学会黑科技，一招搞定 iOS 14.2 的 libffi crash

ffi_type *returnType = st_ffiTypeWithType(self.signature.returnType);NSAssert(returnType, @"can't find a ffi_type of %@", self.signature.returnType);
NSUInteger argumentCount = self->_argsCount;_args = malloc(sizeof(ffi_type *) * argumentCount) ;
for (int i = 0; i < argumentCount; i++) {  ffi_type* current_ffi_type = st_ffiTypeWithType(self.signature.argumentTypes[i]);  NSAssert(current_ffi_type, @"can't find a ffi_type of %@", self.signature.argumentTypes[i]);  _args[i] = current_ffi_type;}
// 创建 ffi 跳板用到的 closure_closure = ffi_closure_alloc(sizeof(ffi_closure), (void **)&xxx_func_ptr);
// 创建 cif，调用函数用到的参数和返回值的类型信息， 之后在调用时会结合call convention 处理参数和返回值if(ffi_prep_cif(&_cif, FFI_DEFAULT_ABI, (unsigned int)argumentCount, returnType, _args) == FFI_OK) {
        // closure 写入 跳板数据页  if (ffi_prep_closure_loc(_closure, &_cif, _st_ffi_function, (__bridge void *)(self), xxx_func_ptr) != FFI_OK) {    NSAssert(NO, @"genarate IMP failed");  }} else {  NSAssert(NO, @"");}

static ffi_trampoline_table *ffi_remap_trampoline_table_alloc (void){.....  /* Allocate two pages -- a config page and a placeholder page */  config_page = 0x0;  kt = vm_allocate (mach_task_self (), &config_page, PAGE_MAX_SIZE * 2,                    VM_FLAGS_ANYWHERE);  if (kt != KERN_SUCCESS)      return NULL;
  /* Allocate two pages -- a config page and a placeholder page */  //bdffc_closure_trampoline_table_page
  /* Remap the trampoline table on top of the placeholder page */  trampoline_page = config_page + PAGE_MAX_SIZE;  trampoline_page_template = (vm_address_t)&ffi_closure_remap_trampoline_table_page;#ifdef __arm__  /* bdffc_closure_trampoline_table_page can be thumb-biased on some ARM archs */  trampoline_page_template &= ~1UL;#endif  kt = vm_remap (mach_task_self (), &trampoline_page, PAGE_MAX_SIZE, 0x0,                 VM_FLAGS_OVERWRITE, mach_task_self (), trampoline_page_template,                 FALSE, &cur_prot, &max_prot, VM_INHERIT_SHARE);  if (kt != KERN_SUCCESS)  {      vm_deallocate (mach_task_self (), config_page, PAGE_MAX_SIZE * 2);      return NULL;  }

  /* We have valid trampoline and config pages */  table = calloc (1, sizeof (ffi_trampoline_table));  table->free_count = FFI_REMAP_TRAMPOLINE_COUNT/2;  table->config_page = config_page;  table->trampoline_page = trampoline_page;
......  return table;}

ffi_statusffi_prep_closure_loc (ffi_closure *closure,                      ffi_cif* cif,                      void (*fun)(ffi_cif*,void*,void**,void*),                      void *user_data,                      void *codeloc){......  if (cif->flags & AARCH64_FLAG_ARG_V)      start = ffi_closure_SYSV_V; // ffi 对 closure的处理函数  else      start = ffi_closure_SYSV;
  void **config = (void**)((uint8_t *)codeloc - PAGE_MAX_SIZE);  config[0] = closure;  config[1] = start;......}

adr x16, -PAGE_MAX_SIZEldp x17, x16, [x16]br x16nop

# 动态remap的 page.align PAGE_MAX_SHIFTCNAME(ffi_closure_remap_trampoline_table_page):.rept PAGE_MAX_SIZE / FFI_TRAMPOLINE_SIZE  # 这是我们的 trampoline entry, 就是ffi生成的函数指针  adr x16, -PAGE_MAX_SIZE                         // 将pc地址减去PAGE_MAX_SIZE, 找到 trampoine data entry  ldp x17, x16, [x16]                             // 加载我们写入的 closure, start 到 x17, x16  br x16                                          // 跳转到 start 函数  nop        /* each entry in the trampoline config page is 2*sizeof(void*) so the trampoline itself cannot be smaller that 16 bytes */.endr

# 静态分配的page#ifdef __MACH__#include <mach/machine/vm_param.h>
.align 14.data.global _ffi_static_trampoline_data_page1_ffi_static_trampoline_data_page1:    .space PAGE_MAX_SIZE*5.align PAGE_MAX_SHIFT.textCNAME(_ffi_static_trampoline_page1):
_ffi_local_forwarding_bridge:adrp x17, ffi_closure_static_trampoline_table_page_start@PAGE;// text pagesub  x16, x16, x17;// offsetadrp x17, _ffi_static_trampoline_data_page1@PAGE;// data pageadd x16, x16, x17;// data addressldp x17, x16, [x16];// x17 closure x16 startbr x16nopnop.align PAGE_MAX_SHIFTCNAME(ffi_closure_static_trampoline_table_page):
#这个label 用来adrp@PAGE 计算 trampoline 到 trampoline page的offset#留了5个用来调试。# 我们static trampoline 两条指令就够了，这里使用4个，和remap的保持一致ffi_closure_static_trampoline_table_page_start:adr x16, #0b _ffi_local_forwarding_bridgenopnop
adr x16, #0b _ffi_local_forwarding_bridgenopnop
adr x16, #0b _ffi_local_forwarding_bridgenopnop
adr x16, #0b _ffi_local_forwarding_bridgenopnop
adr x16, #0b _ffi_local_forwarding_bridgenopnop
// 5 * 4.rept (PAGE_MAX_SIZE*5-5*4) / FFI_TRAMPOLINE_SIZEadr x16, #0b _ffi_local_forwarding_bridgenopnop.endr
.globl CNAME(ffi_closure_static_trampoline_table_page)FFI_HIDDEN(CNAME(ffi_closure_static_trampoline_table_page))#ifdef __ELF__        .type        CNAME(ffi_closure_static_trampoline_table_page), #function        .size        CNAME(ffi_closure_static_trampoline_table_page), . - CNAME(ffi_closure_static_trampoline_table_page)#endif#endif