Description

Many clients have hit a crash due to an Apple library using operator delete on a memory block that was not allocated with operator new. This happens with the following callstack on iOS9 in UE4.13 or later:

0 EFGame 0x019121a8 FMallocBinned::GetAllocationSize(void*, unsigned long&) (in efgame) (MallocBinned.cpp:1061)
1 EFGame 0x0194b6e2 FMallocPoisonProxy::Free(void*) (in efgame) (MallocPoisonProxy.h:78)
2 EFGame 0x0191dc40 FMemory::Free(void*) (in efgame) + 194
3 EFGame 0x0097443c operator delete(void*) (in efgame) + 14
4 CFNetwork 0x25c6bbf4 XTubeManager::~XTubeManager() + 112
5 CFNetwork 0x25c6bb30 XTubeManager::~XTubeManager() + 8
6 CFNetwork 0x25c68a1e -[__NSURLSessionLocal _onqueue_checkForCompletion] + 162
7 CFNetwork 0x25c699f6 -[__NSURLSessionLocal _onqueue_completeInvalidation:] + 106
8 libdispatch.dylib 0x252efcbe _dispatch_call_block_and_release + 10
9 libdispatch.dylib 0x252f9e7e _dispatch_queue_drain + 1762
10 libdispatch.dylib 0x252f2e16 _dispatch_queue_invoke + 282
11 libdispatch.dylib 0x252fb6a0 _dispatch_root_queue_drain + 1572
12 libdispatch.dylib 0x252fb07a _dispatch_worker_thread3 + 94
13 libsystem_pthread.dylib 0x2548ee0c _pthread_wqthread + 1024
14 libsystem_pthread.dylib 0x2548e9fc start_wqthread + 8

Steps to Reproduce

requires sample iOS project using CFNetwork
see external URLs for some examples

Callstack

0 EFGame 0x019121a8 FMallocBinned::GetAllocationSize(void*, unsigned long&) (in efgame) (MallocBinned.cpp:1061)
1 EFGame 0x0194b6e2 FMallocPoisonProxy::Free(void*) (in efgame) (MallocPoisonProxy.h:78)
2 EFGame 0x0191dc40 FMemory::Free(void*) (in efgame) + 194
3 EFGame 0x0097443c operator delete(void*) (in efgame) + 14
4 CFNetwork 0x25c6bbf4 XTubeManager::~XTubeManager() + 112
5 CFNetwork 0x25c6bb30 XTubeManager::~XTubeManager() + 8
6 CFNetwork 0x25c68a1e -[__NSURLSessionLocal _onqueue_checkForCompletion] + 162
7 CFNetwork 0x25c699f6 -[__NSURLSessionLocal _onqueue_completeInvalidation:] + 106
8 libdispatch.dylib 0x252efcbe _dispatch_call_block_and_release + 10
9 libdispatch.dylib 0x252f9e7e _dispatch_queue_drain + 1762
10 libdispatch.dylib 0x252f2e16 _dispatch_queue_invoke + 282
11 libdispatch.dylib 0x252fb6a0 _dispatch_root_queue_drain + 1572
12 libdispatch.dylib 0x252fb07a _dispatch_worker_thread3 + 94
13 libsystem_pthread.dylib 0x2548ee0c _pthread_wqthread + 1024
14 libsystem_pthread.dylib 0x2548e9fc start_wqthread + 8

Have Comments or More Details?

There's no existing public thread on this issue, so head over to Questions & Answers just mention UE-39395 in the post.

0
Login to Vote

Fixed
ComponentUE - Platform - Mobile
Affects Versions4.13
Target Fix4.15
Fix Commit3225868
Main Commit3233813
CreatedDec 6, 2016
ResolvedDec 7, 2016
UpdatedSep 16, 2019
View Jira Issue