崩溃-治理

// 崩溃示例
NSArray *array = @[@1, @2, @3];
id obj = array[10];  // NSRangeException

// 修复方案1：边界检查
- (id)safeObjectAtIndex:(NSUInteger)index fromArray:(NSArray *)array {
    if (index < array.count) {
        return array[index];
    }
    return nil;
}

// 修复方案2：分类安全方法
@implementation NSArray (Safe)

- (id)safeObjectAtIndex:(NSUInteger)index {
    if (index < self.count) {
        return [self objectAtIndex:index];
    }
    return nil;
}

@end

// 修复方案3：Swift可选绑定
extension Array {
    subscript(safe index: Index) -> Element? {
        return indices.contains(index) ? self[index] : nil
    }
}

// 使用
let value = array[safe: 10]  // 返回nil而不是崩溃

// 崩溃示例
NSMutableDictionary *dict = [NSMutableDictionary dictionary];
NSString *value = nil;
[dict setObject:value forKey:@"key"];  // NSInvalidArgumentException

// 修复方案1：nil检查
- (void)setObject:(id)object forKey:(id)key inDict:(NSMutableDictionary *)dict {
    if (object && key) {
        dict[key] = object;
    }
}

// 修复方案2：分类安全方法
@implementation NSMutableDictionary (Safe)

- (void)safeSetObject:(id)object forKey:(id)key {
    if (object && key) {
        [self setObject:object forKey:key];
    }
}

@end

// 修复方案3：使用NSNull
dict[@"key"] = value ?: [NSNull null];

// 崩溃示例
NSString *str = @"hello";
[str performSelector:@selector(count)];  // unrecognized selector

// 修复方案1：respondsToSelector检查
if ([obj respondsToSelector:@selector(someMethod)]) {
    [obj performSelector:@selector(someMethod)];
}

// 修复方案2：消息转发防护
@implementation NSObject (CrashProtection)

+ (void)load {
    // Hook forwardingTargetForSelector:
    Method original = class_getInstanceMethod(self, @selector(forwardingTargetForSelector:));
    Method swizzled = class_getInstanceMethod(self, @selector(safe_forwardingTargetForSelector:));
    method_exchangeImplementations(original, swizzled);
}

- (id)safe_forwardingTargetForSelector:(SEL)aSelector {
    // 如果找不到方法，返回一个空实现的对象
    id target = [self safe_forwardingTargetForSelector:aSelector];
    if (target) return target;
    
    // 记录错误
    NSLog(@"Unrecognized selector: %@ on %@", NSStringFromSelector(aSelector), self);
    
    // 返回一个能处理任何消息的对象
    return [CrashStub shared];
}

@end

// 崩溃场景1：重复移除观察者
[obj removeObserver:self forKeyPath:@"value"];
[obj removeObserver:self forKeyPath:@"value"];  // 崩溃

// 崩溃场景2：未移除观察者就释放
- (void)dealloc {
    // 忘记移除观察者
}

// 修复方案：安全的KVO封装
@interface SafeKVOProxy : NSObject
@property (nonatomic, weak) id observer;
@property (nonatomic, weak) id target;
@property (nonatomic, copy) NSString *keyPath;
@property (nonatomic, copy) void (^callback)(id newValue);
@end

@implementation SafeKVOProxy

- (instancetype)initWithTarget:(id)target 
                       keyPath:(NSString *)keyPath 
                      observer:(id)observer
                      callback:(void (^)(id))callback {
    self = [super init];
    if (self) {
        _target = target;
        _keyPath = keyPath;
        _observer = observer;
        _callback = callback;
        
        [target addObserver:self forKeyPath:keyPath options:NSKeyValueObservingOptionNew context:NULL];
    }
    return self;
}

- (void)observeValueForKeyPath:(NSString *)keyPath 
                      ofObject:(id)object 
                        change:(NSDictionary *)change 
                       context:(void *)context {
    if (self.callback) {
        self.callback(change[NSKeyValueChangeNewKey]);
    }
}

- (void)dealloc {
    [_target removeObserver:self forKeyPath:_keyPath];
}

@end

// 崩溃场景：非线程安全的集合操作
// 线程1
[mutableArray addObject:obj1];
// 线程2
[mutableArray removeObjectAtIndex:0];  // 可能崩溃

