crash report _NSThreadPerformPerform

I'm getting a crash report that I don't know how to interpret. In the XCode Organizer, it shows this:


libobjc.A.dylib: objc_msgSend + 16


Thread 0

7 UIKit -[UIApplication _run]

8 UIKit UIApplicationMain

9 MyAppName main

10 libdyld.dylib start


Then when I click "Open in Project...", it shows this more comprehensive listing in XCode:


Thread 0

0 objc_msgSend ()

1 __NSThreadPerformPerform

2 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__

3 __CFRunLoopDoSources0

4 __CFRunLoopRun

5 CFRunLoopRunSpecific

6 GSEventRunModal

7 -[UIApplication _run]

8 UIApplicationMain

9 main

10 start


But in XCode it does not take me to any specific place or line of code in the project. So I have no clue if the problem is in my code or Apple's code, or even where to start looking. The __NSThreadPerformPerform on line 0 of the report makes me think it's some kind of @selector message that is being sent to a deallocated instance, but if that's true, why doesn't it say so and why doesn't it tell me the line of code that caused the crash. I also cannot determine from looking at this whether this crash is because of my code, or something buried in Apple's code. Any help is appreciated. I've tested my app to death in the debugger - no crashes. Also, this must be an extremely rare crash, as I've only received 1 crash report.

Replies

Something in your app (though possibly not in code you wrote explicitly) is doing a "performSelector" as a way of deferring execution of a method until the next iteration of the run-loop. When it finally got to executing the method, it crashed in objc_msgSend, trying to enter the method. Because this is a highly optimized piece of the system frameworks, there are no debug symbols to help you. You can try to find (e.g.) the selector from a pointer in machine registers:


www.sealiesoftware.com/blog/archive/2008/09/22/objc_explain_So_you_crashed_in_objc_msgSend.html


The likelihood, though, is that you have a memory management bug in your app, so that (e.g.) the object that is supposed to receive the selector message has been deallocated. It is unwise to assume that the bug is in Apple's code.


Finding memory management bugs that produce rare crashes is difficult. General testing is unlikely to help. You should either try to re-create the conditions under which the crash occurs, or try to reason about your code's correctness. I recommend you run the source code analyzer (on the Product menu in Xcode) if you haven't done that already, and try running with the Zombies tool in Instruments.

I can't examine the iPad CPU registers unless I recreate the crash myself in the debugger. As I have been unable to reproduce the crash, it's sort of hopeless for me and I have no idea what the conditions are at crash time. The source code analyzer returns 0 issues. Running with Zombies enabled is only useful if I can re-create the crash, which I cannot.


It's too bad the crash report didn't use the CPU registers to tell me at least the name of the selector, that would give me a huge head start. But obviously if that were possible it would have been done already. I don't know enough about precisely what happens in a crash to know why that's not the case. Or is this because it's not in code I wrote explicitly. Meaning, if it were in code I wrote explicitly, the crash report would have included the name of the selector?

Yes, I know it's discouraging, but sometimes you have to look for the problem even when you don't know what it is. Have you worked through the information in:


developer.apple.com/library/content/technotes/tn2151/_index.html


>> Running with Zombies enabled is only useful if I can re-create the crash


Not necessarily. If you have a memory management problem, it's entirely possible to go on referring to a released object, if there's nothing that causes the memory to be re-used. Running with zombies can expose this kind of problem much earlier and much more reliably.


>> the crash report would have included the name of the selector?


Sometimes there's an exception message that gives more information, but a crash in objc_msgSend tends to be cryptic.

thanks. I didn't realize that about Zombies. Will try running with Zombies as soon as I can! fingers crossed...

I can't examine the iPad CPU registers unless I recreate the crash myself in the debugger.

The CPU registers are included in the crash report, in the Thread State section.

One thing I find instructive when debugging wacky problems like this is to create a dummy app that reproduces the problem. I can then experiment in the dummy app and, once I know what I’m doing, apply those results to the crash in the real app.

For example, this code produces a crash that’s very like the one you’ve reported:

@interface Hack : NSObject

- (void)varnishWaffles:(id)sender;

@end

@implementation Hack

- (void)varnishWaffles:(id)sender {
    NSLog(@"varnish request from %@", sender);
}

@end

Hack * h = [[Hack alloc] init];
[h performSelector:@selector(varnishWaffles:) withObject:self afterDelay:0.1];
[h release];
[h release];

When I run this in the debugger, I see that

x1
contains the selector:
(lldb) p (char *)$x1
(char *) $0 = 0x00000001000b3215 "varnishWaffles:"

Now let’s look at that in a crash log. The crashing thread’s backtrace is as you’d expect:

Thread 0 name:  Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0  … objc_msgSend + 16
1  … __NSFireDelayedPerform + 428
2  … __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 28
3  … __CFRunLoopDoTimer + 872
4  … __CFRunLoopDoTimers + 244
5  … __CFRunLoopRun + 1572
6  … CFRunLoopRunSpecific + 444
7  … GSEventRunModal + 180
8  … -[UIApplication _run] + 684
9  … UIApplicationMain + 208
10 … main (main.m:15)
11 … start + 4

So, let’s take a look at

x1
.
Thread 0 crashed with ARM Thread State (64-bit):
    … x1: 0x0000000100027215 …
    …

We can find the image containing that selector by running that address through the Binary Images section:

Binary Images:
0x100020000 - 0x100027fff …/CrashTest
…

Alas, things get a bit complex here. You need to calculate the slide associated with the image so that you can understand the address you got. In this case the slide is 0x20000, because a main executable image is linked to load at 0x100000000 but, as indicated by the Binary Images entry, was actually loaded at 0x100020000. So, the slide is 0x20000, which is the latter subtract the former.

Armed with that you can dump you selector:

$ lldb --arch arm64 build/Debug-iphoneos/CrashTest.app/CrashTest
(lldb) target create --arch=arm64 "build/Debug-iphoneos/CrashTest.app/CrashTest"
Current executable set to 'build/Debug-iphoneos/CrashTest.app/CrashTest' (arm64).
(lldb) p (char *)(0x0000000100027215 - 0x20000)
(char *) $1 = 0x0000000100007215 "varnishWaffles:"

Fun times!

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Thank you for your fascinating answer! However, I don't see a Thread State section. In the Organizer, I see an end-user crash, and I click Open in Project..., then my project opens and I see this:


Thread 0

0 objc_msgSend ()

1 __NSThreadPerformPerform

2 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__

3 __CFRunLoopDoSources0

4 __CFRunLoopRun

5 CFRunLoopRunSpecific

6 GSEventRunModal

7 -[UIApplication _run]

8 UIApplicationMain

9 main

10 start


Line 0 is highlighted. Clicking on any of the lines does nothing. Where would I see the Thread State? I don't see a Binary Images section either.


Also, I created a sample app with your sample crashing code, and when I get the crash, I don't see anything called Thread State or Binary Images. If I click on the line containing objc_msgSend, I get 50 lines of assembler code, here are the first 7 lines:


libobjc.A.dylib`objc_msgSend:
    0x10a7a5ac0 <+0>:   testq  %rdi, %rdi
    0x10a7a5ac3 <+3>:   jle    0x10a7a5b10               ; <+80>
    0x10a7a5ac5 <+5>:   movq   (%rdi), %r10
    0x10a7a5ac8 <+8>:   movq   %rsi, %r11
->  0x10a7a5acb <+11>:  andl   0x18(%r10), %r11d
    0x10a7a5acf <+15>:  shlq   $0x4, %r11


Note that in my end-user crash report, clicking on any of the lines does nothing. But in both cases, I don't see a Thread State or Binary Images section anywhere. I must be missing something.

In the Organizer, I see an end-user crash …

You need to find the underlying text-based crash report file (typically with the

.crash
extension). Unfortunately I can’t give you step-by-step advice here because I don’t have any crashes in my Organizer window (these only show up if you distribute apps via the store, and that’s not something I can do). However, it seems that this is possible. Check out the Viewing and Finding Crash Reports section of the App Distribution Guide.

Also, I created a sample app with your sample crashing code, and when I get the crash, I don't see anything called Thread State or Binary Images.

That’s because you’re running the app in the debugger, which catches the crash as it occurs. You can get much the same information from the debugger (via commands like

register
and
image
, which is an alias for
target modules
) but that’s not really relevant here. Instead you should run the app outside of the debugger and let it crash there. The system will then generate a crash log which you can see via the Devices window in Xcode.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

ahhh, I see. To others reading this, I found the underlying text based .crash file by doing this:


(1) from the XCode Organizer, Ctrl-click on the crash report and select "Show in Finder"

(2) This takes you to a package file with a .xccrashpoint file extension

(3) Ctrl-click on the file and select "Show package contents"

(4) drill down through the folders and you will see a file with a .crash file extension, which you can view in TextEdit or any text editor


It indeed shows the ARM Thread State, as well as the Binary Images.


In my little test app based on your crashing test code, I was able to successfully reproduce printing out the string pointed to by the x1 register. In my case the x1 register in the thread state showed this


x1: 0x0000000100012d25


and the Binary Image of the executable shows this:


Binary Images:

0x10000c000 - 0x100013fff .../testCrashReport


So the offset is presumably 0x10000c000 - 0x100000000 = 0xc000. But when I print out the contents, it's still 8 bytes off for some strange reason. In other words, this happens:


(lldb) p (char *)(0x0000000100012d25 - 0xc000)

(char *) $0 = 0x0000000100006d25 "affles:"


but when make the offset 8 bytes bigger, I get the correct result:


(lldb) p (char *)(0x0000000100012d25 - 0xc008)

(char *) $0 = 0x0000000100006d1d "varnishWaffles:"


Success on the test app, although I must be misunderstanding how you calculate the offset.


As an aside, I also tried printing out the SEL receiver object, which is supposedly stored in register x0 at the time of the crash. The x0 register shows an address of 0x00000001700183c0, and so I did this:


(lldb) p (char *)(0x00000001700183c0 - 0xc000)

(char *) $0 = 0x000000017000c3c0 <no value available>


As you can see, I get <no value available>. Not sure why...I suppose it's not of type (char *). I really want the class name of the receiver.


=========================

Moving on, I tried to print the selector name at the x1 register with my shipping app using the Archived .app file and the user crash file. According to the thread state of the user crash file, the x1 register at the time of the crash contains this address:


0x000000018c6f8629


Scanning the Binary Images, this address is not found in my application, but rather in UIKit:


0x18bbba000 - 0x18c947fff UIKit arm64 <439dc80bfac033ed983e5bb8c416c452> /System/Library/Frameworks/UIKit.framework/UIKit


Well now what? This is in UIKit. Is this a dead end for me, or is there still hope to get the selector? How would I calculate the offset? And where would I find the binary image of UIKit? I think I found the iOS UIKit.framework on my Mac at:


/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk/System/Library/Frameworks


but that doesn't seem to contain what I need...

