[Android & iOS] 频繁创建和销毁播放器 Crash

[doersoul]

在一个 ListView 中，每个item一个播放器，滚动时创建和销毁播放器，造成 crash

安卓

F/libc    (27621): /Users/doer/Documents/code/flutter/fvp/android/mdk-sdk/include/mdk/Player.h:370: void mdk::Player::updateNativeSurface(void *, int, int, SurfaceType): assertion "p->updateNativeSurface && "NOT IMPLEMENTED! Runtime version < build version?"" failed
F/libc    (27621): Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 27621 (com.example.demo), pid 27621 (com.example.demo)
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'OPPO/PCCM00/OP46C3:11/RKQ1.200928.002/1617017204685:user/release-keys'
Revision: '0'
ABI: 'arm64'
Timestamp: 2025-12-27 17:31:25+0800
pid: 27621, tid: 27621, name: com.example.demo  >>> com.example.demo <<<
uid: 10460
signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
Abort message: '/Users/doer/Documents/code/flutter/fvp/android/mdk-sdk/include/mdk/Player.h:370: void mdk::Player::updateNativeSurface(void *, int, int, SurfaceType): assertion "p->updateNativeSurface && "NOT IMPLEMENTED! Runtime version < build version?"" failed'
    x0  0000000000000000  x1  0000000000006be5  x2  0000000000000006  x3  0000007fe3f54940
    x4  0000000000000080  x5  0000000000000080  x6  0000000000000080  x7  0000000000000040
    x8  00000000000000f0  x9  8c28f0689739833d  x10 0000000000000000  x11 ffffffc0fffffbdf
    x12 0000000000000001  x13 00000000694fa76d  x14 00153a6b350065e2  x15 0000bcee16beca75
    x16 0000007d002f17e0  x17 0000007d002d0da0  x18 0000007d024e6000  x19 0000000000006be5
    x20 0000000000006be5  x21 00000000ffffffff  x22 b400007bd829f900  x23 0000000000000500
    x24 0000000013b67328  x25 0000000015e8e998  x26 0000000015e8e9a8  x27 00000000000002d0
    x28 0000007fe3f54c40  x29 0000007fe3f549c0
    lr  0000007d00284460  sp  0000007fe3f54920  pc  0000007d0028448c  pst 0000000000000000
backtrace:
      #00 pc 000000000007848c  /apex/com.android.runtime/lib64/bionic/libc.so (abort+164) (BuildId: 1ca28d785d6567d2b225cf978ef04de5)
      #01 pc 0000000000078854  /apex/com.android.runtime/lib64/bionic/libc.so (__assert2+36) (BuildId: 1ca28d785d6567d2b225cf978ef04de5)
      #02 pc 0000000000025240  /data/app/~~fzhc9iBXUkHdAielVNzQYw==/com.example.demo-Me0NW6tXeFbuU17ZgAySkA==/base.apk!libfvp_plugin.so (offset 0x48f4000) (BuildId: 108c1377e32df51e29ec07043b142ed792d69194)
      #03 pc 0000000000025020  /data/app/~~fzhc9iBXUkHdAielVNzQYw==/com.example.demo-Me0NW6tXeFbuU17ZgAySkA==/base.apk!libfvp_plugin.so (offset 0x48f4000) (Java_com_mediadevkit_fvp_FvpPlugin_nativeSetSurface+760) (BuildId: 108c1377e32df51e29ec07043b142ed792d69194)
      #04 pc 000000000013ced4  /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+148) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #05 pc 00000000020698d4  /memfd:jit-cache (deleted) (offset 0x2000000) (com.mediadevkit.fvp.FvpPlugin.onMethodCall+2404)
      #06 pc 0000000002026c28  /memfd:jit-cache (deleted) (offset 0x2000000) (io.flutter.plugin.common.MethodChannel$IncomingMethodCallHandler.onMessage+232)
      #07 pc 00000000020294c4  /memfd:jit-cache (deleted) (offset 0x2000000) (io.flutter.embedding.engine.dart.DartMessenger.invokeHandler+244)
      #08 pc 0000000002015ce0  /memfd:jit-cache (deleted) (offset 0x2000000) (io.flutter.embedding.engine.dart.DartMessenger.lambda$dispatchMessageToQueue$0$io-flutter-embedding-engine-dart-DartMessenger+320)
      #09 pc 000000000202ddb4  /memfd:jit-cache (deleted) (offset 0x2000000) (io.flutter.embedding.engine.dart.DartMessenger$$ExternalSyntheticLambda0.run+132)
      #10 pc 000000000202c1c4  /memfd:jit-cache (deleted) (offset 0x2000000) (android.os.Handler.handleCallback+68)
      #11 pc 0000000002029960  /memfd:jit-cache (deleted) (offset 0x2000000) (android.os.Handler.dispatchMessage+64)
      #12 pc 0000000002042c00  /memfd:jit-cache (deleted) (offset 0x2000000) (android.os.Looper.loop+1664)
      #13 pc 000000000013387c  /apex/com.android.art/lib64/libart.so (art_quick_osr_stub+60) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #14 pc 000000000033d060  /apex/com.android.art/lib64/libart.so (art::jit::Jit::MaybeDoOnStackReplacement(art::Thread*, art::ArtMethod*, unsigned int, int, art::JValue*)+344) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #15 pc 000000000068b9e0  /apex/com.android.art/lib64/libart.so (MterpMaybeDoOnStackReplacement+208) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #16 pc 0000000000132350  /apex/com.android.art/lib64/libart.so (MterpHelpers+240) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #17 pc 0000000000403f64  /system/framework/framework.jar (offset 0x945000) (android.os.Looper.loop+1496)
