Crash With iOS Private API Call - objective-c

Question

This call:
[UIKeyboardImpl(ShortcutConversionSupport) _shortcutConversionCandidateForInput:]
is crashing my app. Googling and looking through Apple's API documentation brings up no results. I have never seen this call being made anywhere in my app. I also put a break-point at the location I believe it is getting called at. Here is the crash report:
(FYI, the crash log could not be completely symbolicated even when using the correct dSYM file. No idea why)
Last Exception Backtrace:
0 CoreFoundation 0x327e188f __exceptionPreprocess + 163
1 libobjc.A.dylib 0x34837259 objc_exception_throw + 33
2 CoreFoundation 0x327e1789 +[NSException raise:format:] + 1
3 CoreFoundation 0x327e17ab +[NSException raise:format:] + 35
4 CoreFoundation 0x3273bf5b -[__NSCFString substringWithRange:] + 103
5 Buffer 0x000fa061 0xd6000 + 147553
6 UIKit 0x32348137 -[UIKeyboardImpl(ShortcutConversionSupport) _shortcutConversionCandidateForInput:] + 615
7 UIKit 0x32322c07 -[UIKeyboardImpl addInputString:fromVariantKey:] + 287
8 UIKit 0x32322ae1 -[UIKeyboardImpl handleStringInput:fromVariantKey:] + 165
9 UIKit 0x32321829 -[UIKeyboardImpl handleKeyEvent:] + 1501
10 UIKit 0x02b10261 0x2af4000 + 115297
11 UIKit 0x324bb8a3 -[UIKeyboardLayoutStar sendStringAction:forKey:isPopupVariant:] + 487
12 UIKit 0x3231fdcd -[UIKeyboardLayoutStar touchUp:] + 3197
13 UIKit 0x02b2ab47 0x2af4000 + 224071
14 UIKit 0x3231f0fd -[UIKeyboardLayout touchesEnded:withEvent:] + 381
15 UIKit 0x3222292b -[UIWindow _sendTouchesForEvent:] + 319
16 UIKit 0x32222319 -[UIWindow sendEvent:] + 381
17 UIKit 0x32208695 -[UIApplication sendEvent:] + 357
18 UIKit 0x32207f3b _UIApplicationHandleEvent + 5827
19 GraphicsServices 0x3188f22b PurpleEventCallback + 883
20 CoreFoundation 0x327b5523 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 39
21 CoreFoundation 0x327b54c5 __CFRunLoopDoSource1 + 141
22 CoreFoundation 0x327b4313 __CFRunLoopRun + 1371
23 CoreFoundation 0x327374a5 CFRunLoopRunSpecific + 301
24 CoreFoundation 0x3273736d CFRunLoopRunInMode + 105
25 GraphicsServices 0x3188e439 GSEventRunModal + 137
26 UIKit 0x32236cd5 UIApplicationMain + 1081
27 Buffer 0x000d8327 0xd6000 + 8999
28 Buffer 0x000d7dcc 0xd6000 + 7628
I understand that is crashing at substringWithRange: but when does this particular ShortcutConversionSupport method get called? I believe that will help me isolate the issue.

Answer 1

This is the issue:
- (UITextRange *)textRangeFromPosition:(UITextPosition *)fromPosition toPosition:(UITextPosition *)toPosition
{
// Generate IndexedPosition instances that wrap the to and from ranges
IndexedPosition *from = (IndexedPosition *)fromPosition;
IndexedPosition *to = (IndexedPosition *)toPosition;
NSRange range = NSMakeRange(MIN(from.index, to.index), ABS(to.index - from.index));
return [IndexedRange rangeWithNSRange:range];
}
More specifically: ABS(to.index - from.index)
The issue is that the compiler thinks that the product of this negation is a NSUInteger because to.index and from.index are both NSUInteger variables (so the value can never be negative). Therefore, if from.index > to.index the value would overflow producing a value that is the max size of a 32 bit uint rather than a negative value. Also note, ABS uses typeof to determine the return value of the product. This is the fix:
- (UITextRange *)textRangeFromPosition:(UITextPosition *)fromPosition toPosition:(UITextPosition *)toPosition
{
IndexedPosition *from = (IndexedPosition *)fromPosition;
IndexedPosition *to = (IndexedPosition *)toPosition;
NSInteger index = to.index - from.index;
NSRange range = NSMakeRange(MIN(from.index, to.index), ABS(index));
return [IndexedRange rangeWithNSRange:range];
}
By the way, this only occurs when a user has removed all of the Shortcuts in Settings > General > Keyboard > Shortcuts.