In my little test app based on your crashing test code, I was able to successfully reproduce printing out the string pointed to by the x1 register.

Cool. To quote Obi-Wan, “You’ve taken your first step into a larger world.”

As an aside, I also tried printing out the SEL receiver object, which is supposedly stored in register x0 at the time of the crash.

That won’t work, because the receiving object is allocated from the heap and thus is found at an (essentially) random place on each run of the app.

Well now what? This is in UIKit.

Right, but that shouldn’t stop you (-: To start, you can explore this by modifying your test app to use a UIKit selector. For example:

@interface Hack : NSObject 

- (void)applicationWillTerminate:(id)sender; 

@end 

@implementation Hack 

- (void)applicationWillTerminate:(id)sender { 
    NSLog(@"well terminate request from %@", sender); 
} 

@end 

Hack * h = [[Hack alloc] init]; 
[h performSelector:@selector(applicationWillTerminate:) withObject:self afterDelay:0.1]; 
[h release]; 
[h release];

A crash log from that reveals a new address for

x1
:
Thread 0 crashed with ARM Thread State (64-bit):
    … x1: 0x000000019613716d …

and the load address of UIKit:

0x1955f5000 - 0x196382fff UIKit arm64  <7ef942f43c3e3e4aa6cec127b68ecbab> /System/Library/Frameworks/UIKit.framework/UIKit

The trick here is to run the app (well, any app that uses UIKit) on the same class of device with the same OS release. At that point you can stop in the debugger and do an

image list
command to see all your Mach-O images:
(lldb) image list
…
[  6] 7EF942F4-3C3E-3E4A-A6CE-C127B68ECBAB 0x0000000188b29000 /Users/quinn/Library/Developer/Xcode/iOS DeviceSupport/10.1.1 (14B100)/Symbols/System/Library/Frameworks/UIKit.framework/UIKit
…

There’s two things to note in the UIKit entry:

  • Make sure that the UUIDs match up. The crash log shows

    7ef942f43c3e3e4aa6cec127b68ecbab
    and LLDB shows
    7EF942F4-3C3E-3E4A-A6CE-C127B68ECBAB
    , which are the same (modulo formatting). If they’re different, you’re either on a different OS releases or a different class of device.
  • LLDB shows the base address for the framework as 0x0000000188b29000, which is different from the crash report due to ASLR.

So, now you calculate the offset of

x1
from the crash report base address:
(lldb) p/x 0x000000019613716d-0x1955f5000
(long) $0 = 0x0000000000b4216d

and add that to your new base address:

(lldb) p (char *)(0x0000000188b29000 + 0x0000000000b4216d)
(char *) $0 = 0x000000018966b16d "applicationWillTerminate:"

Et voilà!

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Thank you. I was able to successfully reproduce printing the UIKit "applicationWillTerminate:" selector in my modified test app.


My test app crash report shows the x1 register had an address of:

0x0000000190bef16d


The test app crash report also shows the load address of UIKit:

0x1900ad000 - 0x190e3afff UIKit arm64  <7ef942f43c3e3e4aa6cec127b68ecbab> /System/Library/Frameworks/UIKit.framework/UIKit


In the debugger, the image list shows the base address of UIKit as:

[  6] 7EF942F4-3C3E-3E4A-A6CE-C127B68ECBAB 0x00000001900ad000 /Users/andrewshort/Library/Developer/Xcode/iOS DeviceSupport/10.1.1 (14B100)/Symbols/System/Library/Frameworks/UIKit.framework/UIKit


Of course the UUIDs match up since this is just a test app that I'm intentionally crashing. So, now I calculate the offset of x1 from the crash report base address:

(lldb) p/x 0x0000000190bef16d-0x1900ad000
(long) $0 = 0x0000000000b4216d


Note that 0x0000000000b4216d is the same value you got!


and add that to your new base address to print the selector:

(lldb) p (char *)(0x00000001900ad000 + 0x0000000000b4216d)
(char *) $0 = 0x0000000190bef16d "applicationWillTerminate:"


So yes, that's really cool! Now onto my user crash report in a shipping app:


As you note, to calculate the proper UIKit address/offset requires I calculate some things while in the debugger attached to a device/iOS config that is the same as the crash report. Alas, the user crash report that I'm getting in XCode organizer is from an iPad mini 2 running 10.0.2. As I don't have that device/OS configuration, I have no way of determining the proper address. Or is that really true? Couldn't someone else who happens to have that device/iOS config just tell me the proper address by printing the image list from their debugger attached to their device (while running any app that uses UIKit)? They would not even need my app, right - just any sort of test app that uses UIKit, like the test app we created that intentionally crashes with the UIKit selector applicationWillTerminate. And if that's true, then wouldn't it be nice if this were published somewhere in a big table, so I could just look up the offset? In other words, a table that says if you're running an iPad mini 2 running iOS 10.0.2, then UIKit has a load address of blabla.

In other words, a table that says if you're running an iPad mini 2 running iOS 10.0.2, then UIKit has a load address of blabla.

It’s not the load address you need. The load address will be different on each device, even the same device running the same OS, due to ASLR.

What you need is a copy of the UIKit image itself, so you can load it up at an address of your choosing and then dump the memory at that offset; this is basically the same as what I did with the CrashTest app in the last part of my 15 Nov post.

Alas, I don’t know of any supported way to get such an image. You could probably do it by locating the appropriate

.ipsw
and unpacking things from there, but such endeavours are definitely not supported (and definitely not an appropriate topic of conversation for DevForums )-:

Alternatively, you could build a test app that, when run on a user’s device:

  1. verifies that UIKit’s UUID was correct

  2. works out UIKit’s load address

  3. applies your offset to that

  4. reads the selector string from memory

At that point you just need to find someone running the right device (-:

IMPORTANT You don’t need exactly the right device. iOS devices group into families, so any device from the same family would work. A good way to see these family groups is to look at the iOS Restore Images for the latest iOS beta on the developer downloads page. In your specific case, that indicates that the iPad mini 2 uses the same system software as the iPad Air.

If you wanted to do this, you’d need to get up to speed on the APIs in

<mach-o/dyld.h>
and the declarations in
<mach-o/loader.h>
. Fun times!

After poking around with this some more I discovered that the actual selector in

x1
in this case is always going to be
performSelector:withObject:
because that’s how
__NSThreadPerformPerform
does its thing. So the actual value of interest is in
x2
, that is, the ‘selector’ parameter to
performSelector:withObject:
. What do you see for that?

Oh, btw, I changed my test project to more accurately reflect the crash you’re seeing.

Hack * h = [[Hack alloc] init];
[h performSelectorOnMainThread:@selector(varnishWaffles:) withObject:nil waitUntilDone:NO]; 
[h release]; 
[h release];

With this change frame 1 is

__NSThreadPerformPerform
, whereas with the older code it was
__NSFireDelayedPerform
, and I just didn’t notice that difference. The devil really is in the details with this stuff.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

439dc80bfac033ed983e5bb8c416c452 0x000000018c6f8629-0x18bbba000 0x0000000000b3e629 00000001874a6000 0x0000000187fe4629

ok, thanks. In the user crash report, the x2 register contains the address

0x000000019ed73664


Scanning the Binary Images, I see that address is within this:

0x19ecc2000 - 0x19ed96fff AVFAudio arm64  <291f828312d038c9aecd48a7069cc790> /System/Library/Frameworks/AVFoundation.framework/Frameworks/AVFAudio.framework/AVFAudio


My app does initialize an AVAudioSession, and my app plays instances of AVAudioPlayer, and my app responds to AVAudioSessionInterruptionNotification to deal with audio interruptions. Also my app uses AVSpeechSynthesizer a lot.


Not clear to me what "AVFAudio" is...


I recently made changes in my app to how I handle audio interruptions (in addition to many other unrelated changes), so this gives me a place to start looking!


I have an iPad Air 2 running iOS iOS 10.1.1, and the crash report was on an iPad mini 2 running iOS 10.0.2, so I'm not sure I can get the selector.


And for reference, here is the crash report:


Incident Identifier: 90066498-A0D1-41D7-8A2C-6885C7E6B28D
CrashReporter Key:   f1802400ddac5cb6a51dd67f30403451bfd2b89e
Hardware Model:      iPad4,4
Process:             Jungle Time [615]
Path:                /private/var/containers/Bundle/Application/DF4A588C-4AD1-4F83-889C-FDD480E05F92/Jungle Time.app/Jungle Time
Identifier:          com.shortiphoneapps.Jungle-Time.ipad
Version:             1.0 (7.67)
Code Type:           ARM-64 (Native)
Role:                Foreground
Parent Process:      launchd [1]
Coalition:           com.shortiphoneapps.Jungle-Time.ipad [471]




Date/Time:           2016-11-08 16:51:34.5457 -0600
Launch Time:         2016-11-08 08:19:02.3861 -0600
OS Version:          iPhone OS 10.0.2 (14A456)
Report Version:      104


Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000687b2beb8
Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [0]
Triggered by Thread:  0


Thread 0 name:
Thread 0 Crashed:
0   libobjc.A.dylib               0x00000001847d2f30 objc_msgSend + 16
1   Foundation                     0x000000018686e6ec __NSThreadPerformPerform + 340 (NSThread.m:1247)
2   CoreFoundation                 0x0000000185d36278 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24 (CFRunLoop.c:1943)
3   CoreFoundation                 0x0000000185d35bc0 __CFRunLoopDoSources0 + 524 (CFRunLoop.c:1989)
4   CoreFoundation                 0x0000000185d337c0 __CFRunLoopRun + 804 (CFRunLoop.c:2821)
5   CoreFoundation                 0x0000000185c62048 CFRunLoopRunSpecific + 444 (CFRunLoop.c:3113)
6   GraphicsServices               0x00000001876e5198 GSEventRunModal + 180 (GSEvent.c:2245)
7   UIKit                         0x000000018bc35628 -[UIApplication _run] + 684 (UIApplication.m:2649)
8   UIKit                         0x000000018bc30360 UIApplicationMain + 208 (UIApplication.m:4091)
9   Jungle Time                   0x00000001000f9768 main + 188 (main.m:16)
10  libdyld.dylib                 0x0000000184c445b8 start + 4


