How to debug EXC_BAD_ACCESS bug

Question

I received an error

EXC_BAD_ACCESS code=2 at0xb0987654

I am wondering how to print out the value at 0xb0987654?

Solution 1

To debug an EXC_BAD_ACCESS, you can generally find out the where the dangling pointer is by enabling zombie objects.

Xcode

Choose edit scheme, then Diagnostics tab in the Run section, then click the 'Zombie Objects' option.

AppCode

Choose edit target, and add the following environment variable:

NSZombieEnabled=YES

Another cause for EXC_BAD_ACCESS can be infinite recursion, which can be found by adding some logging.

Update for C++:

To debug dangling pointers in C++ with the Clang compiler try using Address Sanitizer (ASAN) from Google.

Solution 2

It looks like maybe you are trying to write onto a code page or something? EXC_BAD_ACCESS is described in /usr/include/mach/exception_types.h:

#define EXC_BAD_ACCESS          1       /* Could not access memory */
            /* Code contains kern_return_t describing error. */
            /* Subcode contains bad memory address. */

And from kern_return.h:

#define KERN_PROTECTION_FAILURE         2
            /* Specified memory is valid, but does not permit the
             * required forms of access.
             */

You can see WHERE that address is in your binary by doing:

(lldb) image lookup -va 0xb0987654

But what you really need to figure out is who is trying to write there. If the problem is simple this might tell you what's wrong, but as Jasper suggests, this is probably some use-after-free or other such problem, and the bad actor is long gone by the time you crash. guardmalloc can also sometimes catch this sort of error (you can enable this in Xcode in the Run scheme.)

Comments

[Jasper Blues]

@AdamLee How about this then? stackoverflow.com/questions/3199067/…

[Jasper Blues]

@AdamLee, Oops looks like MudFlap is gcc only, updated for Clang/llvm

[Translunar]

image lookup -va 0x1586470c4 in lldb gives me no output at all, not even an error message.

[Jim Ingham]

At present "image lookup -a" just prints what it can find at a given address, even in the case of "no symbols at this address" when that is nothing... LLDB should really print some error when it can't find any symbols associated with a given address. Please file a bug about this either with Apple's bug reporter or the lldb.llvm.org bugzilla. Thanks.

[Jay]

Ever got the AddressSanitizer working with Xcode?? On all Xcode versions I've tried yet the 'special' clang version included by Apple doesn't feature support for -fsanitize..

[Jasper Blues]

@Jay Have not tried recently . . mostly ObjC lately. Found any workaround or other approach?

[Jay]

@JasperBlues in these day's I'm just using the Instruments templates for any kind of Obj-C memory errors.. and years of experience, extensive error checks plus heaps of logging for the bad, C++ ones.....