      #18 pc 0000000000305bb0  /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.13231680141516411457)+268) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #19 pc 000000000030dba0  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+200) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #20 pc 000000000030ef88  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, true>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+1772) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #21 pc 0000000000177f40  /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<true, false>(art::interpreter::SwitchImplContext*)+57848) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #22 pc 000000000013f7d8  /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #23 pc 00000000001b4898  /system/framework/framework.jar (android.app.ActivityThread.main)
      #24 pc 0000000000305cb8  /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.13231680141516411457)+532) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #25 pc 000000000066bd68  /apex/com.android.art/lib64/libart.so (artQuickToInterpreterBridge+780) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #26 pc 000000000013cff8  /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #27 pc 00000000001337e8  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #28 pc 00000000001a8a94  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+228) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #29 pc 00000000005562a8  /apex/com.android.art/lib64/libart.so (art::InvokeMethod(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jobject*, _jobject*, unsigned long)+1364) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #30 pc 00000000004d53c0  /apex/com.android.art/lib64/libart.so (art::Method_invoke(_JNIEnv*, _jobject*, _jobject*, _jobjectArray*)+52) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #31 pc 00000000000937f4  /apex/com.android.art/javalib/arm64/boot.oat (art_jni_trampoline+180) (BuildId: 116ef9131fea789a2381b0a3347dcdf92c8d0416)
      #32 pc 0000000000133564  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+548) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #33 pc 00000000001a8a78  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #34 pc 0000000000318288  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+376) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #35 pc 000000000030e5b4  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+996) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #36 pc 000000000067d050  /apex/com.android.art/lib64/libart.so (MterpInvokeVirtual+848) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #37 pc 000000000012d814  /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #38 pc 0000000000539e9a  /system/framework/framework.jar (offset 0x127d000) (com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run+22)
      #39 pc 0000000000305bb0  /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.13231680141516411457)+268) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #40 pc 000000000066bd68  /apex/com.android.art/lib64/libart.so (artQuickToInterpreterBridge+780) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #41 pc 000000000013cff8  /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #42 pc 00000000008fd0b4  /system/framework/arm64/boot-framework.oat (com.android.internal.os.ZygoteInit.main+2756) (BuildId: a9968a8b8b9e74713c33cd6a14b6f1060cd7e6fc)
      #43 pc 00000000001337e8  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #44 pc 00000000001a8a94  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+228) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #45 pc 0000000000554ce4  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeWithVarArgs<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, std::__va_list)+448) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #46 pc 0000000000555198  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list)+92) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #47 pc 0000000000438fc8  /apex/com.android.art/lib64/libart.so (art::JNI<true>::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, std::__va_list)+656) (BuildId: b2950014fddab380a9bebef52fe2d1c3)
      #48 pc 000000000009c424  /system/lib64/libandroid_runtime.so (_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...)+124) (BuildId: a54426a2b2bfe5ad975341aa6c0e7841)
      #49 pc 00000000000a4160  /system/lib64/libandroid_runtime.so (android::AndroidRuntime::start(char const*, android::Vector<android::String8> const&, bool)+856) (BuildId: a54426a2b2bfe5ad975341aa6c0e7841)
      #50 pc 0000000000003674  /system/bin/app_process64 (main+1580) (BuildId: 9349370b830e2b77b835dee3aff71480)
      #51 pc 0000000000073a5c  /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+108) (BuildId: 1ca28d785d6567d2b225cf978ef04de5)