Thread 1 name:
Thread 1:
0   libsystem_kernel.dylib         0x0000000184d3816c mach_msg_trap + 8
1   libsystem_kernel.dylib         0x0000000184d37fdc mach_msg + 72 (mach_msg.c:103)
2   CoreFoundation                 0x0000000185d35cec __CFRunLoopServiceMachPort + 192 (CFRunLoop.c:2527)
3   CoreFoundation                 0x0000000185d33908 __CFRunLoopRun + 1132 (CFRunLoop.c:2870)
4   CoreFoundation                 0x0000000185c62048 CFRunLoopRunSpecific + 444 (CFRunLoop.c:3113)
5   Foundation                     0x0000000186770b1c -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 304 (NSRunLoop.m:367)
6   Foundation                     0x000000018679160c -[NSRunLoop(NSRunLoop) runUntilDate:] + 96 (NSRunLoop.m:411)
7   UIKit                         0x000000018c5aac7c -[UIEventFetcher threadMain] + 136 (UIEventFetcher.m:279)
8   Foundation                     0x000000018686e50c __NSThread__start__ + 1024 (NSThread.m:1163)
9   libsystem_pthread.dylib       0x0000000184e1b860 _pthread_body + 240 (pthread.c:697)
10  libsystem_pthread.dylib       0x0000000184e1b770 _pthread_start + 284 (pthread.c:744)
11  libsystem_pthread.dylib       0x0000000184e18dbc thread_start + 4


Thread 2 name:
Thread 2:
0   libsystem_kernel.dylib         0x0000000184d3816c mach_msg_trap + 8
1   libsystem_kernel.dylib         0x0000000184d37fdc mach_msg + 72 (mach_msg.c:103)
2   CoreFoundation                 0x0000000185d35cec __CFRunLoopServiceMachPort + 192 (CFRunLoop.c:2527)
3   CoreFoundation                 0x0000000185d33908 __CFRunLoopRun + 1132 (CFRunLoop.c:2870)
4   CoreFoundation                 0x0000000185c62048 CFRunLoopRunSpecific + 444 (CFRunLoop.c:3113)
5   AVFAudio                       0x000000019ed3afe8 GenericRunLoopThread::Entry(void*) + 164 (GenericRunLoopThread.h:106)
6   AVFAudio                       0x000000019ed60f14 CAPThread::Entry(CAPThread*) + 84
7   libsystem_pthread.dylib       0x0000000184e1b860 _pthread_body + 240 (pthread.c:697)
8   libsystem_pthread.dylib       0x0000000184e1b770 _pthread_start + 284 (pthread.c:744)
9   libsystem_pthread.dylib       0x0000000184e18dbc thread_start + 4


Thread 3 name:
Thread 3:
0   libsystem_kernel.dylib         0x0000000184d3816c mach_msg_trap + 8
1   libsystem_kernel.dylib         0x0000000184d37fdc mach_msg + 72 (mach_msg.c:103)
2   CoreFoundation                 0x0000000185d35cec __CFRunLoopServiceMachPort + 192 (CFRunLoop.c:2527)
3   CoreFoundation                 0x0000000185d33908 __CFRunLoopRun + 1132 (CFRunLoop.c:2870)
4   CoreFoundation                 0x0000000185c62048 CFRunLoopRunSpecific + 444 (CFRunLoop.c:3113)
5   Foundation                     0x0000000186770b1c -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 304 (NSRunLoop.m:367)
6   libAXSpeechManager.dylib       0x0000000190f0deb0 -[AXSpeechThread main] + 232 (AXSpeechThread.m:33)
7   Foundation                     0x000000018686e50c __NSThread__start__ + 1024 (NSThread.m:1163)
8   libsystem_pthread.dylib       0x0000000184e1b860 _pthread_body + 240 (pthread.c:697)
9   libsystem_pthread.dylib       0x0000000184e1b770 _pthread_start + 284 (pthread.c:744)
10  libsystem_pthread.dylib       0x0000000184e18dbc thread_start + 4


Thread 4 name:
Thread 4:
0   libsystem_kernel.dylib         0x0000000184d3816c mach_msg_trap + 8
1   libsystem_kernel.dylib         0x0000000184d37fdc mach_msg + 72 (mach_msg.c:103)
2   CoreFoundation                 0x0000000185d35cec __CFRunLoopServiceMachPort + 192 (CFRunLoop.c:2527)
3   CoreFoundation                 0x0000000185d33908 __CFRunLoopRun + 1132 (CFRunLoop.c:2870)
4   CoreFoundation                 0x0000000185c62048 CFRunLoopRunSpecific + 444 (CFRunLoop.c:3113)
5   AudioToolbox                   0x0000000188cdafd0 GenericRunLoopThread::Entry(void*) + 164 (GenericRunLoopThread.h:106)
6   AudioToolbox                   0x0000000188eb0590 CAPThread::Entry(CAPThread*) + 84
7   libsystem_pthread.dylib       0x0000000184e1b860 _pthread_body + 240 (pthread.c:697)
8   libsystem_pthread.dylib       0x0000000184e1b770 _pthread_start + 284 (pthread.c:744)
9   libsystem_pthread.dylib       0x0000000184e18dbc thread_start + 4


Thread 5 name:
Thread 5:
0   libsystem_kernel.dylib         0x0000000184d3816c mach_msg_trap + 8
1   libsystem_kernel.dylib         0x0000000184d37fdc mach_msg + 72 (mach_msg.c:103)
2   CoreFoundation                 0x0000000185d35cec __CFRunLoopServiceMachPort + 192 (CFRunLoop.c:2527)
3   CoreFoundation                 0x0000000185d33908 __CFRunLoopRun + 1132 (CFRunLoop.c:2870)
4   CoreFoundation                 0x0000000185c62048 CFRunLoopRunSpecific + 444 (CFRunLoop.c:3113)
5   Foundation                     0x0000000186770b1c -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 304 (NSRunLoop.m:367)
6   libAXSpeechManager.dylib       0x0000000190f0deb0 -[AXSpeechThread main] + 232 (AXSpeechThread.m:33)
7   Foundation                     0x000000018686e50c __NSThread__start__ + 1024 (NSThread.m:1163)
8   libsystem_pthread.dylib       0x0000000184e1b860 _pthread_body + 240 (pthread.c:697)
9   libsystem_pthread.dylib       0x0000000184e1b770 _pthread_start + 284 (pthread.c:744)
10  libsystem_pthread.dylib       0x0000000184e18dbc thread_start + 4


Thread 6:
0   libsystem_kernel.dylib         0x0000000184d3816c mach_msg_trap + 8
1   libsystem_kernel.dylib         0x0000000184d37fdc mach_msg + 72 (mach_msg.c:103)
2   CoreFoundation                 0x0000000185d35cec __CFRunLoopServiceMachPort + 192 (CFRunLoop.c:2527)
3   CoreFoundation                 0x0000000185d33908 __CFRunLoopRun + 1132 (CFRunLoop.c:2870)
4   CoreFoundation                 0x0000000185c62048 CFRunLoopRunSpecific + 444 (CFRunLoop.c:3113)
5   TTSSpeechBundle               0x0000000103a9a59c 0x103a8c000 + 58780
6   libsystem_pthread.dylib       0x0000000184e1b860 _pthread_body + 240 (pthread.c:697)
7   libsystem_pthread.dylib       0x0000000184e1b770 _pthread_start + 284 (pthread.c:744)
8   libsystem_pthread.dylib       0x0000000184e18dbc thread_start + 4


Thread 7:
0   libsystem_pthread.dylib       0x0000000184e18db0 start_wqthread + 0


Thread 8:
0   libsystem_kernel.dylib         0x0000000184d56a88 __workq_kernreturn + 8
1   libsystem_pthread.dylib       0x0000000184e1936c _pthread_wqthread + 1452 (pthread.c:2205)
2   libsystem_pthread.dylib       0x0000000184e18db4 start_wqthread + 4


Thread 9:
0   libsystem_pthread.dylib       0x0000000184e18db0 start_wqthread + 0


Thread 10:
0   libsystem_pthread.dylib       0x0000000184e18db0 start_wqthread + 0


Thread 0 crashed with ARM Thread State (64-bit):
    x0: 0x000000017000f3a0   x1: 0x000000018c6f8629   x2: 0x000000019ed73664   x3: 0x00000001aa1aa110
    x4: 0x0000000000000010   x5: 0x0000000000000000   x6: 0x0000000000000000   x7: 0x0000000000000000
    x8: 0x0000000000000018   x9: 0x00000000a1a1a1a1  x10: 0x00000001700a3e18  x11: 0xffffffffffffffff
   x12: 0x0002540000025503  x13: 0xbadde9f687b2bead  x14: 0x0002550000025500  x15: 0x0000000000000000
   x16: 0x0000000687b2bea8  x17: 0x0000000185c62520  x18: 0x0000000000000000  x19: 0x0000000170261540
   x20: 0x00000001a8be3000  x21: 0x00000001a8be3000  x22: 0x000000018c6f86a0  x23: 0x0000000000000001
   x24: 0x00000001a8be3000  x25: 0x0000000174863880  x26: 0x0000000000000000  x27: 0x00000001a8be3000
   x28: 0x00000001001f4090   fp: 0x000000016fd2ec40   lr: 0x000000018686e6ec
    sp: 0x000000016fd2ebc0   pc: 0x00000001847d2f30 cpsr: 0x20000000


