What causes a SIGILL with an ILL_ILLTRP code on iOS?

Question

I've received a crash report for my iOS application where the exception type is SIGILL with an exception code of ILL_ILLTRP, which I've never seen before.

The only information I can find about ILL_ILLTRP is in signal.h, where it says:

/*
 * When the signal is SIGILL or SIGFPE, si_addr contains the address of
 * the faulting instruction.
 * When the signal is SIGSEGV or SIGBUS, si_addr contains the address of
 * the faulting memory reference. Although for x86 there are cases of SIGSEGV
 * for which si_addr cannot be determined and is NULL.
 * If the signal is SIGCHLD, the si_pid field will contain the child process ID,
 *  si_status contains the exit value or signal and
 *  si_uid contains the real user ID of the process that sent the signal.
 */

/* Values for si_code */

/* Codes for SIGILL */
#if !defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE)
#define ILL_NOOP        0       /* if only I knew... */
#endif
#define ILL_ILLOPC      1       /* [XSI] illegal opcode */
#define ILL_ILLTRP      2       /* [XSI] illegal trap */
#define ILL_PRVOPC      3       /* [XSI] privileged opcode */
#define ILL_ILLOPN      4       /* [XSI] illegal operand -NOTIMP */
#define ILL_ILLADR      5       /* [XSI] illegal addressing mode -NOTIMP */
#define ILL_PRVREG      6       /* [XSI] privileged register -NOTIMP */
#define ILL_COPROC      7       /* [XSI] coprocessor error -NOTIMP */
#define ILL_BADSTK      8       /* [XSI] internal stack error -NOTIMP */

On iOS (and Swift or Obj-C), what could cause an "illegal trap" to occur?

For reference, here is the stack trace for the crashing thread:

Incident Identifier: A450C98F-DDB4-4593-9C93-B4C17D3EB4E4
CrashReporter Key:   DB1695E0-C812-4087-9567-D4BD5D4D491C
Hardware Model:      iPhone8,1
Code Type:       ARM-64
Parent Process:  ??? [1]

Date/Time:       2019-05-26T17:01:50Z
Launch Time:     2019-05-26T17:01:37Z
OS Version:      iPhone OS 12.1.2 (16C101)
Report Version:  104

Exception Type:  SIGILL
Exception Codes: ILL_ILLTRP at 0x100c3343c
Crashed Thread:  0

