崩溃方案：

用到3个知识点

1、消息转发机制


@implementation HelloClass
//这里没啥用
-(BOOL)respondsToSelector:(SEL)aSelector{
    bool a= [super respondsToSelector:aSelector];
    return a;
}
//如果方法没有实现，默认返回false
//如果返回false，就会走消息转发
+(BOOL)resolveInstanceMethod:(SEL)sel{
    bool a = [super resolveInstanceMethod:sel];
    return a;
}
//默认返回空
//又被称为快速消息转发。
// 如果为空，走慢速消息转发，继续转发消息
-(id)forwardingTargetForSelector:(SEL)aSelector{
    id a = [super forwardingTargetForSelector:aSelector];
    return a;
}
//默认实现是崩溃
//并且不能用try-catch捕获
-(void)forwardInvocation:(NSInvocation *)anInvocation{
    [super forwardInvocation:anInvocation];
    NSLog(@"");
}
// 默认一般普通方法是返回空的。
// 如果是协议方法，没有实现，不会反回空。
//反回空，到这里就会崩溃了
//如果这里返回了签名，会再次调用resolveInstanceMethod:(SEL)sel判断是否实现
//如果仍然没有实现，就会走到fowardInvocation:
-(NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector{
    NSMethodSignature *a =[super methodSignatureForSelector:aSelector];
    return a;
}
@end

2、关联对象内存管理

通过对象dealloc时，关联对象也会dealloc的特性，可以给dealloc插入一些实现。


static const char DeallocNSObjectKey;

/**
 Observer the target middle object
 */
@interface DeallocStub : NSObject

@property (nonatomic,readwrite,copy) void(^deallocBlock)(void);

@end

@implementation DeallocStub

- (void)dealloc {
    if (self.deallocBlock) {
        self.deallocBlock();
    }
    self.deallocBlock = nil;
}

@end

@implementation NSObject (DeallocBlock)



- (void)isd_deallocBlock:(void(^)(void))block{
    @synchronized(self){
         // 用数组，  保证每一个block都能执行
        
        NSMutableArray* blockArray = objc_getAssociatedObject(self, &DeallocNSObjectKey);
        if (!blockArray) {
            blockArray = [NSMutableArray array];
             objc_setAssociatedObject(self, &DeallocNSObjectKey, blockArray, OBJC_ASSOCIATION_RETAIN_NONATOMIC);
        }
        
        
        
        DeallocStub *stub = [DeallocStub new];
        stub.deallocBlock = block;
        [blockArray addObject:stub];
    }
}

@end

3、HOOK方法交换



void isd_swizzleClassMethod(Class cls, SEL originSelector, SEL swizzleSelector)
{
    if (!cls) {
        return;
    }
    Method originalMethod = class_getClassMethod(cls, originSelector);
    Method swizzledMethod = class_getClassMethod(cls, swizzleSelector);

    
    Class metacls = objc_getMetaClass(NSStringFromClass(cls).UTF8String);
    if (class_addMethod(metacls,
                        originSelector,
                        method_getImplementation(swizzledMethod),
                        method_getTypeEncoding(swizzledMethod)) ) {
        /* swizzing super class method, added if not exist */
        class_replaceMethod(metacls,
                            swizzleSelector,
                            method_getImplementation(originalMethod),
                            method_getTypeEncoding(originalMethod));
        
    } else {
        /* swizzleMethod maybe belong to super */
        class_replaceMethod(metacls,
                            swizzleSelector,
                            class_replaceMethod(metacls,
                                                originSelector,
                                                method_getImplementation(swizzledMethod),
                                                method_getTypeEncoding(swizzledMethod)),
                            method_getTypeEncoding(originalMethod));
    }
}



void isd_swizzleInstanceMethod(Class cls, SEL originSelector, SEL swizzleSelector)
{
    if (!cls) {
        return;
    }

 
    /* if current class not exist selector, then get super*/
    Method originalMethod = class_getInstanceMethod(cls, originSelector);
    Method swizzledMethod = class_getInstanceMethod(cls, swizzleSelector);

    /* add selector if not exist, implement append with method */
    //调用originSelector-》swizzledMethod
    if (class_addMethod(cls,
                        originSelector,
                        method_getImplementation(swizzledMethod),
                        method_getTypeEncoding(swizzledMethod)) ) {
        /* replace class instance method, added if selector not exist */
        /* for class cluster , it always add new selector here */
        //调用swizzleSelector-》originalMethod

        class_replaceMethod(cls,
                            swizzleSelector,
                            method_getImplementation(originalMethod),
                            method_getTypeEncoding(originalMethod));

    } else {
        /* swizzleMethod maybe belong to super */
        //swizzleSelector-》originalMethod
        //originSelector-》swizzledMethod
        class_replaceMethod(cls,
                            swizzleSelector,
                            class_replaceMethod(cls,
                                                originSelector,
                                                method_getImplementation(swizzledMethod),
                                                method_getTypeEncoding(swizzledMethod)),
                            method_getTypeEncoding(originalMethod));
    }
}

崩溃和保护方案

1、nstimer。aTarget 类没有实现对应的方法

hook NSTimer

+ (NSTimer *)scheduledTimerWithTimeInterval:(NSTimeInterval)ti target:(id)aTarget selector:(SEL)aSelector userInfo:(nullable id)userInfo repeats:(BOOL)yesOrNo;