Binary Images:
0x1000d0000 - 0x100153fff Jungle Time arm64  <99b895649ee83bb0bc3879568a60f70a> /var/containers/Bundle/Application/DF4A588C-4AD1-4F83-889C-FDD480E05F92/Jungle Time.app/Jungle Time
0x100230000 - 0x10025ffff dyld arm64  <fc8715469f7b30228b67a5ae12cadf10> /usr/lib/dyld
0x103904000 - 0x103a1bfff MacinTalk arm64  <214111166a453362b20bb0c87a3aa356> /System/Library/TTSPlugins/MacinTalk.speechbundle/MacinTalk
0x103a8c000 - 0x103d73fff TTSSpeechBundle arm64  <20c85b67e39638fcbc3c09ff20128120> /System/Library/TTSPlugins/TTSSpeechBundle.speechbundle/TTSSpeechBundle
0x18473c000 - 0x18473dfff libSystem.B.dylib arm64  <8788325e11bc31a39b075a3497d26ebd> /usr/lib/libSystem.B.dylib
0x18473e000 - 0x184793fff libc++.1.dylib arm64  <95f6dd603b933208ba95cc2d84613c54> /usr/lib/libc++.1.dylib
0x184794000 - 0x1847b4fff libc++abi.dylib arm64  <286b3adc78d1308eaa0d6f10914b1fa7> /usr/lib/libc++abi.dylib
0x1847b8000 - 0x184b91fff libobjc.A.dylib arm64  <56adf6a5a61b3ef1968bae3dd66e4893> /usr/lib/libobjc.A.dylib
0x184b92000 - 0x184b96fff libcache.dylib arm64  <4073ffab5dee3540b91e3ea1292d4944> /usr/lib/system/libcache.dylib
0x184b97000 - 0x184ba2fff libcommonCrypto.dylib arm64  <cbc60c6bf6843b489a4d4b47bc9caba8> /usr/lib/system/libcommonCrypto.dylib
0x184ba3000 - 0x184ba6fff libcompiler_rt.dylib arm64  <6b7d58fa13473277aae76d339b13a724> /usr/lib/system/libcompiler_rt.dylib
0x184ba7000 - 0x184baefff libcopyfile.dylib arm64  <2130e1083c2b31498e4873b42c01a87c> /usr/lib/system/libcopyfile.dylib
0x184baf000 - 0x184c0ffff libcorecrypto.dylib arm64  <69592d5de33d337baf0746846b8e8b71> /usr/lib/system/libcorecrypto.dylib
0x184c10000 - 0x184c3ffff libdispatch.dylib arm64  <9da4900c6d953655bbfcc6b31c990e9c> /usr/lib/system/libdispatch.dylib
0x184c40000 - 0x184c44fff libdyld.dylib arm64  <b69bc0979de93e7c9cac9d89b284039f> /usr/lib/system/libdyld.dylib
0x184c45000 - 0x184c45fff liblaunch.dylib arm64  <7e180d7e5df13f699dbc6bb79ad46116> /usr/lib/system/liblaunch.dylib
0x184c46000 - 0x184c4bfff libmacho.dylib arm64  <40cb3d5ba75831cdac02a56cab260364> /usr/lib/system/libmacho.dylib
0x184c4c000 - 0x184c4dfff libremovefile.dylib arm64  <58f887789b983f71a5cfd5777958da77> /usr/lib/system/libremovefile.dylib
0x184c4e000 - 0x184c65fff libsystem_asl.dylib arm64  <2ec01cd41fa73c94b3f0ba16aacd3858> /usr/lib/system/libsystem_asl.dylib
0x184c66000 - 0x184c66fff libsystem_blocks.dylib arm64  <e49693e120c33ee580a602e909c83abe> /usr/lib/system/libsystem_blocks.dylib
0x184c67000 - 0x184ce5fff libsystem_c.dylib arm64  <051c0135e5d835979ce0166c05c8f381> /usr/lib/system/libsystem_c.dylib
0x184ce6000 - 0x184ceafff libsystem_configuration.dylib arm64  <c253d3f37bac39bcb755bd85f8c6b7fd> /usr/lib/system/libsystem_configuration.dylib
0x184ceb000 - 0x184cf0fff libsystem_containermanager.dylib arm64  <a845710abeb9350596b19219de14752d> /usr/lib/system/libsystem_containermanager.dylib
0x184cf1000 - 0x184cf2fff libsystem_coreservices.dylib arm64  <e10d8ff725fe3a88a5328b24666b4d34> /usr/lib/system/libsystem_coreservices.dylib
0x184cf3000 - 0x184d0bfff libsystem_coretls.dylib arm64  <23df3c03932932869f59404b025c3153> /usr/lib/system/libsystem_coretls.dylib
0x184d0c000 - 0x184d12fff libsystem_dnssd.dylib arm64  <441464753206379bafd15b113907f608> /usr/lib/system/libsystem_dnssd.dylib
0x184d13000 - 0x184d36fff libsystem_info.dylib arm64  <2e66f9d1ee0837ff895155dd12b2c956> /usr/lib/system/libsystem_info.dylib
0x184d37000 - 0x184d5bfff libsystem_kernel.dylib arm64  <04e6664af08030e1ad7d9f2249e47e18> /usr/lib/system/libsystem_kernel.dylib
0x184d5c000 - 0x184d88fff libsystem_m.dylib arm64  <786e37b9fc8431f5bfb79550eed0c3ce> /usr/lib/system/libsystem_m.dylib
0x184d89000 - 0x184da4fff libsystem_malloc.dylib arm64  <6eef211324863711a1d99713c51512cb> /usr/lib/system/libsystem_malloc.dylib
0x184da5000 - 0x184dfbfff libsystem_network.dylib arm64  <84d56a9d88ba32f9830d884a7aa14c3b> /usr/lib/system/libsystem_network.dylib
0x184dfc000 - 0x184e05fff libsystem_networkextension.dylib arm64  <a8d963518d643327ac1991dbf8f15f91> /usr/lib/system/libsystem_networkextension.dylib
0x184e06000 - 0x184e10fff libsystem_notify.dylib arm64  <abb481f869e83db39d0ee3e61a9c0554> /usr/lib/system/libsystem_notify.dylib
0x184e11000 - 0x184e17fff libsystem_platform.dylib arm64  <6735814899ed328499ce8a0f59ff49b6> /usr/lib/system/libsystem_platform.dylib
0x184e18000 - 0x184e21fff libsystem_pthread.dylib arm64  <be17c5de3ff83a8695913479341c34ec> /usr/lib/system/libsystem_pthread.dylib
0x184e22000 - 0x184e25fff libsystem_sandbox.dylib arm64  <f269179060d53feaaac004e7c838b44d> /usr/lib/system/libsystem_sandbox.dylib
0x184e26000 - 0x184e2dfff libsystem_symptoms.dylib arm64  <2e6f3a69a33a3a309ca86ef8358c2b55> /usr/lib/system/libsystem_symptoms.dylib
0x184e2e000 - 0x184e4ffff libsystem_trace.dylib arm64  <3ed1ebdc2ed435dc87973ddbf563744b> /usr/lib/system/libsystem_trace.dylib
0x184e50000 - 0x184e55fff libunwind.dylib arm64  <8e51acc655103210bcd8c557e4f103ab> /usr/lib/system/libunwind.dylib
0x184e56000 - 0x184e56fff libvminterpose.dylib arm64  <abee403ad3fe3b428af3d4ed901a2dfc> /usr/lib/system/libvminterpose.dylib
0x184e57000 - 0x184e7dfff libxpc.dylib arm64  <9bbf09cd8cfd3f94bae40fac797416e0> /usr/lib/system/libxpc.dylib
0x184e7e000 - 0x185098fff libicucore.A.dylib arm64  <49bff0b83e023804af2b53d77d1f6cb4> /usr/lib/libicucore.A.dylib
0x185099000 - 0x1850a9fff libz.1.dylib arm64  <5e67d9e80348304187cd8bf557849015> /usr/lib/libz.1.dylib
0x185c59000 - 0x185fdcfff CoreFoundation arm64  <c4824900d70e3fd5b01dbb079b63eae1> /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation
0x185fdd000 - 0x185fedfff libbsm.0.dylib arm64  <f3a3eb26182839e0ac4646d0e2f9e9c4> /usr/lib/libbsm.0.dylib
0x185fee000 - 0x185feefff libenergytrace.dylib arm64  <2cfdece2a96330968c249f7d9e7811ad> /usr/lib/libenergytrace.dylib
0x185fef000 - 0x186069fff IOKit arm64  <27c8e5eb76843818abd4a0b0d5dfccc3> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x18606a000 - 0x18608afff libMobileGestalt.dylib arm64  <f8456dbddfbb35d29491c29b43860e6f> /usr/lib/libMobileGestalt.dylib
0x18608b000 - 0x186175fff libxml2.2.dylib arm64  <edc3ce1ed39b39fd9c3c535d9e542967> /usr/lib/libxml2.2.dylib
0x186176000 - 0x186202fff Security arm64  <624164bf18ba32c8a7f28b5031ef6aa5> /System/Library/Frameworks/Security.framework/Security
0x186203000 - 0x18626dfff SystemConfiguration arm64  <486dd4e417a83cc6a09e0b7de9319356> /System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration
0x18626e000 - 0x186382fff libsqlite3.dylib arm64  <511215637edc3a0f8d3416fe4536881d> /usr/lib/libsqlite3.dylib
0x186383000 - 0x1866f2fff CFNetwork arm64  <ca09941bfd353bb8b6b679a0f14cad1e> /System/Library/Frameworks/CFNetwork.framework/CFNetwork
0x1866f3000 - 0x186703fff libbz2.1.0.dylib arm64  <b312e3b393893c0db8f793f370dae319> /usr/lib/libbz2.1.0.dylib
0x186704000 - 0x18671cfff liblzma.5.dylib arm64  <3c157ec9f2e83f99a26f322feb7deabc> /usr/lib/liblzma.5.dylib
0x18671d000 - 0x186737fff libCRFSuite.dylib arm64  <af22ff8591193afa81d6d044c5cd7978> /usr/lib/libCRFSuite.dylib
0x186738000 - 0x186761fff libarchive.2.dylib arm64  <1e4278f3e3323387ac5c90f975232c07> /usr/lib/libarchive.2.dylib
0x186762000 - 0x186763fff liblangid.dylib arm64  <c2cccb75f84e3b8a9c2ce6e32e812eb9> /usr/lib/liblangid.dylib
0x186764000 - 0x186a32fff Foundation arm64  <a6ad10553017396ebb4eba2a4ad331d8> /System/Library/Frameworks/Foundation.framework/Foundation
0x186a33000 - 0x186adffff libBLAS.dylib arm64  <499c291219e730d79cf409daee75db9d> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libBLAS.dylib
0x186ae0000 - 0x186e22fff libLAPACK.dylib arm64  <f07da3926d4a3fb0bfcbe3b3b026b54f> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libLAPACK.dylib
0x186e23000 - 0x1870c5fff vImage arm64  <c3827fd6a2763bb9bf22e65906eb3cfc> /System/Library/Frameworks/Accelerate.framework/Frameworks/vImage.framework/vImage
0x1870c6000 - 0x1870e8fff libvMisc.dylib arm64  <bd641d6b451430a8a26dde179a9bfc4a> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libvMisc.dylib
0x1870e9000 - 0x1870fdfff libLinearAlgebra.dylib arm64  <e9a40ae4066c3d3ebab7aec269c6f69e> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libLinearAlgebra.dylib
0x1870fe000 - 0x18710ffff libSparseBLAS.dylib arm64  <66e35a109b573fe98941afd7e9921214> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libSparseBLAS.dylib
0x187110000 - 0x187188fff libvDSP.dylib arm64  <c2ce3490f1b633119d556081ffd0caa0> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libvDSP.dylib
0x187189000 - 0x187189fff vecLib arm64  <c07ed4a995bd35a89bea45c4fd101553> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/vecLib
0x18718a000 - 0x18718afff Accelerate arm64  <5057f428ad8539a9b13b2a607bc7839f> /System/Library/Frameworks/Accelerate.framework/Accelerate
0x18718b000 - 0x1876d8fff CoreGraphics arm64  <4a137515f15e30a495edf7ec114755e0> /System/Library/Frameworks/CoreGraphics.framework/CoreGraphics
0x1876d9000 - 0x1876edfff GraphicsServices arm64  <1e0ed9315f4830088aa2086205f45050> /System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices
0x1876ee000 - 0x187739fff AppSupport arm64  <1fd5606d67de38b484c8e09e0783b4af> /System/Library/PrivateFrameworks/AppSupport.framework/AppSupport
0x18773a000 - 0x18785afff MobileCoreServices arm64  <37baec08da073e729066bded8c9b53da> /System/Library/Frameworks/MobileCoreServices.framework/MobileCoreServices
0x18785b000 - 0x1878b1fff BaseBoard arm64  <160dad81a8de3c5cb46f17c3d4eb7b87> /System/Library/PrivateFrameworks/BaseBoard.framework/BaseBoard