iOS

Assertion failed: (p->setRenderAPI && "NOT IMPLEMENTED! Runtime version < build version?"), function setRenderAPI, file Player.h, line 602.
* thread #1, stop reason = signal SIGABRT
    frame #0: 0x00000001b8db2964
->  0x1b8db2964: b.lo   0x1b8db2984
    0x1b8db2968: pacibsp 
    0x1b8db296c: stp    x29, x30, [sp, #-0x10]!
    0x1b8db2970: mov    x29, sp
Target 0: (Runner) stopped.

[wang-bin]

不是必现的？

[doersoul]

不是必现的？

基本必现，只要上下滚动的快的话。从日志中可以定位的原因么，不行的话，我再写个简单的例子试下

[wang-bin]

ios也同样的错误？这个错误对于日志里的函数不可能出现才对。只有加新接口了用新sdk编译老sdk运行才有可能出现在新接口调用里

[doersoul]

ios也同样的错误？这个错误对于日志里的函数不可能出现才对。只有加新接口了用新sdk编译老sdk运行才有可能出现在新接口调用里

iOS 也有，我试了clean项目和 pub-cache 也不行，等我有时间，新建个项目试下

[doersoul]

所有缓存都清了，新建了一个项目测试也不行，先执行pause再dispose也不行

和这个有关系吗？

I/flutter (24555): [IMPORTANT:flutter/shell/platform/android/platform_view_android.cc(361)] Flutter recommends migrating plugins that create and register surface textures to the new surface producer API. See https://docs.flutter.dev/release/breaking-changes/android-surface-plugins

I/flutter (24555): [IMPORTANT:flutter/shell/platform/android/platform_view_android.cc(361)] Flutter recommends migrating plugins that create and register surface textures to the new surface producer API. See https://docs.flutter.dev/release/breaking-changes/android-surface-plugins
E/libEGL  (24555): Invalid file path for libcolorx-loader.so
E/libEGL  (24555): Invalid file path for libcolorx-loader.so
I/chatty  (24555): uid=10472(com.example.fvp_demo) identical 2 lines
E/libEGL  (24555): Invalid file path for libcolorx-loader.so
E/libEGL  (24555): Invalid file path for libcolorx-loader.so
I/chatty  (24555): uid=10472(com.example.fvp_demo) identical 14 lines
E/libEGL  (24555): Invalid file path for libcolorx-loader.so
E/libEGL  (24555): Invalid file path for libcolorx-loader.so
I/chatty  (24555): uid=10472(com.example.fvp_demo) identical 5 lines
E/libEGL  (24555): Invalid file path for libcolorx-loader.so
E/libEGL  (24555): Invalid file path for libcolorx-loader.so
F/libc    (24555): /Users/doer/Documents/code/flutter/fvp/android/mdk-sdk/include/mdk/Player.h:370: void mdk::Player::updateNativeSurface(void *, int, int, SurfaceType): assertion "p->updateNativeSurface && "NOT IMPLEMENTED! Runtime version < build version?"" failed
F/libc    (24555): Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 24555 (xample.fvp_demo), pid 24555 (xample.fvp_demo)
Process name is com.example.fvp_demo, not key_process
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'OPPO/PCCM00/OP46C3:11/RKQ1.200928.002/1617017204685:user/release-keys'
Revision: '0'
ABI: 'arm64'
Timestamp: 2025-12-29 23:16:27+0800
pid: 24555, tid: 24555, name: xample.fvp_demo  >>> com.example.fvp_demo <<<
uid: 10472
signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
Abort message: '/Users/doer/Documents/code/flutter/fvp/android/mdk-sdk/include/mdk/Player.h:370: void mdk::Player::updateNativeSurface(void *, int, int, SurfaceType): assertion "p->updateNativeSurface && "NOT IMPLEMENTED! Runtime version < build version?"" failed'

[wang-bin]