方法。

2， nsnotfication奔溃，没有移除观察者
观察者dealloc释放时候，没有从消息中心移除自己

hook NSNotificationCenter

 - (void)addObserver:(id)observer selector:(SEL)aSelector name:(nullable NSNotificationName)aName object:(nullable id)anObject;

方法。

给observer 对象添加关联对象。

observer对象释放-》关联对象在dealloc-〉绑定block，关联对象dealloc时调用block，消息中心移除观察者。

3， kvo崩溃
多移除： it is not registered as an observer.、
少移除都会崩溃：deallocated while key value observers were still registered with it

hook

addObserver:forKeyPath:options:context:
removeObserver:forKeyPath:
removeObserver:forKeyPath:context:

方法。
通过关联对象。记录已经添加的 observer 和keypath。

4，找不到方法崩溃

hook NSObject

methodSignatureForSelector：
forwardInvocation：

方法。



@implementation NSObject (UnrecognizedSelectorHook)

+ (void)xxx_swizzleUnrecognizedSelector{
    xxx_swizzleInstanceMethod(self, @selector(methodSignatureForSelector:), @selector(methodSignatureForSelectorSwizzled:));
    xxx_swizzleInstanceMethod(self, @selector(forwardInvocation:), @selector(forwardInvocationSwizzled:));
}

- (NSMethodSignature*)methodSignatureForSelectorSwizzled:(SEL)aSelector {
    NSMethodSignature* methodSignature = [self methodSignatureForSelectorSwizzled:aSelector];
    // 协议中的方法，但是没有实现， 默认返回非空
    if (methodSignature) {
        return methodSignature;
    }
    
    // 其他情况， 默认返回空
    
    //原始的默认实现NSObject 函数指针
    IMP originIMP = class_getMethodImplementation([NSObject class], @selector(methodSignatureForSelector:));
    
    // 当前类自己的实现
    IMP currentClassIMP = class_getMethodImplementation(self.class, @selector(methodSignatureForSelector:));
    
    // If current class override methodSignatureForSelector return nil
    //当前类自己重新实现了methodSignatureForSelector:方法；
    if (originIMP != currentClassIMP){
        return nil;
    }
    
    // Customer method signature
    // void xxx(id,sel,id)
    //随便返回点啥签名， 只要forwardInvocation被hook拦截住不调用就不会崩溃
    return [NSMethodSignature signatureWithObjCTypes:"v@:@"];
}



- (void)forwardInvocationSwizzled:(NSInvocation*)invocation{
    //forwardInvocation:
    NSString* message = [NSString stringWithFormat:@"Unrecognized selector class:%@ and selector:%@",NSStringFromClass(self.class),NSStringFromSelector(invocation.selector)];
    handleCrashException(xxxCrashProtectionUnrecognizedSelector,message,@{});
}


@end

还有其他方案：

HOOK
NSNULL、 NSObject、NSNumber、NSString
NSNULL类的 forwardingTargetForSelector:方法

比如对NSNumber调用NSString的方法，可以forwardingTargetForSelector:返回NSString对象。
NSString也一样，原对象转化NSNumber对象返回。
NSNull @"", @[], @{}, @0 respondsToSelector判断，字符串、数组、字典、number哪个实现了原来selector，就返回对应固定对象，保证不崩溃。
NSObject实现为，forwardingTargetForSelector:转发给新对象。新的类动态使用
class_addMethod 添加实现。 IMP指向一个C函数。

5、集合类，nsstring，nsdictionary，nsarray 以及他们的可变版本插入nil，超过下标越界访问崩溃

6、NSUserDefaults崩溃。 key 或者value 有一个为NULL都会崩溃的

hook NSUserDefaults 类：

objectForKey:
setObject:forKey:

方法。

7、野指针崩溃

hook

 dealloc

方法。
就是dealloc 之后，给当前实例对象通过

    objc_destructInstance(self);
    object_setClass(self, [xxxZombieSub class]);

方法，修改isa，让其所有方法，都转向重新定向的类
在新类的

 - (id)forwardingTargetForSelector:(SEL)selector 。

转发
-》

void unrecognizedSelectorZombie(ZombieSelectorHandle* self, SEL _cmd){
    // fromObject 对象内存free后，仍然会成为野指针
    NSString* message = [NSString stringWithFormat:@"unrecognizedSelectorZombie:%@   selector:%@",[self.fromObject class],NSStringFromSelector(_cmd)];
    handleCrashException(xxxCrashProtectionZombie,message,@{});
    NSLog(@"%@", message);
}

8、非主线程操作UI

hook
UIView的下面方法

(&onceToken, ^{
            NSDictionary * methods = @{@"setNeedsLayout": @"xxxSafe_setNeedsLayout",
                                       @"setNeedsDisplay": @"xxxSafe_setNeedsDisplay",
                                       @"setNeedsDisplayInRect:": @"xxxSafe_setNeedsDisplayInRect:",
                                       @"addSubview:": @"xxxSafe_addSubview:",
                                       @"removeFromSuperview:": @"xxxSafe_removeFromSuperview:",
                                       };

方法

9、其他崩溃

NSJSONSerialization

JSONObjectWithData:options:error:

JSON序列化 data是nil
HOOK NSJSONSerialization此方法。

2022-03-15 iOS OC常见崩溃和防止崩溃方案