Why would an app crash with _objc_msgSend_uncached

Question

Is a document or a place to find information information on what would cause _objc_msgSend_uncached in a crash report?

more info on the crash

libobjc.A.dylib 0x37e623cc  _objc_inform
4   libobjc.A.dylib 0x37e616f2  _ZN7cache_t9bad_cacheEP11objc_objectP13objc_selectorP10objc_class
5   libobjc.A.dylib 0x37e61730  _ZN7cache_t4findEm
6   libobjc.A.dylib 0x37e617da  cache_fill
7   libobjc.A.dylib 0x37e65890  lookUpImpOrForward
8   libobjc.A.dylib 0x37e5e02a  _class_lookupMethodAndLoadCache3
9   libobjc.A.dylib 0x37e5ddf8  _objc_msgSend_uncached
10  MyApp   0x00253f5c  -[AEEngine scanKeyframes:currentFrame:] in AEEngine.m on Line 256
11  MyApp   0x00256148  -[AEEngine doFrame] in AEEngine.m on Line 664
12  MyApp   0x00255f28  __31-[AEEngine doFrameInBackground]_block_invoke in AEEngine.m on Line 642

Got another similar crash that looks like this and ends in cache_t::bad_cache

  0   libobjc.A.dylib                   0x37b44368 _objc_trap() + 0
  1   libobjc.A.dylib                   0x37b443c8 _objc_fatal + 68
  2   libobjc.A.dylib                   0x37b436ee cache_t::bad_cache(objc_object*, objc_selector*, objc_class*) + 202
  3   libobjc.A.dylib                   0x37b4372c cache_t::find(unsigned long) + 48
  4   libobjc.A.dylib                   0x37b437d6 cache_fill + 122
  5   libobjc.A.dylib                   0x37b4788c lookUpImpOrForward + 320
  6   libobjc.A.dylib                   0x37b40026 _class_lookupMethodAndLoadCache3 + 30
  7   libobjc.A.dylib                   0x37b3fdf6 _objc_msgSend_uncached + 22
  8   MyApp                         0x0033811c -[MyCellCell configureCell:] (MyCellCell.m:81)

Answer 1

_objc_msgSend_uncached is an internal implementation detail of objc_msgSend. Crashes in objc_msgSend most often indicate that you're sending a message to a deallocated instance. The most common cause of that is incorrect memory management. The most common cause of incorrect memory management is failure to use ARC.

Most likely, -[AEEngine scanKeyframes:currentFrame:] is trying to message something that is deallocated. That doesn't mean the bug is in AEEngine, only that this is the place you tripped over the over-release. I would start by making sure that ARC is turned on, and that you have addressed all static analyzer warnings.

Answer 2

this isn't exactly documentation but found this

http://opensource.apple.com/source/objc4/objc4-551.1/runtime/Messengers.subproj/objc-msg-x86_64.s

/********************************************************************
 *
 * _objc_msgSend_uncached_impcache
 * _objc_msgSend_uncached
 * _objc_msgSend_stret_uncached
 * 
 * Used to erase method cache entries in-place by 
 * bouncing them to the uncached lookup.
 *
 ********************************************************************/

    STATIC_ENTRY __objc_msgSend_uncached_impcache
    // Method cache version

    // THIS IS NOT A CALLABLE C FUNCTION
    // Out-of-band condition register is NE for stret, EQ otherwise.
    // Out-of-band r11 is the searched class

    MESSENGER_START
    nop
    MESSENGER_END_SLOW

    jne __objc_msgSend_stret_uncached
    jmp __objc_msgSend_uncached

    END_ENTRY __objc_msgSend_uncached_impcache


    STATIC_ENTRY __objc_msgSend_uncached
    DW_START __objc_msgSend_uncached

    // THIS IS NOT A CALLABLE C FUNCTION
    // Out-of-band r11 is the searched class

    // r11 is already the class to search
    MethodTableLookup %a1, %a2, __objc_msgSend_uncached // r11 = IMP
    cmp %r11, %r11      // set eq (nonstret) for forwarding
    jmp *%r11           // goto *imp

    DW_END __objc_msgSend_uncached, 1
    END_ENTRY __objc_msgSend_uncached


    STATIC_ENTRY __objc_msgSend_stret_uncached
    DW_START __objc_msgSend_stret_uncached
    // THIS IS NOT A CALLABLE C FUNCTION
    // Out-of-band r11 is the searched class

    // r11 is already the class to search
    MethodTableLookup %a2, %a3, __objc_msgSend_stret_uncached  // r11 = IMP
    test    %r11, %r11      // set ne (stret) for forward; r11!=0
    jmp *%r11           // goto *imp

    DW_END __objc_msgSend_stret_uncached, 1
    END_ENTRY __objc_msgSend_stret_uncached

Answer 3

This error was fixed by using a different audio engine. The older audio engine had vDSP functions in it and while I don't know the cause I suspect some form of alignment or memory corruption due to the vDSP functions being used incorrectly.

Answer 4

_objc_msgSend_uncached is because of a memory access error. If your Xcode version is higher than 7.0, you can find memory access errors using Address Sanitizer in Edit Scheme.

Check the error location through the stack.

Then correct the error.