跟缓存没关系，c结构体里的函数指针是空，我不清楚为什么会这样，不可能发生。你发个ios崩溃日志和backtrace看看。

[doersoul]

iOS backtrace

->  0x1017b71d8: ldr    x0, [x19, #0x8]         Thread 1: EXC_BAD_ACCESS (code=1, address=0x80000000100ecc08)             
    0x1017b71dc: mov    w23, #0x1                 ; =1 
    0x1017b71e0: mov    x1, x20
    0x1017b71e4: bl     0x10181f32c
    0x1017b71e8: mov    x21, x0
    0x1017b71ec: ldr    x0, [x0, #0x8]
    0x1017b71f0: cbz    x0, 0x1017b71fc
    0x1017b71f4: bl     0x10181ad30

dyld`start:
    0x1002a581c <+0>:   pacibsp 
    0x1002a5820 <+4>:   sub    sp, sp, #0x150
    0x1002a5824 <+8>:   stp    x22, x21, [sp, #0x120]
    0x1002a5828 <+12>:  stp    x20, x19, [sp, #0x130]
    0x1002a582c <+16>:  stp    x29, x30, [sp, #0x140]
    0x1002a5830 <+20>:  add    x29, sp, #0x140
    0x1002a5834 <+24>:  mov    x20, x0
    0x1002a5838 <+28>:  stp    xzr, xzr, [sp]
    0x1002a583c <+32>:  mov    w0, #0x34                 ; =52 
    0x1002a5840 <+36>:  movk   w0, #0x1f07, lsl #16
    0x1002a5844 <+40>:  mov    x1, #0x0                  ; =0 
    0x1002a5848 <+44>:  mov    x2, #0x0                  ; =0 
    0x1002a584c <+48>:  mov    x3, #0x0                  ; =0 
    0x1002a5850 <+52>:  mov    x4, #0x0                  ; =0 
    0x1002a5854 <+56>:  mov    x5, #0x0                  ; =0 
    0x1002a5858 <+60>:  mov    x6, #0x0                  ; =0 
    0x1002a585c <+64>:  bl     0x10028f5f0               ; dyld3::kdebug_trace_dyld_marker(unsigned int, dyld3::kt_arg, dyld3::kt_arg, dyld3::kt_arg, dyld3::kt_arg)
    0x1002a5860 <+68>:  adrp   x19, -25
    0x1002a5864 <+72>:  add    x19, x19, #0x0
    0x1002a5868 <+76>:  mov    x0, x19
    0x1002a586c <+80>:  bl     0x10028f1e4               ; dyld3::MachOFile::hasChainedFixups() const
    0x1002a5870 <+84>:  tbz    w0, #0x0, 0x1002a5a50     ; <+564>
    0x1002a5874 <+88>:  sub    x21, x29, #0x50
    0x1002a5878 <+92>:  stp    xzr, x21, [x29, #-0x50]
    0x1002a587c <+96>:  adrp   x8, 52
    0x1002a5880 <+100>: ldr    d0, [x8, #0xde8]
    0x1002a5884 <+104>: stur   d0, [x29, #-0x40]
    0x1002a5888 <+108>: add    x8, x21, #0x18
    0x1002a588c <+112>: adrp   x16, 1
    0x1002a5890 <+116>: add    x16, x16, #0x824          ; __Block_byref_object_copy_
    0x1002a5894 <+120>: pacia  x16, x8
    0x1002a5898 <+124>: stur   x16, [x29, #-0x38]
    0x1002a589c <+128>: add    x8, x21, #0x20
    0x1002a58a0 <+132>: adrp   x16, 1
    0x1002a58a4 <+136>: add    x16, x16, #0x830          ; __Block_byref_object_dispose_
    0x1002a58a8 <+140>: pacia  x16, x8
    0x1002a58ac <+144>: stur   x16, [x29, #-0x30]
    0x1002a58b0 <+148>: add    x0, x21, #0x28
    0x1002a58b4 <+152>: mov    w1, #0x0                  ; =0 
    0x1002a58b8 <+156>: bl     0x10028d970               ; Diagnostics::Diagnostics(bool)
    0x1002a58bc <+160>: ldur   x8, [x29, #-0x48]
    0x1002a58c0 <+164>: add    x1, x8, #0x28
    0x1002a58c4 <+168>: sub    x8, x29, #0x88
    0x1002a58c8 <+172>: adrp   x16, 75
