Kids Paint (com.phyzios.PhyziosKidsPaint, armv7) crashed with:
+[NSPropertyListSerialization propertyListFromData:mutabilityOption:format:errorDescription:]:
unrecognized selector sent to instance 0x10127c6c
The selector is present in Generator/templates/generated.plist, so the
signature table is fine. The generator drops it while emitting code.
Cause
An id * out parameter is spelled either bare (^@) or qualified with the
out modifier (o^@). MethodParameter -declaration,
-parameterToBePassed and -postCall switch on the raw first byte of the
encoding. For o^@ that byte is o, so no pointer case matches and all
three fall through to /* unhandled type */.
MethodBuilder then wraps the whole method in #if 0, so the
@implementation survives, the build succeeds, and the only trace is a
-Wincomplete-implementation warning buried in the build output. The method
is absent at run time and the guest aborts the first time that selector is
sent — for a deprecated API that can be minutes into a session.
This affects every NSError ** and errorDescription: parameter spelled
with the qualifier.
Fix
Adding an objectOutPointerSignature check ahead of the three raw switches
brings back 25 methods: NSPropertyListSerialization (7), the
-getObjectValue:forString:errorDescription: formatters (13),
NSURL -getResourceValue:forKey:error:, NSCalendar, NSNetService,
CNContactFormatter. It emits exactly the code the bare spelling already
produced, so ^@ is untouched. Unique -Wincomplete-implementation
warnings went 446 → 435, nothing regressed.
r^@ / n^@ are left excluded (an encoding cannot tell a single object
from a caller-provided array), and N^@ too (the host cell is zeroed rather
than seeded).
Related
The generator now prints how many methods it disabled
(Disabled 1839 methods with unhandled types), with a ratchet test, so the
next encoding to lose its bridge shows up at generation time rather than in
a crash log.
A more detailed write-up is in FORK_NOTES.md on my fork:
https://github.com/Nsan736/LiveExec32/blob/dev/FORK_NOTES.md
Investigated and fixed with Claude Code (Opus 5).
Verified on iPad 9 / iPadOS 26.6 / LiveContainer with JIT.
Kids Paint (
com.phyzios.PhyziosKidsPaint, armv7) crashed with:The selector is present in
Generator/templates/generated.plist, so thesignature table is fine. The generator drops it while emitting code.
Cause
An
id *out parameter is spelled either bare (^@) or qualified with theoutmodifier (o^@).MethodParameter -declaration,-parameterToBePassedand-postCallswitch on the raw first byte of theencoding. For
o^@that byte iso, so no pointer case matches and allthree fall through to
/* unhandled type */.MethodBuilderthen wraps the whole method in#if 0, so the@implementationsurvives, the build succeeds, and the only trace is a-Wincomplete-implementationwarning buried in the build output. The methodis absent at run time and the guest aborts the first time that selector is
sent — for a deprecated API that can be minutes into a session.
This affects every
NSError **anderrorDescription:parameter spelledwith the qualifier.
Fix
Adding an
objectOutPointerSignaturecheck ahead of the three raw switchesbrings back 25 methods:
NSPropertyListSerialization(7), the-getObjectValue:forString:errorDescription:formatters (13),NSURL -getResourceValue:forKey:error:,NSCalendar,NSNetService,CNContactFormatter. It emits exactly the code the bare spelling alreadyproduced, so
^@is untouched. Unique-Wincomplete-implementationwarnings went 446 → 435, nothing regressed.
r^@/n^@are left excluded (an encoding cannot tell a single objectfrom a caller-provided array), and
N^@too (the host cell is zeroed ratherthan seeded).
Related
The generator now prints how many methods it disabled
(
Disabled 1839 methods with unhandled types), with a ratchet test, so thenext encoding to lose its bridge shows up at generation time rather than in
a crash log.
A more detailed write-up is in FORK_NOTES.md on my fork:
https://github.com/Nsan736/LiveExec32/blob/dev/FORK_NOTES.md
Investigated and fixed with Claude Code (Opus 5).
Verified on iPad 9 / iPadOS 26.6 / LiveContainer with JIT.