Thread 0 Crashed:
0   CocoaLumberjack                      0x0000000100c3343c CocoaLumberjack.asyncLoggingEnabled.unsafeMutableAddressor : Swift.Bool (CocoaLumberjack.swift:73)
1   XXXApp                               0x0000000100762d08 XXXApp.XXXAppNavigationContext.append(XXXApp.XXXAppNavigationPathComponent) -> () (XXXAppNavigationContext.swift:0)
2   XXXApp                               0x0000000100763a4c merged @objc XXXApp.XXXAppNavigationContext.append(XXXApp.XXXAppNavigationPathComponent) -> () + 44
3   XXXApp                               0x000000010071ae80 -[XXXAppTableViewController viewWillAppear:] (XXXAppTableViewController.m:35)
4   XXXApp                               0x0000000100708360 -[XXXAppGroupTableViewController viewWillAppear:] (XXXAppGroupTableViewController.m:83)
5   UIKitCore                            0x00000001b3224f28 -[UIViewController _setViewAppearState:isAnimating:] + 580
6   UIKitCore                            0x00000001b322560c -[UIViewController __viewWillAppear:] + 136
7   XXXApp                               0x00000001006d3ff8 -[XXXAppTabBarViewController sendAppearanceTransitionsToViewControllers:] (XXXAppTabBarViewController.m:441)
8   XXXApp                               0x00000001006d3d88 -[XXXAppTabBarViewController scrollViewDidScroll:] (XXXAppTabBarViewController.m:426)
9   XXXApp                               0x00000001006d1458 -[XXXAppTabBarViewController viewDidLayoutSubviews] (XXXAppTabBarViewController.m:159)
10  UIKitCore                            0x00000001b3c8f944 -[UIView(CALayerDelegate) layoutSublayersOfLayer:] + 1736
11  QuartzCore                           0x000000018ac4db74 -[CALayer layoutSublayers] + 180
12  QuartzCore                           0x000000018ac52b2c CA::Layer::layout_if_needed(CA::Transaction*) + 320
13  UIKitCore                            0x00000001b3c7acc8 -[UIView(Hierarchy) layoutBelowIfNeeded] + 544
14  UIKitCore                            0x00000001b318bd0c -[UINavigationController _layoutViewController:] + 1292
15  UIKitCore                            0x00000001b3186400 -[UINavigationController _layoutTopViewController] + 232
16  UIKitCore                            0x00000001b31845d0 -[UINavigationController navigationTransitionView:didEndTransition:fromView:toView:] + 776
17  UIKitCore                            0x00000001b3c4a7d4 -[UINavigationTransitionView _notifyDelegateTransitionDidStopWithContext:] + 416
18  UIKitCore                            0x00000001b3c4aa90 -[UINavigationTransitionView _cleanupTransition] + 584
19  UIKitCore                            0x00000001b3c58950 -[UIViewAnimationState sendDelegateAnimationDidStop:finished:] + 308
20  UIKitCore                            0x00000001b3c5438c +[UIViewAnimationState popAnimationState] + 332
21  UIKitCore                            0x00000001b3c4a518 -[UINavigationTransitionView transition:fromView:toView:] + 1860
22  UIKitCore                            0x00000001b318cb1c -[UINavigationController _startTransition:fromViewController:toViewController:] + 2652
23  UIKitCore                            0x00000001b318d0f8 -[UINavigationController _startDeferredTransitionIfNeeded:] + 1180
24  UIKitCore                            0x00000001b318e3f8 -[UINavigationController __viewWillLayoutSubviews] + 160
25  UIKitCore                            0x00000001b31705e8 -[UILayoutContainerView layoutSubviews] + 220
26  UIKitCore                            0x00000001b3c8f7dc -[UIView(CALayerDelegate) layoutSublayersOfLayer:] + 1376
27  QuartzCore                           0x000000018ac4db74 -[CALayer layoutSublayers] + 180
28  QuartzCore                           0x000000018ac52b2c CA::Layer::layout_if_needed(CA::Transaction*) + 320
29  QuartzCore                           0x000000018abb144c CA::Context::commit_transaction(CA::Transaction*) + 336
30  QuartzCore                           0x000000018abdfd7c CA::Transaction::commit() + 604
31  UIKitCore                            0x00000001b380fa3c _afterCACommitHandler + 252
32  CoreFoundation                       0x00000001865e07cc __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 28
33  CoreFoundation                       0x00000001865db460 __CFRunLoopDoObservers + 408
34  CoreFoundation                       0x00000001865dba00 __CFRunLoopRun + 1260
35  CoreFoundation                       0x00000001865db1f0 CFRunLoopRunSpecific + 432
36  GraphicsServices                     0x0000000188854584 GSEventRunModal + 96
37  UIKitCore                            0x00000001b37e6d40 UIApplicationMain + 208
38  XXXApp                               0x00000001006c96e4 main (main.m:16)
39  libdyld.dylib                        0x000000018609abb4 start + 0

Answer 1

I tried to understand what happened. I don’t have a solution, but a few ideas:

The stack trace (line 0) says the crash is in the CocoaLumberjack swift code at line 73, where a Bool var asyncLoggingEnabled should be accessed using an unsafeMutableAddressor.
Apparently, this is the instruction

public var asyncLoggingEnabled = true

in this code at line 73.

I believe this var is accessed using an UnsafeMutablePointer (docs). Here, the app is

... responsible for handling the life cycle of any memory you work with through unsafe pointers to avoid leaks or undefined behavior.

Particularly,

Many pointer operations must only be applied to pointers with memory in a specific state—you must keep track of the state of the memory you are working with and understand the changes to that state that different operations perform. Memory can be untyped and uninitialized, bound to a type and uninitialized, or bound to a type and initialized to a value. Finally, memory that was allocated previously may have been deallocated, leaving existing pointers referencing unallocated memory.

I believe that your app crashed because the pointer used to access asyncLoggingEnabled points to memory in an illegal state.
If this happens, a system trap should be executed to handle the situation, but it can only be executed if a trap handler for this type of exception has been installed. If this is not the case, an illegal trap (Exception Code: ILL_ILLTRP) is done that handles all not handled traps.

Probably, the memory could by chance also be in a legal state, depending on the execution history. Thus, the crash may happen or not.

To cut it short, I think this is a bug in CocoaLumberjack.