// 修复方案1：加锁
@property (nonatomic, strong) NSLock *arrayLock;

- (void)safeAddObject:(id)object {
    [self.arrayLock lock];
    [self.mutableArray addObject:object];
    [self.arrayLock unlock];
}

// 修复方案2：使用GCD串行队列
@property (nonatomic, strong) dispatch_queue_t arrayQueue;

- (void)safeAddObject:(id)object {
    dispatch_sync(self.arrayQueue, ^{
        [self.mutableArray addObject:object];
    });
}

// 修复方案3：使用Actor（Swift Concurrency）
actor SafeStorage {
    private var items: [Any] = []
    
    func append(_ item: Any) {
        items.append(item)
    }
    
    func remove(at index: Int) {
        guard index < items.count else { return }
        items.remove(at: index)
    }
    
    func getAll() -> [Any] {
        return items
    }
}

let storage = SafeStorage()
await storage.append(obj1)

// 崩溃场景
__unsafe_unretained id unsafeRef = obj;
obj = nil;
[unsafeRef description];  // EXC_BAD_ACCESS

// 修复方案1：使用weak而非unsafe_unretained
__weak id weakRef = obj;
obj = nil;
[weakRef description];  // 安全，weakRef为nil

// 修复方案2：Zombie Objects检测（调试用）
// 在Scheme中启用Zombie Objects

// 修复方案3：野指针检测工具
// 使用Address Sanitizer
// Product -> Scheme -> Edit Scheme -> Diagnostics -> Address Sanitizer

// 崩溃示例
let value: String? = nil
print(value!)  // Fatal error: Unexpectedly found nil

// 修复方案1：可选绑定
if let value = optionalValue {
    print(value)
}

// 修复方案2：空合运算符
let value = optionalValue ?? "default"

// 修复方案3：guard语句
guard let value = optionalValue else {
    return
}
print(value)

// 修复方案4：可选链
let length = optionalString?.count  // 返回Int?

#import <mach/mach.h>
#import <os/proc.h>

typedef struct {
    uint64_t footprint;   // 当前进程占用（= Xcode Memory Gauge）
    uint64_t available;   // 当前进程还可申请的内存
    uint64_t limit;       // 当前进程 OOM 阈值
    double   pressure;    // footprint / limit
} MemorySnapshot;

static MemorySnapshot MemoryQuerySnapshot(void) {
    MemorySnapshot s = {0};
    task_vm_info_data_t info;
    mach_msg_type_number_t count = TASK_VM_INFO_COUNT;
    if (task_info(mach_task_self(), TASK_VM_INFO, (task_info_t)&info, &count) == KERN_SUCCESS) {
        s.footprint = info.phys_footprint;
    }
    if (@available(iOS 13.0, *)) {
        s.available = os_proc_available_memory();
        s.limit = s.footprint + s.available;
    }
    s.pressure = s.limit > 0 ? (double)s.footprint / (double)s.limit : 0;
    return s;
}

@interface MemoryMonitor : NSObject
@property (nonatomic, assign) double warningPressure;   // 0.75
@property (nonatomic, assign) double criticalPressure;  // 0.85
@property (nonatomic, assign) double dumpPressure;      // 0.90 触发 Memory Dump
@end

@implementation MemoryMonitor

- (void)startMonitoring {
    dispatch_source_t timer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0,
                                                     dispatch_get_global_queue(QOS_CLASS_UTILITY, 0));
    dispatch_source_set_timer(timer, DISPATCH_TIME_NOW, 1 * NSEC_PER_SEC, 100 * NSEC_PER_MSEC);
    dispatch_source_set_event_handler(timer, ^{
        MemorySnapshot s = MemoryQuerySnapshot();
        if (s.pressure >= self.dumpPressure) {
            [[MemoryDump shared] triggerDumpWithReason:@"water-line"];
        } else if (s.pressure >= self.criticalPressure) {
            [self handleCriticalMemory];
        } else if (s.pressure >= self.warningPressure) {
            [self handleMemoryWarning];
        }
    });
    dispatch_resume(timer);
}