0x1878b2000 - 0x1878bdfff AssertionServices arm64  <3fac49b1df4c373184edb6af5d3a09dd> /System/Library/PrivateFrameworks/AssertionServices.framework/AssertionServices
0x1878be000 - 0x1878eafff BackBoardServices arm64  <b531352894cd36bbbb6d0b9d503566a7> /System/Library/PrivateFrameworks/BackBoardServices.framework/BackBoardServices
0x1878ef000 - 0x18793efff FrontBoardServices arm64  <af1172067ff2304d9d3c8a2f92f04255> /System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices
0x187942000 - 0x187978fff SpringBoardServices arm64  <b575c6c21a493b4a87e2dd05bb8cf02a> /System/Library/PrivateFrameworks/SpringBoardServices.framework/SpringBoardServices
0x187979000 - 0x187990fff MobileKeyBag arm64  <734ebf66412c3aa5ac99334f29ebe620> /System/Library/PrivateFrameworks/MobileKeyBag.framework/MobileKeyBag
0x187991000 - 0x187999fff IOSurface arm64  <0c687f05288f30efbb936e54be9a6f58> /System/Library/PrivateFrameworks/IOSurface.framework/IOSurface
0x18799a000 - 0x1879a5fff liblockdown.dylib arm64  <12947e09f9ca3245ae33ede73e0b651f> /usr/lib/liblockdown.dylib
0x1879a6000 - 0x1879bbfff CrashReporterSupport arm64  <b17ade4774223014893f614b1d14de61> /System/Library/PrivateFrameworks/CrashReporterSupport.framework/CrashReporterSupport
0x1879bc000 - 0x1879befff IOSurfaceAccelerator arm64  <969c522dc6183cb8ada7073b07353512> /System/Library/PrivateFrameworks/IOSurfaceAccelerator.framework/IOSurfaceAccelerator
0x1879bf000 - 0x1879fffff AppleJPEG arm64  <ddac80f526a73d5684ad96a7faeac161> /System/Library/PrivateFrameworks/AppleJPEG.framework/AppleJPEG
0x187a00000 - 0x187f8ffff ImageIO arm64  <0cc6da0a6265372190bd34b428c02a9f> /System/Library/Frameworks/ImageIO.framework/ImageIO
0x187f90000 - 0x187f96fff TCC arm64  <fca78b84e3f73fdc90b9d1e5d5ff6919> /System/Library/PrivateFrameworks/TCC.framework/TCC
0x187f97000 - 0x187f9bfff AggregateDictionary arm64  <621603daf2bf3e7ab75aafd59f095c5b> /System/Library/PrivateFrameworks/AggregateDictionary.framework/AggregateDictionary
0x187f9c000 - 0x187fa8fff PowerLog arm64  <c2cd0fdbbf6e385ba55748201f88a7a3> /System/Library/PrivateFrameworks/PowerLog.framework/PowerLog
0x187fa9000 - 0x188011fff libTelephonyUtilDynamic.dylib arm64  <1af42608ce2b3f4ebcee64dcdbac02b6> /usr/lib/libTelephonyUtilDynamic.dylib
0x188012000 - 0x188024fff CommonUtilities arm64  <0098d095d66733988b5a6e73803f37a6> /System/Library/PrivateFrameworks/CommonUtilities.framework/CommonUtilities
0x188025000 - 0x188039fff libcompression.dylib arm64  <b04eddd5ef0839a6aee2707f5c14aa1a> /usr/lib/libcompression.dylib
0x18803a000 - 0x1882d4fff CoreData arm64  <65f30a82a6683482bbdb857c83f3fc56> /System/Library/Frameworks/CoreData.framework/CoreData
0x1882d5000 - 0x1882d8fff libCoreVMClient.dylib arm64  <ef615871768f3db8b7f860b5fd7bf707> /System/Library/Frameworks/OpenGLES.framework/libCoreVMClient.dylib
0x1882d9000 - 0x1882defff IOAccelerator arm64  <d7135a13f4753c9eb8b4b79455175d32> /System/Library/PrivateFrameworks/IOAccelerator.framework/IOAccelerator
0x1882df000 - 0x1882e0fff libCVMSPluginSupport.dylib arm64  <a5694c66e17b346ca36396fd40029618> /System/Library/Frameworks/OpenGLES.framework/libCVMSPluginSupport.dylib
0x1882e1000 - 0x1882e4fff libCoreFSCache.dylib arm64  <7d0b5c6277ea362598ea9c06f292eaa0> /System/Library/Frameworks/OpenGLES.framework/libCoreFSCache.dylib
0x1882e5000 - 0x188328fff libGLImage.dylib arm64  <679d74c254e13f1c925f38b82d8e6963> /System/Library/Frameworks/OpenGLES.framework/libGLImage.dylib
0x188329000 - 0x188333fff libGFXShared.dylib arm64  <402e4f5820f834f5807f5fa448902f2c> /System/Library/Frameworks/OpenGLES.framework/libGFXShared.dylib
0x188334000 - 0x18833bfff IOMobileFramebuffer arm64  <c913022952a1394a928f7bbf5bfec3e9> /System/Library/PrivateFrameworks/IOMobileFramebuffer.framework/IOMobileFramebuffer
0x18833c000 - 0x18833cfff libmetal_timestamp.dylib arm64  <fd7029ad82583e1f89ca3a1ddff84df2> /System/Library/PrivateFrameworks/GPUCompiler.framework/libmetal_timestamp.dylib
0x18833d000 - 0x18839afff Metal arm64  <18991406aed530c99a3dcca4ca4371b8> /System/Library/Frameworks/Metal.framework/Metal
0x18839b000 - 0x1883a5fff OpenGLES arm64  <48579b12ba843baf8688c929e4aa1350> /System/Library/Frameworks/OpenGLES.framework/OpenGLES
0x1883a6000 - 0x1883cafff CoreVideo arm64  <865a7204d95b3117bf535727201a1da9> /System/Library/Frameworks/CoreVideo.framework/CoreVideo
0x1883cb000 - 0x1883cdfff OAuth arm64  <f202cfb14ee333f1a7502e5a75f2df92> /System/Library/PrivateFrameworks/OAuth.framework/OAuth
0x1883ce000 - 0x18840cfff Accounts arm64  <79664bb249ab30799fdce891cf8a91cd> /System/Library/Frameworks/Accounts.framework/Accounts
0x18840d000 - 0x1884fffff libiconv.2.dylib arm64  <bf0bd341bdd43ec7bd40d067233e57a8> /usr/lib/libiconv.2.dylib
0x188500000 - 0x18864bfff CoreAudio arm64  <0a134f19c9ae39b79dcdd8af00189b56> /System/Library/Frameworks/CoreAudio.framework/CoreAudio
0x18864c000 - 0x18864ffff UserFS arm64  <c0a53a908768398cb07c22ec2ff1abb2> /System/Library/PrivateFrameworks/UserFS.framework/UserFS
0x188650000 - 0x18875afff CoreMedia arm64  <d0cc03900e45378e98d8193662edf565> /System/Library/Frameworks/CoreMedia.framework/CoreMedia
0x18875b000 - 0x188761fff libcupolicy.dylib arm64  <0680676b2f97349fb5742ec91e20f429> /usr/lib/libcupolicy.dylib
0x188762000 - 0x1887eefff CoreTelephony arm64  <f6ab69bda98d3b619d2b41a57fc2c69e> /System/Library/Frameworks/CoreTelephony.framework/CoreTelephony
0x1887ef000 - 0x1888f9fff libFontParser.dylib arm64  <7a8928d14bd538b29f9c8d2be8fb889a> /System/Library/PrivateFrameworks/FontServices.framework/libFontParser.dylib
0x1888fa000 - 0x188989fff ************ arm64  <63305fbde9b03b7891bb48b8868f4f36> /System/Library/Frameworks/************.framework/************
0x18898a000 - 0x18898afff FontServices arm64  <c6d2054d8d013dbdafecea3ad8948d76> /System/Library/PrivateFrameworks/FontServices.framework/FontServices
0x18898b000 - 0x188ad7fff CoreText arm64  <89e2f40a358a3760885d80ebb4491ac1> /System/Library/Frameworks/CoreText.framework/CoreText
0x188ad8000 - 0x188af2fff ProtocolBuffer arm64  <84a84046c997386b891fff8f4c249d20> /System/Library/PrivateFrameworks/ProtocolBuffer.framework/ProtocolBuffer
0x188af3000 - 0x188b1bfff PersistentConnection arm64  <46122ee81ebc3ae0a60ae25c730a129e> /System/Library/PrivateFrameworks/PersistentConnection.framework/PersistentConnection
0x188b1c000 - 0x188b22fff DataMigration arm64  <0aa788c904ca304ea9a9bf19ee990b53> /System/Library/PrivateFrameworks/DataMigration.framework/DataMigration
0x188b23000 - 0x188f79fff AudioToolbox arm64  <f1ac89ed6113395bb6f8d9eef1b345dc> /System/Library/Frameworks/AudioToolbox.framework/AudioToolbox
0x188f7a000 - 0x189151fff QuartzCore arm64  <dfdc0c40cf153854b84a6bc06b12b4ea> /System/Library/Frameworks/QuartzCore.framework/QuartzCore
0x189152000 - 0x189158fff Netrb arm64  <019a8ba8af39378891e3689409db009d> /System/Library/PrivateFrameworks/Netrb.framework/Netrb
0x189159000 - 0x189169fff libcmph.dylib arm64  <ddb74cea99f83aeb9332a789afb36b35> /usr/lib/libcmph.dylib
0x18916a000 - 0x18918afff libmis.dylib arm64  <039e7c4ab2c53597ba3403fc0b5516e3> /usr/lib/libmis.dylib
0x18918b000 - 0x18927cfff LanguageModeling arm64  <1399d8b96350301ead6b2c824fbb7c53> /System/Library/PrivateFrameworks/LanguageModeling.framework/LanguageModeling
0x18927d000 - 0x189362fff ManagedConfiguration arm64  <083f833136993b47bee913c927ee65de> /System/Library/PrivateFrameworks/ManagedConfiguration.framework/ManagedConfiguration
0x189363000 - 0x189379fff libmarisa.dylib arm64  <39ff439cc20b3c8e9e6055c0678506e5> /usr/lib/libmarisa.dylib
0x18937a000 - 0x18944afff ProofReader arm64  <88e0eab61d173a318afb6c85b7a1a2d0> /System/Library/PrivateFrameworks/ProofReader.framework/ProofReader
0x18944b000 - 0x189455fff MediaAccessibility arm64  <4cdf6c8a21143e04838c8985ca3ab8a2> /System/Library/Frameworks/MediaAccessibility.framework/MediaAccessibility
0x189456000 - 0x189466fff MobileAsset arm64  <0c5fb05c798b3a8cabbace58bc7b0ec1> /System/Library/PrivateFrameworks/MobileAsset.framework/MobileAsset
0x189467000 - 0x1894d8fff ColorSync arm64  <5762d9f6aa723c5f9ac4faf32c313791> /System/Library/PrivateFrameworks/ColorSync.framework/ColorSync
0x1894d9000 - 0x189548fff MetalPerformanceShaders arm64  <5d6f9961367c3336a19b5283176262df> /System/Library/Frameworks/MetalPerformanceShaders.framework/MetalPerformanceShaders
0x189549000 - 0x189978fff FaceCore arm64  <c6528cdf6e1d3fe48f12735bbc8fe99f> /System/Library/PrivateFrameworks/FaceCore.framework/FaceCore
0x189979000 - 0x1899f4fff Quagga arm64  <9f220dabf92e372bb1851251b1f66fe1> /System/Library/PrivateFrameworks/Quagga.framework/Quagga
0x1899f5000 - 0x189bbefff CoreImage arm64  <0a9f9730278e31e19e59bdcabfcb6ff1> /System/Library/Frameworks/CoreImage.framework/CoreImage
0x189bbf000 - 0x189c0afff TextInput arm64  <d1a353ce89983a7dac86d75f384bce7f> /System/Library/PrivateFrameworks/TextInput.framework/TextInput
0x189c0b000 - 0x189c1bfff libAccessibility.dylib arm64  <306f29d3df4c32cb923e6e5a136b9c67> /usr/lib/libAccessibility.dylib
0x189c2a000 - 0x18a580fff JavaScriptCore arm64  <3a74efcce7283410ac8a55027b67d2ef> /System/Library/Frameworks/JavaScriptCore.framework/JavaScriptCore
0x18a581000 - 0x18a796fff StoreServices arm64  <f0f43f609f5434e59616995f596d6d91> /System/Library/PrivateFrameworks/StoreServices.framework/StoreServices
0x18a797000 - 0x18b885fff WebCore arm64  <5f4c0a6773123239905a48919249deff> /System/Library/PrivateFrameworks/WebCore.framework/WebCore
