Radar: Accessibility-based Tools crash app running in iOS 7 Simulator

This bug in iOS Simulator is interesting because it is the first bug we found where a crash in a simulated iOS app can be triggered by having a Mac app using Accessibility running outside of the simulator. I filed it and am reporting on this here because I’ve gotten this as issue on my project now two times.

Submitted as rdar://15478255 and to OpenRadar.

Summary

If you enable the accessibility inspector you can cause crashes on UIViews which implement custom accessibility elements.

Steps to Reproduce:

• Get the sample project
  git clone –recursive https://github.com/Cocoanetics/DTCoreText.git
• enable the Accessibility inspector on the iOS 7 simulator, General – Accessibility
• Build&Run the DemoApp target of the project
• Double-Click on the first entry that says “README”
• Double-Click on the Portrait Photo
• Swipe and click wildly around on the view

Expected Results

• No crash

Actual Results

Crash with the following stack trace:

2013-11-15 10:44:10.533 RTDemoApp[1536:70b] *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '-[DTAttributedTextContentView superlayer]: unrecognized selector sent to instance 0xa696bf0'
*** First throw call stack:
(
	0   CoreFoundation                      0x034e35e4 __exceptionPreprocess + 180
	1   libobjc.A.dylib                     0x024578b6 objc_exception_throw + 44
	2   CoreFoundation                      0x03580903 -[NSObject(NSObject) doesNotRecognizeSelector:] + 275
	3   CoreFoundation                      0x034d390b ___forwarding___ + 1019
	4   CoreFoundation                      0x034d34ee _CF_forwarding_prep_0 + 14
	5   QuartzCore                          0x01db0804 -[CALayer(CALayerPrivate) ancestorSharedWithLayer:] + 63
	6   QuartzCore                          0x01da56cc _ZN2CA5Layer12map_geometryEP7CALayerS2_PFvPvRKNS_4Mat4IdEEES9_S3_ + 80
	7   QuartzCore                          0x01da5c95 -[CALayer convertPoint:toLayer:] + 77
	8   UIKit                               0x00b03271 -[UIView(Geometry) convertPoint:toView:] + 112
	9   UIAccessibility                     0x0bf8e70f -[NSObject(AXPrivCategory) _accessibilityBaseHitTest:withEvent:] + 2047
	10  UIAccessibility                     0x0bf8da4e -[NSObject(AXPrivCategory) _accessibilityHitTest:withEvent:] + 62
	11  UIKit                               0x0fcca3b2 -[UIViewAccessibility(SafeCategory) _accessibilityHitTest:withEvent:] + 140
	12  UIKit                               0x0fcc9a9c -[UIViewAccessibility(SafeCategory) __accessibilityHitTest:withEvent:] + 1231
	13  UIKit                               0x0fcca37f -[UIViewAccessibility(SafeCategory) _accessibilityHitTest:withEvent:] + 89
	14  UIKit                               0x0fcc9a9c -[UIViewAccessibility(SafeCategory) __accessibilityHitTest:withEvent:] + 1231
	15  UIKit                               0x0fcca37f -[UIViewAccessibility(SafeCategory) _accessibilityHitTest:withEvent:] + 89
	16  UIKit                               0x0fcc9a9c -[UIViewAccessibility(SafeCategory) __accessibilityHitTest:withEvent:] + 1231
	17  UIKit                               0x0fcca37f -[UIViewAccessibility(SafeCategory) _accessibilityHitTest:withEvent:] + 89
	18  UIKit                               0x0fcc9a9c -[UIViewAccessibility(SafeCategory) __accessibilityHitTest:withEvent:] + 1231
	19  UIKit                               0x0fcca37f -[UIViewAccessibility(SafeCategory) _accessibilityHitTest:withEvent:] + 89
	20  UIKit                               0x0fcc9a9c -[UIViewAccessibility(SafeCategory) __accessibilityHitTest:withEvent:] + 1231
	21  UIKit                               0x0fcca37f -[UIViewAccessibility(SafeCategory) _accessibilityHitTest:withEvent:] + 89
	22  UIKit                               0x0fcc9a9c -[UIViewAccessibility(SafeCategory) __accessibilityHitTest:withEvent:] + 1231
	23  UIKit                               0x0fcca37f -[UIViewAccessibility(SafeCategory) _accessibilityHitTest:withEvent:] + 89
	24  UIAccessibility                     0x0bf88b6d _copyElementAtPositionCallback + 1357
	25  AXRuntime                           0x0e76fa3d _AXXMIGCopyElementAtPosition + 170
	26  AXRuntime                           0x0e76a97b _XCopyElementAtPosition + 340
	27  AXRuntime                           0x0e7756c8 mshMIGPerform + 256
	28  CoreFoundation                      0x0345ed65 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 53
	29  CoreFoundation                      0x0345ea9b __CFRunLoopDoSource1 + 523
	30  CoreFoundation                      0x0348977c __CFRunLoopRun + 2156
	31  CoreFoundation                      0x03488ac3 CFRunLoopRunSpecific + 467
	32  CoreFoundation                      0x034888db CFRunLoopRunInMode + 123
	33  GraphicsServices                    0x038bb9e2 GSEventRunModal + 192
	34  GraphicsServices                    0x038bb809 GSEventRun + 104
	35  UIKit                               0x00aabd3b UIApplicationMain + 1225
	36  RTDemoApp                           0x0000b9f6 main + 134
	37  RTDemoApp                           0x00002b25 start + 53
)
libc++abi.dylib: terminating with uncaught exception of type NSException

Regression

This occurs only on the iOS 7 simulator, not on iOS 6 simulator.

Notes

There is no method -[UIView superlayer], yet accessibility hit testing wants to call it from -[CALayer(CALayerPrivate) ancestorSharedWithLayer:]

An alternative method to reproduce this is to enable the BetterTouchTool which seems to also enable some sort of Accessibility inside iOS simulator.