    0x1002a58cc <+176>: add    x16, x16, #0x310          ; _NSConcreteStackBlock
    0x1002a58d0 <+180>: mov    x17, x8
    0x1002a58d4 <+184>: movk   x17, #0x6ae1, lsl #48
    0x1002a58d8 <+188>: pacda  x16, x17
    0x1002a58dc <+192>: stur   x16, [x29, #-0x88]
    0x1002a58e0 <+196>: adrp   x9, 52
    0x1002a58e4 <+200>: ldr    d0, [x9, #0xdf0]
    0x1002a58e8 <+204>: stur   d0, [x29, #-0x80]
    0x1002a58ec <+208>: add    x8, x8, #0x10
    0x1002a58f0 <+212>: adrp   x16, 1
    0x1002a58f4 <+216>: add    x16, x16, #0x838          ; __�start_block_invoke
    0x1002a58f8 <+220>: pacia  x16, x8
    0x1002a58fc <+224>: adrp   x8, 63
    0x1002a5900 <+228>: add    x8, x8, #0x1d0            ; __block_descriptor_tmp
    0x1002a5904 <+232>: stp    x16, x8, [x29, #-0x78]
    0x1002a5908 <+236>: stp    x21, x19, [x29, #-0x68]
    0x1002a590c <+240>: stur   x19, [x29, #-0x58]
    0x1002a5910 <+244>: sub    x3, x29, #0x88
    0x1002a5914 <+248>: mov    x0, x19
    0x1002a5918 <+252>: mov    x2, #0x0                  ; =0 
    0x1002a591c <+256>: bl     0x10028f298               ; dyld3::MachOAnalyzer::withChainStarts(Diagnostics&, unsigned long long, void (dyld_chained_starts_in_image const*) block_pointer) const
    0x1002a5920 <+260>: ldur   x8, [x29, #-0x48]
    0x1002a5924 <+264>: add    x0, x8, #0x28
    0x1002a5928 <+268>: bl     0x100293140               ; Diagnostics::assertNoError() const
    0x1002a592c <+272>: bl     0x10029e76c               ; mach_init
    0x1002a5930 <+276>: mov    x0, x20
    0x1002a5934 <+280>: bl     0x1002a7ae0               ; dyld4::KernelArgs::findApple() const
    0x1002a5938 <+284>: bl     0x1002c0bb0               ; __guard_setup
    0x1002a593c <+288>: mov    x0, x20
    0x1002a5940 <+292>: bl     0x1002a7ae0               ; dyld4::KernelArgs::findApple() const
    0x1002a5944 <+296>: bl     0x1002cdfe0               ; _subsystem_init
    0x1002a5948 <+300>: adrp   x21, 63
    0x1002a594c <+304>: add    x21, x21, #0x70           ; dyld4::sConfigBuffer
    0x1002a5950 <+308>: adrp   x2, 75
    0x1002a5954 <+312>: add    x2, x2, #0x300            ; dyld4::sSyscallDelegate
    0x1002a5958 <+316>: mov    x0, x21
    0x1002a595c <+320>: mov    x1, x20
    0x1002a5960 <+324>: bl     0x1002a7b9c               ; dyld4::ProcessConfig::ProcessConfig(dyld4::KernelArgs const*, dyld4::SyscallDelegate&)
    0x1002a5964 <+328>: add    x8, sp, #0x90
    0x1002a5968 <+332>: adrp   x16, 75
    0x1002a596c <+336>: add    x16, x16, #0x310          ; _NSConcreteStackBlock
    0x1002a5970 <+340>: mov    x17, x8
    0x1002a5974 <+344>: movk   x17, #0x6ae1, lsl #48
    0x1002a5978 <+348>: pacda  x16, x17
    0x1002a597c <+352>: str    x16, [sp, #0x90]
    0x1002a5980 <+356>: adrp   x9, 52
    0x1002a5984 <+360>: ldr    d0, [x9, #0xdf8]
    0x1002a5988 <+364>: str    d0, [sp, #0x98]
    0x1002a598c <+368>: add    x8, x8, #0x10
    0x1002a5990 <+372>: adrp   x16, 1
    0x1002a5994 <+376>: add    x16, x16, #0x880          ; __�start_block_invoke.3
    0x1002a5998 <+380>: pacia  x16, x8