0x18b886000 - 0x18b8affff libxslt.1.dylib arm64  <d4d14fddc95e390d8d6b0f647acefbdc> /usr/lib/libxslt.1.dylib
0x18b8b0000 - 0x18b991fff WebKitLegacy arm64  <20b8c9cf5b3b3564b1e90113ea896db1> /System/Library/PrivateFrameworks/WebKitLegacy.framework/WebKitLegacy
0x18b992000 - 0x18ba59fff CoreUI arm64  <f1131a07ecfa3f679c3dd3fd62a1a131> /System/Library/PrivateFrameworks/CoreUI.framework/CoreUI
0x18ba5a000 - 0x18ba81fff DictionaryServices arm64  <059e702327533e2493da8c662ea81790> /System/Library/PrivateFrameworks/DictionaryServices.framework/DictionaryServices
0x18ba82000 - 0x18ba83fff HangTracer arm64  <1fd22f31313d33e3bc2f0b6373a84876> /System/Library/PrivateFrameworks/HangTracer.framework/HangTracer
0x18ba84000 - 0x18bad4fff PhysicsKit arm64  <2aeeacbe6a8d3b959f9d09f02a85fc9c> /System/Library/PrivateFrameworks/PhysicsKit.framework/PhysicsKit
0x18bad5000 - 0x18bbadfff UIFoundation arm64  <80a5a544327033c593c6de75027dd934> /System/Library/PrivateFrameworks/UIFoundation.framework/UIFoundation
0x18bbba000 - 0x18c947fff UIKit arm64  <439dc80bfac033ed983e5bb8c416c452> /System/Library/Frameworks/UIKit.framework/UIKit
0x18c948000 - 0x18c970fff CoreBluetooth arm64  <13fb911b0abc3dbe8b3d431b7a59b4b9> /System/Library/Frameworks/CoreBluetooth.framework/CoreBluetooth
0x18c971000 - 0x18c996fff DataAccessExpress arm64  <5799a178384d3ce28527b23c720ed04c> /System/Library/PrivateFrameworks/DataAccessExpress.framework/DataAccessExpress
0x18c997000 - 0x18c9b8fff NetworkStatistics arm64  <fbdf2cf4373d305584bdf54398fd5613> /System/Library/PrivateFrameworks/NetworkStatistics.framework/NetworkStatistics
0x18c9b9000 - 0x18ca41fff AddressBook arm64  <b835a0db2c4b3b42bcc3d7487fd67ed8> /System/Library/Frameworks/AddressBook.framework/AddressBook
0x18ca42000 - 0x18cb76fff CoreMotion arm64  <b4fe074374f13922aaa6833f2278495e> /System/Library/Frameworks/CoreMotion.framework/CoreMotion
0x18cb77000 - 0x18cba4fff CacheDelete arm64  <93e649608229314ab93d03dc37330685> /System/Library/PrivateFrameworks/CacheDelete.framework/CacheDelete
0x18cba5000 - 0x18cbb2fff CoreAUC arm64  <d01c24d9a0ef3bf693693d7e49ff32e3> /System/Library/PrivateFrameworks/CoreAUC.framework/CoreAUC
0x18cbb3000 - 0x18d14cfff MediaToolbox arm64  <3d18249fdd593d5abf9e41ca38cf5f38> /System/Library/Frameworks/MediaToolbox.framework/MediaToolbox
0x18d14d000 - 0x18d2ecfff ********* arm64  <2db48a3d1b9c3438beb747c96b6042d2> /System/Library/PrivateFrameworks/*********.framework/*********
0x18d2ed000 - 0x18d2fcfff IntlPreferences arm64  <726d4688da7d3df6aa23711f4bc33aea> /System/Library/PrivateFrameworks/IntlPreferences.framework/IntlPreferences
0x18d2fd000 - 0x18d2fffff CoreDuetDebugLogging arm64  <309dba4a51c332d6b92e39bd4955cee8> /System/Library/PrivateFrameworks/CoreDuetDebugLogging.framework/CoreDuetDebugLogging
0x18d300000 - 0x18d314fff CoreDuetDaemonProtocol arm64  <dd889e6e81f1335794f6bcc62d2fbc68> /System/Library/PrivateFrameworks/CoreDuetDaemonProtocol.framework/CoreDuetDaemonProtocol
0x18d315000 - 0x18d3eafff CoreDuet arm64  <ad4c52ee6397380383fde88900b175a8> /System/Library/PrivateFrameworks/CoreDuet.framework/CoreDuet
0x18d3eb000 - 0x18d598fff AVFoundation arm64  <e23db4dfb7f0377c9d2baa6a1a259db4> /System/Library/Frameworks/AVFoundation.framework/AVFoundation
0x18d599000 - 0x18d5cbfff libtidy.A.dylib arm64  <4b6463950ec93d089afdfcc248cc9934> /usr/lib/libtidy.A.dylib
0x18d5cc000 - 0x18d632fff IMFoundation arm64  <eb79b515358a3affa8a710eb247149a6> /System/Library/PrivateFrameworks/IMFoundation.framework/IMFoundation
0x18d633000 - 0x18dcb6fff GeoServices arm64  <4c130c4f654d38eab0a5b939f26268c1> /System/Library/PrivateFrameworks/GeoServices.framework/GeoServices
0x18dcb7000 - 0x18dcb8fff DiagnosticLogCollection arm64  <4ae00177103839308da604cb1d472989> /System/Library/PrivateFrameworks/DiagnosticLogCollection.framework/DiagnosticLogCollection
0x18dcb9000 - 0x18dcbafff Marco arm64  <580f95708c3b3f169c13d4dca206255e> /System/Library/PrivateFrameworks/Marco.framework/Marco
0x18dcbb000 - 0x18dd34fff CoreLocation arm64  <f6ecdc6653c437a1859213c641aacf34> /System/Library/Frameworks/CoreLocation.framework/CoreLocation
0x18dd35000 - 0x18dd3afff ConstantClasses arm64  <566b6f6ad9333f4cb16f3bbf8da935fe> /System/Library/PrivateFrameworks/ConstantClasses.framework/ConstantClasses
0x18dfca000 - 0x18e01bfff IDSFoundation arm64  <70fc4d6a24ae38369f2da7d874dcc543> /System/Library/PrivateFrameworks/IDSFoundation.framework/IDSFoundation
0x18e0e3000 - 0x18e100fff MediaServices arm64  <273fd73ed0ef32559424df9d08045941> /System/Library/PrivateFrameworks/MediaServices.framework/MediaServices
0x18e101000 - 0x18e13ffff AuthKit arm64  <a4b626e8c7693a78bf522299c02ee49c> /System/Library/PrivateFrameworks/AuthKit.framework/AuthKit
0x18e140000 - 0x18e145fff libheimdal-asn1.dylib arm64  <e59780c1a4993eeba201e067d7cbc1fc> /usr/lib/libheimdal-asn1.dylib
0x18e146000 - 0x18e1e9fff MediaRemote arm64  <b8b341b5e3333cf2896c6b4b40a65f3d> /System/Library/PrivateFrameworks/MediaRemote.framework/MediaRemote
0x18e1ea000 - 0x18e370fff MobileSpotlightIndex arm64  <d6152193b08e3885a3b0b6a15847a9d1> /System/Library/PrivateFrameworks/MobileSpotlightIndex.framework/MobileSpotlightIndex
0x18e371000 - 0x18e390fff PlugInKit arm64  <8fde4c6c2dbc3004b563587001b9e729> /System/Library/PrivateFrameworks/PlugInKit.framework/PlugInKit
0x18e391000 - 0x18e3bdfff ProtectedCloudStorage arm64  <dd2b7cdd498332f0a537a0802353b9b2> /System/Library/PrivateFrameworks/ProtectedCloudStorage.framework/ProtectedCloudStorage
0x18e3be000 - 0x18e3d9fff libresolv.9.dylib arm64  <bbfd607a359d3982b6ea1d85e44047e7> /usr/lib/libresolv.9.dylib
0x18e3da000 - 0x18e3effff ApplePushService arm64  <96a277741eac38c2b76e6a92f4fda58b> /System/Library/PrivateFrameworks/ApplePushService.framework/ApplePushService
0x18e3f0000 - 0x18e43efff ContactsFoundation arm64  <07665e20f60e36edb46667f631b238b9> /System/Library/PrivateFrameworks/ContactsFoundation.framework/ContactsFoundation
0x18e445000 - 0x18e4e9fff Contacts arm64  <7c18b9016e4431b891a280cf9d9a0a8f> /System/Library/Frameworks/Contacts.framework/Contacts
0x18e4ea000 - 0x18e534fff CoreSpotlight arm64  <6be155856f6333b28d211a7bb4f86c0c> /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlight
0x18e535000 - 0x18e55cfff vCard arm64  <65d8ed9e8f533e1e81fd8e66975ac05c> /System/Library/PrivateFrameworks/vCard.framework/vCard
0x18e55d000 - 0x18e5e8fff VoiceServices arm64  <1aa21ac90c4237d08b2e13fd79429b9c> /System/Library/PrivateFrameworks/VoiceServices.framework/VoiceServices
0x18e5e9000 - 0x18e636fff SAObjects arm64  <a591dbffd2aa373b97c43c50e2f295f8> /System/Library/PrivateFrameworks/SAObjects.framework/SAObjects
0x18e6d2000 - 0x18e769fff AssistantServices arm64  <544e9d76ded53591b7108dbd77c3dd46> /System/Library/PrivateFrameworks/AssistantServices.framework/AssistantServices
0x18e781000 - 0x18e783fff MessageSupport arm64  <d431ebdd714b32c8a6e8123b0f4dfda0> /System/Library/PrivateFrameworks/MessageSupport.framework/MessageSupport
0x18e784000 - 0x18e7d8fff MIME arm64  <cdc60ac7161633a8bfb076ca40837c8a> /System/Library/PrivateFrameworks/MIME.framework/MIME
0x18e87d000 - 0x18e899fff AppleIDSSOAuthentication arm64  <9dd66a90b42d3e7da948684e3eda6800> /System/Library/PrivateFrameworks/AppleIDSSOAuthentication.framework/AppleIDSSOAuthentication
0x18e89a000 - 0x18e8aafff MailServices arm64  <383d33400ff3389299cfad4564843fb2> /System/Library/PrivateFrameworks/MailServices.framework/MailServices
0x18e8ab000 - 0x18e918fff AppleAccount arm64  <061b166b09cc3c2cb5fe92e9acc3b869> /System/Library/PrivateFrameworks/AppleAccount.framework/AppleAccount
0x18e919000 - 0x18e91dfff CommunicationsFilter arm64  <99040110ee233365a89da3f813483acd> /System/Library/PrivateFrameworks/CommunicationsFilter.framework/CommunicationsFilter
0x18e91e000 - 0x18e942fff ChunkingLibrary arm64  <229183db6c0a322f8a1b905e1e9bad4f> /System/Library/PrivateFrameworks/ChunkingLibrary.framework/ChunkingLibrary
0x18e97e000 - 0x18e984fff AssetCacheServices arm64  <f0eae7e0143933cebef9363b674ccd70> /System/Library/PrivateFrameworks/AssetCacheServices.framework/AssetCacheServices
0x18e985000 - 0x18ea5efff MMCS arm64  <2a61bb65185735feaf06b72fce79cb81> /System/Library/PrivateFrameworks/MMCS.framework/MMCS
0x18ea90000 - 0x18ead2fff ContentIndex arm64  <f747582858683aa7859cf0aa744aec0c> /System/Library/PrivateFrameworks/ContentIndex.framework/ContentIndex
0x18eb30000 - 0x18eb60fff Bom arm64  <ee5d665311073e739ff553115ddefd2d> /System/Library/PrivateFrameworks/Bom.framework/Bom
0x18eb61000 - 0x18eb68fff CertUI arm64  <06d2316865be3c23850bc9edc2c0cfd3> /System/Library/PrivateFrameworks/CertUI.framework/CertUI
0x18eb69000 - 0x18ebb8fff FTServices arm64  <c8e3ead6ebbf30ab857b9ff71f8681b5> /System/Library/PrivateFrameworks/FTServices.framework/FTServices
0x18ebb9000 - 0x18ec17fff CoreDAV arm64  <ca9047d9a3be3bcbacb700cdbb0e686c> /System/Library/PrivateFrameworks/CoreDAV.framework/CoreDAV
0x18ec26000 - 0x18ec3afff UserManagement arm64  <7ab7861470113dc9a26107d23429ca17> /System/Library/PrivateFrameworks/UserManagement.framework/UserManagement
0x18ec3b000 - 0x18ed03fff CorePDF arm64  <4cc68715dc4733c1a6582e7a78e19a03> /System/Library/PrivateFrameworks/CorePDF.framework/CorePDF
0x18ed04000 - 0x18ed38fff iCalendar arm64  <63f6f6db8dfb3698a3e6351a61757c3e> /System/Library/PrivateFrameworks/iCalendar.framework/iCalendar