@end

typedef NS_ENUM(NSInteger, OOMResult) {
    OOMResultNormalExit,
    OOMResultCrash,
    OOMResultOSUpgrade,
    OOMResultAppUpgrade,
    OOMResultAppHang,       // 前台卡死（Watchdog）
    OOMResultLowBattery,    // 低电量关机
    OOMResultFOOM,          // 前台 OOM
    OOMResultBOOM,          // 后台 OOM
    OOMResultUnknown,       // 排除法兜底
};

@interface OOMDetector : NSObject
@property (nonatomic, copy)   NSString *lastAppVersion;
@property (nonatomic, copy)   NSString *lastOSBuild;           // 用 build 比 version 更准
@property (nonatomic, assign) BOOL      didExitNormally;
@property (nonatomic, assign) BOOL      didCrashLastLaunch;
@property (nonatomic, assign) BOOL      wasInBackground;
@property (nonatomic, assign) uint64_t  lastFootprint;         // 退出前水位
@property (nonatomic, assign) uint64_t  lastLimit;             // 退出前阈值
@property (nonatomic, assign) BOOL      wasWatchdogSuspect;    // 退出前是否主线程卡顿
@property (nonatomic, assign) float     lastBatteryLevel;      // 退出前电量
@end

@implementation OOMDetector

- (OOMResult)diagnoseLastLaunch {
    if (self.didExitNormally)   return OOMResultNormalExit;
    if (self.didCrashLastLaunch) return OOMResultCrash;

    if (![self.lastOSBuild isEqualToString:[self currentOSBuild]]) return OOMResultOSUpgrade;
    if (![self.lastAppVersion isEqualToString:[self currentAppVersion]]) return OOMResultAppUpgrade;

    // 主线程卡顿超阈值 → 归为前台卡死，不算 OOM
    if (self.wasWatchdogSuspect) return OOMResultAppHang;

    // 电量 < 2% 且非正常退出 → 归为低电量关机
    if (self.lastBatteryLevel > 0 && self.lastBatteryLevel < 0.02) return OOMResultLowBattery;

    // 水位置信度校验：退出前 < 70% → 非典型 OOM
    double pressure = self.lastLimit > 0 ? (double)self.lastFootprint / self.lastLimit : 0;
    if (pressure < 0.7) return OOMResultUnknown;

    return self.wasInBackground ? OOMResultBOOM : OOMResultFOOM;
}

@end

// libmalloc/include/malloc/malloc_private.h
typedef void (malloc_logger_t)(uint32_t type,
                               uintptr_t arg1, uintptr_t arg2, uintptr_t arg3,
                               uintptr_t result, uint32_t num_hot_frames_to_skip);
extern malloc_logger_t *malloc_logger;      // 覆盖 malloc/free/realloc/calloc 等堆分配
extern malloc_logger_t *__syscall_logger;   // 覆盖 vm_allocate/mach_vm_allocate 等 VM 分配

extern malloc_logger_t *malloc_logger;
extern malloc_logger_t *__syscall_logger;

// libmalloc 内部枚举，按值复制过来
#define memory_logging_type_alloc        2
#define memory_logging_type_dealloc      4
#define memory_logging_type_vm_allocate  16
#define memory_logging_type_vm_deallocate 32

static void memdump_logger(uint32_t type, uintptr_t arg1, uintptr_t arg2,
                           uintptr_t arg3, uintptr_t result, uint32_t skip) {
    bool is_alloc   = (type & memory_logging_type_alloc)   != 0;
    bool is_dealloc = (type & memory_logging_type_dealloc) != 0;

    if (is_alloc) {
        size_t    size = (size_t)arg2;
        uintptr_t ptr  = result;
        uint64_t  sid  = memdump_capture_stack(skip + 1);
        memdump_live_insert(ptr, size, sid);
    } else if (is_dealloc) {
        memdump_live_remove(arg2);
    }
}

void memdump_install(void) {
    malloc_logger   = memdump_logger;
    __syscall_logger = memdump_logger;
}

size_t memdump_thread_stack_pcs(vm_address_t *buf, size_t max) {
    void **fp = __builtin_frame_address(0);
    size_t n = 0;
    while (fp && n < max) {
        vm_address_t pc = (vm_address_t)*(fp + 1);
        if (pc == 0) break;
        buf[n++] = pc;
        fp = (void **)*fp;  // 跟随保存的 fp 链
    }
    return n;
}

stack1: A → C → D → E → F → G
stack2: A → B → D → E → F → G
共享后缀:         D → E → F → G

typedef struct {
    uint64_t pc        : 36; // armv8 虚拟地址 36 位够用
    uint64_t parent_idx: 28; // 父节点下标
} stack_node_t;