    0x1002a599c <+384>: adrp   x8, 63
    0x1002a59a0 <+388>: add    x8, x8, #0x200            ; __block_descriptor_tmp.5
    0x1002a59a4 <+392>: stp    x16, x8, [sp, #0xa0]
    0x1002a59a8 <+396>: str    x19, [sp, #0xb0]
    0x1002a59ac <+400>: add    x1, sp, #0x90
    0x1002a59b0 <+404>: mov    x0, x19
    0x1002a59b4 <+408>: bl     0x100295cec               ; dyld3::MachOFile::forEachSegment(void (dyld3::MachOFile::SegmentInfo const&, bool&) block_pointer) const
    0x1002a59b8 <+412>: movi.2d v0, #0000000000000000
    0x1002a59bc <+416>: stp    q0, q0, [sp, #0x10]
    0x1002a59c0 <+420>: adrp   x8, 66
    0x1002a59c4 <+424>: add    x8, x8, #0xb78            ; _os_lock_type_unfair
    0x1002a59c8 <+428>: str    x8, [sp, #0x30]
    0x1002a59cc <+432>: adrp   x8, 52
    0x1002a59d0 <+436>: ldr    q1, [x8, #0xe10]
    0x1002a59d4 <+440>: stur   q1, [sp, #0x38]
    0x1002a59d8 <+444>: stur   q0, [sp, #0x48]
    0x1002a59dc <+448>: stur   q0, [sp, #0x58]
    0x1002a59e0 <+452>: stur   q0, [sp, #0x68]
    0x1002a59e4 <+456>: str    xzr, [sp, #0x78]
    0x1002a59e8 <+460>: mov    w8, #0x1                  ; =1 
    0x1002a59ec <+464>: str    w8, [sp, #0x80]
    0x1002a59f0 <+468>: add    x1, sp, #0x10
    0x1002a59f4 <+472>: mov    x0, x21
    0x1002a59f8 <+476>: bl     0x10029c640               ; dyld4::APIs::bootstrap(dyld4::ProcessConfig const&, dyld4::RuntimeLocks&)
    0x1002a59fc <+480>: mov    x19, x0
    0x1002a5a00 <+484>: bl     0x1002a68a8               ; dyld4::prepare(dyld4::APIs&, dyld3::MachOAnalyzer const*)
    0x1002a5a04 <+488>: mov    x20, x0
    0x1002a5a08 <+492>: mov    x0, x19
    0x1002a5a0c <+496>: bl     0x10029c094               ; dyld4::RuntimeState::decWritable()
    0x1002a5a10 <+500>: ldr    x8, [x19, #0x8]
    0x1002a5a14 <+504>: ldr    w0, [x8, #0x40]
    0x1002a5a18 <+508>: ldp    x1, x2, [x8, #0x48]
    0x1002a5a1c <+512>: ldr    x3, [x8, #0x58]
    0x1002a5a20 <+516>: blraaz x20
->  0x1002a5a24 <+520>: mov    x1, x0                         Thread 1: EXC_BAD_ACCESS (code=1, address=0x80000000100ecc08)
    0x1002a5a28 <+524>: ldr    x0, [x19, #0x68]
    0x1002a5a2c <+528>: ldr    x16, [x0]
    0x1002a5a30 <+532>: mov    x17, x0
    0x1002a5a34 <+536>: movk   x17, #0x9abf, lsl #48
    0x1002a5a38 <+540>: autda  x16, x17
    0x1002a5a3c <+544>: ldr    x8, [x16, #0x78]!
    0x1002a5a40 <+548>: mov    x9, x16
    0x1002a5a44 <+552>: mov    x17, x9
    0x1002a5a48 <+556>: movk   x17, #0x3448, lsl #48
    0x1002a5a4c <+560>: blraa  x8, x17
    0x1002a5a50 <+564>: adrp   x0, 53
    0x1002a5a54 <+568>: add    x0, x0, #0xc50            ; "start"
    0x1002a5a58 <+572>: adrp   x1, 53
    0x1002a5a5c <+576>: add    x1, x1, #0xc56            ; "dyldMain.cpp"
    0x1002a5a60 <+580>: adrp   x3, 53
    0x1002a5a64 <+584>: add    x3, x3, #0xc63            ; "dyldMA->hasChainedFixups()"
    0x1002a5a68 <+588>: mov    w2, #0x33f                ; =831 
    0x1002a5a6c <+592>: bl     0x1002d9230               ; __assert_rtn