0x18ed41000 - 0x18ed9ffff CalendarFoundation arm64  <5ea61219427731e2bb45cb5913eff70c> /System/Library/PrivateFrameworks/CalendarFoundation.framework/CalendarFoundation
0x18ee9d000 - 0x18ef35fff CalendarDatabase arm64  <5798df86aaa131db8659d12254740798> /System/Library/PrivateFrameworks/CalendarDatabase.framework/CalendarDatabase
0x18ef36000 - 0x18ef78fff CalendarDaemon arm64  <1c4f22ce498d3282ad7fd8680dc50a7f> /System/Library/PrivateFrameworks/CalendarDaemon.framework/CalendarDaemon
0x18ef79000 - 0x18f048fff EventKit arm64  <fa0cc301c0033b33a02dc0b6ee599c0c> /System/Library/Frameworks/EventKit.framework/EventKit
0x18f049000 - 0x18f348fff WebKit arm64  <ad83e4097cec393588f3117ff3f7984d> /System/Library/Frameworks/WebKit.framework/WebKit
0x18f349000 - 0x18f38ffff WebBookmarks arm64  <4939623c09453d499744e809ee865345> /System/Library/PrivateFrameworks/WebBookmarks.framework/WebBookmarks
0x18f390000 - 0x18f4d4fff ContactsUI arm64  <d2208cfa296e346c8f20815dd07c32b3> /System/Library/Frameworks/ContactsUI.framework/ContactsUI
0x18f4d5000 - 0x18fb3cfff ModelIO arm64  <fdffc2b14ab53f3fb430496af426cb36> /System/Library/Frameworks/ModelIO.framework/ModelIO
0x18fb44000 - 0x18fbc5fff CoreSymbolication arm64  <1a84d15d8ec835e6ab65c0cfcaf435a2> /System/Library/PrivateFrameworks/CoreSymbolication.framework/CoreSymbolication
0x18fc5f000 - 0x18fc8efff GLKit arm64  <dd0f8559665936fda454a0970b05151f> /System/Library/Frameworks/GLKit.framework/GLKit
0x18fefb000 - 0x18ff39fff Notes arm64  <f5813244a3ff392b825707129b7301de> /System/Library/PrivateFrameworks/Notes.framework/Notes
0x18ff3a000 - 0x190011fff AddressBookUI arm64  <31c0ddcfa58f34a6bf9c60c838908e72> /System/Library/Frameworks/AddressBookUI.framework/AddressBookUI
0x190012000 - 0x1900f0fff CloudKit arm64  <6964b82f3a593988b86b3ab436f2f44f> /System/Library/Frameworks/CloudKit.framework/CloudKit
0x19024a000 - 0x190299fff DataAccess arm64  <12a88c8b110737048d257a5176399176> /System/Library/PrivateFrameworks/DataAccess.framework/DataAccess
0x190d13000 - 0x190d81fff libprotobuf.dylib arm64  <49cefe5f37573881b69ab4c1ca25c417> /usr/lib/libprotobuf.dylib
0x190d82000 - 0x190da5fff ScreenReaderCore arm64  <f3080005bf733731ae94889ef52bf685> /System/Library/PrivateFrameworks/ScreenReaderCore.framework/ScreenReaderCore
0x190e5b000 - 0x190e7afff TextToSpeech arm64  <0ee5b719c20438948d850eb22c78f7b2> /System/Library/PrivateFrameworks/TextToSpeech.framework/TextToSpeech
0x190f04000 - 0x190f06fff libAXSafeCategoryBundle.dylib arm64  <ec2951ef911a356aa26a014ba9149a27> /usr/lib/libAXSafeCategoryBundle.dylib
0x190f07000 - 0x190f10fff libAXSpeechManager.dylib arm64  <3d126e8c35fc3c798044c7899847cfba> /usr/lib/libAXSpeechManager.dylib
0x190f11000 - 0x190fb1fff AccessibilityUtilities arm64  <c0f52d226d9539b4983e038b74f760be> /System/Library/PrivateFrameworks/AccessibilityUtilities.framework/AccessibilityUtilities
0x190fb2000 - 0x1910edfff Message arm64  <641dcb7f3a313859a7d6eb0cb0cd3c51> /System/Library/PrivateFrameworks/Message.framework/Message
0x19119f000 - 0x1911d2fff DataDetectorsCore arm64  <7cf6a2529e2831e488c3708945e314e0> /System/Library/PrivateFrameworks/DataDetectorsCore.framework/DataDetectorsCore
0x1911e1000 - 0x191415fff libAWDSupportFramework.dylib arm64  <88727890305735ba853dc8edbfd663a7> /usr/lib/libAWDSupportFramework.dylib
0x191454000 - 0x191491fff WirelessDiagnostics arm64  <6c0d913bce5b30aeabfb8c9382929a0d> /System/Library/PrivateFrameworks/WirelessDiagnostics.framework/WirelessDiagnostics
0x19159b000 - 0x1915d2fff AXRuntime arm64  <fa516ffcfe8b34a3953eab1d6df126dd> /System/Library/PrivateFrameworks/AXRuntime.framework/AXRuntime
0x19166a000 - 0x191675fff CoreRecents arm64  <7115aa87e7c83d668649a4ebec02fc05> /System/Library/PrivateFrameworks/CoreRecents.framework/CoreRecents
0x191fec000 - 0x191feffff FTClientServices arm64  <8db69557415f3574a29447f850b70e6d> /System/Library/PrivateFrameworks/FTClientServices.framework/FTClientServices
0x1921ea000 - 0x192222fff ContactsAutocomplete arm64  <407f2dcac7a93cbdbe16724bac2ab88b> /System/Library/PrivateFrameworks/ContactsAutocomplete.framework/ContactsAutocomplete
0x192233000 - 0x192310fff MessageUI arm64  <fb2381cf4cc937e09a843ea88a7c6a1e> /System/Library/Frameworks/MessageUI.framework/MessageUI
0x192311000 - 0x192389fff libnetwork.dylib arm64  <0a7b6197b67b32858ab16f65cc8e89bb> /usr/lib/libnetwork.dylib
0x192e43000 - 0x192e75fff Pegasus arm64  <5815a011d91e3b9ca2ac76caa2245b77> /System/Library/PrivateFrameworks/Pegasus.framework/Pegasus
0x1949e2000 - 0x194a18fff OpenAL arm64  <4564bba1105436c997271ee32059627a> /System/Library/Frameworks/OpenAL.framework/OpenAL
0x194b40000 - 0x194b5dfff Jet arm64  <95e8fc5b278833eaa87c1dcb629b6d8a> /System/Library/PrivateFrameworks/Jet.framework/Jet
0x194ca9000 - 0x194e25fff SpriteKit arm64  <edd71bb34a6634b8a7007bdf8b933fa6> /System/Library/Frameworks/SpriteKit.framework/SpriteKit
0x195174000 - 0x1951a4fff WirelessProximity arm64  <7e491a1bcba63ed895899f44e890e3f7> /System/Library/PrivateFrameworks/WirelessProximity.framework/WirelessProximity
0x1960a0000 - 0x1960fcfff CoreBrightness arm64  <45681ca0f8de3889b148b92cd7c379ac> /System/Library/PrivateFrameworks/CoreBrightness.framework/CoreBrightness
0x197902000 - 0x197921fff CoreNLP arm64  <f23128bd305e3e0eb3be0d9b2b575dd1> /System/Library/PrivateFrameworks/CoreNLP.framework/CoreNLP
0x19983e000 - 0x199845fff libMatch.1.dylib arm64  <5698f0d024dd3dbea8fbcbd94d64e8f3> /usr/lib/libMatch.1.dylib
0x199905000 - 0x19990bfff AXSpeechImplementation arm64  <12bc0c98d8c830f08719ad0bf105ea90> /System/Library/AccessibilityBundles/AXSpeechImplementation.bundle/AXSpeechImplementation
0x199f03000 - 0x199f17fff libCGInterfaces.dylib arm64  <6197c0f084b532d9ad7df20efbf15f09> /System/Library/Frameworks/Accelerate.framework/Frameworks/vImage.framework/Libraries/libCGInterfaces.dylib
0x199f18000 - 0x19a18efff AudioCodecs arm64  <f448cadf08d43882a76f583a2b694097> /System/Library/Frameworks/AudioToolbox.framework/AudioCodecs
0x19addb000 - 0x19ade9fff AppleFSCompression arm64  <d390dfb23092338c9452195e007afcb0> /System/Library/PrivateFrameworks/AppleFSCompression.framework/AppleFSCompression
0x19adea000 - 0x19adf5fff AppleIDAuthSupport arm64  <01a507f1fe2030aab5f90d0c7c664961> /System/Library/PrivateFrameworks/AppleIDAuthSupport.framework/AppleIDAuthSupport
0x19bac3000 - 0x19bae9fff CoreServicesInternal arm64  <ac0a1a1093eb359a96033c5f36f69b21> /System/Library/PrivateFrameworks/CoreServicesInternal.framework/CoreServicesInternal
0x19c168000 - 0x19c174fff libGSFontCache.dylib arm64  <62002ad71b7a323a9d385a43dde68a66> /System/Library/PrivateFrameworks/FontServices.framework/libGSFontCache.dylib
0x19c175000 - 0x19c1a6fff libTrueTypeScaler.dylib arm64  <725a2ff41d7f315b834d14c969050ea8> /System/Library/PrivateFrameworks/FontServices.framework/libTrueTypeScaler.dylib
0x19df7e000 - 0x19df83fff TextInputUI arm64  <5f3e83b8ed103077a4f0df5eb58f6368> /System/Library/PrivateFrameworks/TextInputUI.framework/TextInputUI
0x19e66d000 - 0x19e848fff libFosl_dynamic.dylib arm64  <824eea765c503ac1ba0917abf74f38db> /usr/lib/libFosl_dynamic.dylib
0x19ec57000 - 0x19ec86fff libpcap.A.dylib arm64  <5e8e5836c6ee38109cf607fcb398671a> /usr/lib/libpcap.A.dylib
0x19ec87000 - 0x19ecbefff libsandbox.1.dylib arm64  <398892b5683531a2ba8833af790099f2> /usr/lib/libsandbox.1.dylib
0x19ecc2000 - 0x19ed96fff AVFAudio arm64  <291f828312d038c9aecd48a7069cc790> /System/Library/Frameworks/AVFoundation.framework/Frameworks/AVFAudio.framework/AVFAudio
0x19ed97000 - 0x19eda0fff ProactiveEventTracker arm64  <da5a5190c6043c40a89c3a82179257c8> /System/Library/PrivateFrameworks/ProactiveEventTracker.framework/ProactiveEventTracker
0x19eda1000 - 0x19eee3fff Intents arm64  <8233bd87de6b35b995d0aeee596d7a48> /System/Library/Frameworks/Intents.framework/Intents
0x19f01e000 - 0x19f041fff UserNotifications arm64  <23ee04a6460836929ab4494c2bffe5d9> /System/Library/Frameworks/UserNotifications.framework/UserNotifications
0x19f051000 - 0x19f05ffff PersonaKit arm64  <685d10cd74153df0ac58f31db6e9f8a4> /System/Library/PrivateFrameworks/PersonaKit.framework/PersonaKit
0x19f4b2000 - 0x19f638fff TextureIO arm64  <c761c83a9d3d353793a765e1a66164d9> /System/Library/PrivateFrameworks/TextureIO.framework/TextureIO
0x19fb45000 - 0x19fb8dfff ContactsUICore arm64  <2a7eac654cb3330688777fbce01a48ec> /System/Library/PrivateFrameworks/ContactsUICore.framework/ContactsUICore
0x1a08df000 - 0x1a0965fff AGXMetalA7 arm64  <23428469a5be3320b352cd6840bc8288> /System/Library/Extensions/AGXMetalA7.bundle/AGXMetalA7
0x1a0966000 - 0x1a0978fff libBNNS.dylib arm64  <c5b5b579660333878b35b237714132e3> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libBNNS.dylib
0x1a0979000 - 0x1a097efff libQuadrature.dylib arm64  <f96735a958f531ee83765f2237d3a0da> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libQuadrature.dylib
0x1a0cb1000 - 0x1a0cc2fff CoreEmoji arm64  <7b72c0afc47f32988794951dca896329> /System/Library/PrivateFrameworks/CoreEmoji.framework/CoreEmoji
0x1a1255000 - 0x1a131dfff NLP arm64  <5de1e299b3043ddeb78d5a1504bae28e> /System/Library/PrivateFrameworks/NLP.framework/NLP
0x1a2166000 - 0x1a21d7fff libate.dylib arm64  <9d78bbf324af3a19b869f1f95ccbba0f> /usr/lib/libate.dylib
0x1a21d8000 - 0x1a21d8fff libcoretls.dylib arm64  <c50a55eeb4fc36d3964e983efbf9866d> /usr/lib/libcoretls.dylib
0x1a21d9000 - 0x1a21dafff libcoretls_cfhelpers.dylib arm64  <f7d161c350483e84a2a2e5c4c7dc30f5> /usr/lib/libcoretls_cfhelpers.dylib


