Explore invalid memory access

on YouTube ↗21m

" summary

Shows how crashes are traced to concrete causes: use of the Hopper disassembler to map crash-report offsets to ARM64 instructions, reading register state (x0, x1, x16) and exception addresses, and finding a use-after-free in objc message send via selector/requestIdMap offsets. Demonstrates a Swift case where concurrent appends cause an invalid address (array append race), and proves fixes: serialize via a dedicated queue or add a lock to eliminate the swift array race.

AI-written summary · about

" chapters (13)

1. 0:00Intro
2. 0:36Crashes by Invalid Memory Access
3. 0:55IDENTIFY PATTERN
4. 1:47HOW TO DEBUG?
5. 3:13GET MORE FROM CRASH REPORT
6. 5:26WHAT HAPPENED IN MESSAGE SEND FUNCTION
7. 8:51CHECK REGISTER STATE
8. 9:51ABOUT ISA
9. 10:40WHO IS DEALLOCATED OBJECT?
10. 11:48BASE ADDRESS + OFFSET
11. 12:55TRACE ARGUMENTS
12. 13:53TRACE THIS VARIABLE
13. 19:59WRAP IT UP

" related talks

• 57mExploring Swift Memory LayoutMike Ash · GOTO Copenhagen 2016
• 20mAssembly. You can do it!Andrew Madsen · try! Swift Tokyo 2019
• 19mJust Enough Objective-CDaniel Jalkut · dotSwift 2019
• 05mThe Safety of Unsafe SwiftRay Fix · try! Swift Tokyo 2017
• 27mHigh Performance Systems in SwiftCory Benfield · Hacking with Swift Live 2019
• 49mState of Swift Internals: Swift 4 & 5Stephen Tramer · 360iDev 2018
• 34mSo You Think You Know Swift?Nick Lockwood · ServerSide.swift 2024
• 51mSwift 2 Under the HoodAlex Blewitt · GOTO Berlin 2015