iOS 9 Crashing in _prepareForCAFlush with EXC_BAD_ACCESS KERN_INVALID_ADDRESS

Question

With the release of iOS 9, we are seeing several crash reports for what appears to be a bug from Apple's side of things in iOS 9. This is happening across device types (iPhone, iPad and iPod). I am looking to find out why this may be happening and if there is anything I can do to work around it. This stack is being reported through our crash reporting system (Crashlytics) so unfortunately I don't have reproducible steps or code, but I will try and answer any questions as best as I can. The stack is as follows:

Thread : Crashed: com.apple.main-thread
0  libobjc.A.dylib                0x34a27ad6 objc_msgSend + 21
1  CoreFoundation                 0x230d3db9 -[__NSArrayM dealloc] + 148
2  libobjc.A.dylib                0x34a34f67 objc_object::sidetable_release(bool) + 150
3  libobjc.A.dylib                0x34a353a9 (anonymous namespace)::AutoreleasePoolPage::pop(void*) + 388
4  CoreFoundation                 0x230cbfa9 _CFAutoreleasePoolPop + 16
5  UIKit                          0x27523cd9 _prepareForCAFlush + 312
6  UIKit                          0x2752886b _beforeCACommitHandler + 10
7  CoreFoundation                 0x2317a509 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 20
8  CoreFoundation                 0x2317880d __CFRunLoopDoObservers + 280
9  CoreFoundation                 0x23178c3f __CFRunLoopRun + 958
10 CoreFoundation                 0x230cc249 CFRunLoopRunSpecific + 520
11 CoreFoundation                 0x230cc035 CFRunLoopRunInMode + 108
12 GraphicsServices               0x2c182ad1 GSEventRunModal + 160
13 UIKit                          0x272e18a9 UIApplicationMain + 144
14 APPNAMEHERE                    0x000ec967 main (main.m:14)

Answer 1

For me the problem was that I was showing and dismissing the keyboard when the application was minimized.

[self.textView becomeFirstResponder];
[self.textView resignFirstResponder];

I performed the above code on the applicationWillResignActive event. removing this code fixed the crash.

Answer 2

We encountered the a crash with a similar stack trace, and after a long investigation we found out that it was related to an other crash; fixing that also fixed this, however I'm still unsure how the two crashes are related.

Here are the details about the other crash:

We had a function call in one of our methods like

AudioServicesAddSystemSoundCompletion(self.soundID,  
                                      [[NSRunLoop currentRunLoop] getCFRunLoop],  
                                      kCFRunLoopDefaultMode,  
                                      AudioServicesSystemSoundCompletion,  
                                      (void *)CFBridgingRetain(self)); 

where AudioServicesSystemSoundCompletion looked like

void AudioServicesSystemSoundCompletion(SystemSoundID ssID,  void *clientData) {  
     AudioServicesRemoveSystemSoundCompletion(ssID);  
     CFRelease(clientData);  
}

Executing that function call two or more times simultaneously caused the app to crash. We fixed this by passing NULL instead of (void *)CFBridgingRetain(self) and removing the CFRelease(clientData); line.

Since this fix we no longer see the '_prepareForCAFlush' crash anymore.

Also note that according to Crashlytics the device had very high memory usage each time the crash has reproduced.

Hope this helps!