EOF

Not clear to me what "AVFAudio" is...

AVFAudio is a subframework of AVFoundation that implements all the AVAudio APIs.

I recently made changes in my app to how I handle audio interruptions (in addition to many other unrelated changes), so this gives me a place to start looking!

Looking at your crash log with tools here, I believe

x2
from your crash log maps to the
finishedPlaying:
selector. That gels with this comment.

I have an iPad Air 2 running iOS iOS 10.1.1, and the crash report was on an iPad mini 2 running iOS 10.0.2, so I'm not sure I can get the selector.

Yeah, as I mentioned earlier, without being able to test on a device with the same libraries as the crash log, I don’t know of any supported way to make progress. OTOH, given that there’s been a lot of fixes under the bridge since 10.0.2, maybe you should just tell this user to upgrade and see if the problem reoccurs.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

thanks. I don't see a finishedPlaying selector anywhere, it must be a system call. Of course, AVAudioPlayerDelegate has audioPlayerDidFinishPlaying, but I don't even use AVAudioPlayerDelegate anywhere and I never set the delegate property of any AVAudioPlayer objects.


Another recent change I made in my app is I I have a SpriteKit view where I was playing sounds a certain way, then because of bugs I switched to using AVAudioPlayer instead. These AVAudioPlayer sounds play when 2 sprites bump into eachother, which is implemented by SKPhysicsContactDelegate didBeginContact. Looking at the SKPhysicsWorld contactDelegate property, I noticed it still uses assign, not weak. Which means on dealloc the contactDelegate is not set to nil. So one possibility for the crash is after the view is dismissed, 2 sprites were just able to bump into each other, which calls didBeginContact, which then plays audio using AVAudioPlayer. So I've updated my code to set contactDelegate to nil in dealloc. We'll see if that fixes things.


I have no way of contacting the user, since this is a crash report downloaded from Organizer in XCode. In other words it's a user who agreed to "share information with Apple".


Thanks for all your help. I have really appreciated it. I learned a lot, and I think anyone else reading this thread has, too, particularly on how to examine the registers for certain kinds of crashes and dig a bit deeper. Fascinating stuff.