x0000000112070586 CoreText`TTypesetterAttrString::Initialize(__CFAttributedString const*) + 674
        frame #8: 0x000000011207029a CoreText`TTypesetterAttrString::TTypesetterAttrString(__CFAttributedString const*) + 158
        frame #9: 0x000000011205d79f CoreText`CTLineCreateWithAttributedString + 63
        frame #10: 0x0000000110c6d8bd UIFoundation`__NSStringDrawingEngine + 18744
        frame #11: 0x0000000110c68f5f UIFoundation`-[NSString(NSExtendedStringDrawing) boundingRectWithSize:options:attributes:context:] + 198
        frame #12: 0x000000010e875788 UIKit`-[UIButton _intrinsicSizeWithinSize:] + 946
        frame #13: 0x000000010ec2466d UIKit`-[UIView(UIConstraintBasedLayout) intrinsicContentSize] + 37
        frame #14: 0x000000010ec24b6c UIKit`-[UIView(UIConstraintBasedLayout) _generateContentSizeConstraints] + 33
        frame #15: 0x000000010ec24930 UIKit`-[UIView(UIConstraintBasedLayout) _updateContentSizeConstraints] + 422
        frame #16: 0x000000010ec2bd25 UIKit`-[UIView(AdditionalLayoutSupport) updateConstraints] + 162
        frame #17: 0x000000010e87521b UIKit`-[UIButton updateConstraints] + 2925
        frame #18: 0x000000010ec2b346 UIKit`-[UIView(AdditionalLayoutSupport) _internalUpdateConstraintsIfNeededAccumulatingViewsNeedingSecondPassAndViewsNeedingBaselineUpdate:] + 242
        frame #19: 0x000000010ec2b53e UIKit`-[UIView(AdditionalLayoutSupport) _updateConstraintsIfNeededAccumulatingViewsNeedingSecondPassAndViewsNeedingBaselineUpdate:] + 124
        frame #20: 0x000000010e0bd354 CoreFoundation`CFArrayApplyFunction + 68
        frame #21: 0x000000010ec2b2ed UIKit`-[UIView(AdditionalLayoutSupport) _internalUpdateConstraintsIfNeededAccumulatingViewsNeedingSecondPassAndViewsNeedingBaselineUpdate:] + 153
        frame #22: 0x000000010d9ef1be Foundation`-[NSISEngine withBehaviors:performModifications:] + 155
        frame #23: 0x000000010ec2b53e UIKit`-[UIView(AdditionalLayoutSupport) _updateConstraintsIfNeededAccumulatingViewsNeedingSecondPassAndViewsNeedingBaselineUpdate:] + 124
        frame #24: 0x000000010ec2ba0e UIKit`__60-[UIView(AdditionalLayoutSupport) updateConstraintsIfNeeded]_block_invoke + 96
        frame #25: 0x000000010d9ef1be Foundation`-[NSISEngine withBehaviors:performModifications:] + 155
        frame #26: 0x000000010ec2b6d6 UIKit`-[UIView(AdditionalLayoutSupport) updateConstraintsIfNeeded] + 231
        frame #27: 0x000000010ec2bdde UIKit`-[UIView(AdditionalLayoutSupport) _updateConstraintsAtEngineLevelIfNeeded] + 146
        frame #28: 0x000000010e623a3d UIKit`-[UIView(Hierarchy) _updateConstraintsAsNecessaryAndApplyLayoutFromEngine] + 114
        frame #29: 0x000000010e62fa2b UIKit`-[UIView(CALayerDelegate) layoutSublayersOfLayer:] + 536
        frame #30: 0x0000000111e08ec2 QuartzCore`-[CALayer layoutSublayers] + 146
        frame #31: 0x0000000111dfd6d6 QuartzCore`CA::Layer::layout_if_needed(CA::Transaction*) + 380
        frame #32: 0x0000000111dfd546 QuartzCore`CA::Layer::layout_and_display_if_needed(CA::Transaction*) + 24
        frame #33: 0x0000000111d69886 QuartzCore`CA::Context::commit_transaction(CA::Transaction*) + 242
        frame #34: 0x0000000111d6aa3a QuartzCore`CA::Transaction::commit() + 462
        frame #35: 0x000000010e5ada2d UIKit`-[UIApplication _reportMainSceneUpdateFinished:] + 44
        frame #36: 0x000000010e5ae6f1 UIKit`-[UIApplication _runWithMainScene:transitionContext:completion:] + 2648
        frame #37: 0x000000010e5ad0d5 UIKit`-[UIApplication workspaceDidEndTransaction:] + 179
        frame #38: 0x0000000110d835e5 FrontBoardServices`__31-[FBSSerialQueue performAsync:]_block_invoke_2 + 21
        frame #39: 0x000000010e0ea41c CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__ + 12
        frame #40: 0x000000010e0e0165 CoreFoundation`__CFRunLoopDoBlocks + 341
        frame #41: 0x000000010e0dff25 CoreFoundation`__CFRunLoopRun + 2389
        frame #42: 0x000000010e0df366 CoreFoundation`CFRunLoopRunSpecific + 470
        frame #43: 0x000000010e5acb42 UIKit`-[UIApplication _run] + 413
        frame #44: 0x000000010e5af900 UIKit`UIApplicationMain + 1282
      * frame #45: 0x000000010d91ed0f Islam`main(argc=1, argv=0x00007fff522e1330) + 111 at main.m:14
        frame #46: 0x000000011076e145 libdyld.dylib`start + 1