// stack_id = 入口节点下标；解压只需沿 parent_idx 链回溯

int fd = open(path, O_RDWR | O_CREAT, 0644);
ftruncate(fd, MAP_SIZE);
void *base = mmap(NULL, MAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
close(fd);  // mmap 区域依然有效
// 所有写入直接操作 base+offset

#import <malloc/malloc.h>
#import <execinfo.h>

#define LARGE_ALLOC_THRESHOLD (1 * 1024 * 1024)

static malloc_logger_t *s_original_logger;

static void large_alloc_logger(uint32_t type, uintptr_t arg1, uintptr_t arg2,
                               uintptr_t arg3, uintptr_t result, uint32_t skip) {
    // 保留链式调用，避免与其他监控组件冲突
    if (s_original_logger) {
        s_original_logger(type, arg1, arg2, arg3, result, skip);
    }
    if (!(type & memory_logging_type_alloc)) return;

    size_t size = (size_t)arg2;
    if (size < LARGE_ALLOC_THRESHOLD) return;

    // ⚠️ 此处禁止再调用 malloc/Foundation，否则递归死锁
    void *frames[128];
    int count = backtrace(frames, 128);

    // 把原始 PC 塞入无锁 ring buffer，让异步线程消费
    LargeAllocTrackerEnqueue((void *)result, size, frames, count);
}

+ (void)install {
    s_original_logger = malloc_logger;
    malloc_logger = large_alloc_logger;
}

@implementation UIViewController (MemoryLeak)

- (void)willDealloc {
    __weak typeof(self) weakSelf = self;
    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(2 * NSEC_PER_SEC)),
                   dispatch_get_main_queue(), ^{
        if (weakSelf) {
            // 2s 后仍存活 → 极可能泄漏
            NSLog(@"Memory leak detected: %@", weakSelf);
            [weakSelf reportMemoryLeak];
        }
    });
}

@end

#import <FBRetainCycleDetector/FBRetainCycleDetector.h>

- (void)detectRetainCycle:(id)object {
    FBRetainCycleDetector *detector = [FBRetainCycleDetector new];
    [detector addCandidate:object];
    NSSet *cycles = [detector findRetainCycles];
    if (cycles.count > 0) {
        NSLog(@"Retain cycles detected: %@", cycles);
    }
}

内存占用 = 宽度 × 高度 × 每像素字节数

常见格式每像素字节数：
- RGBA：4字节（最常见）
- RGB：3字节
- 灰度：1字节

// 监控大图加载，及时发现内存风险
@implementation UIImage (MemoryMonitor)

+ (void)load {
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        // Hook imageNamed:
        Method original = class_getClassMethod(self, @selector(imageNamed:));
        Method swizzled = class_getClassMethod(self, @selector(monitored_imageNamed:));
        method_exchangeImplementations(original, swizzled);
    });
}

+ (UIImage *)monitored_imageNamed:(NSString *)name {
    UIImage *image = [self monitored_imageNamed:name];
    
    if (image) {
        [self checkImageMemoryUsage:image name:name];
    }
    
    return image;
}

+ (void)checkImageMemoryUsage:(UIImage *)image name:(NSString *)name {
    CGFloat width = image.size.width * image.scale;
    CGFloat height = image.size.height * image.scale;
    
    // 计算内存占用（RGBA格式，每像素4字节）
    NSUInteger memorySize = width * height * 4;
    
    // 超过2MB的图片记录警告
    if (memorySize > 2 * 1024 * 1024) {
        NSLog(@"[MemoryWarning] Large image loaded: %@, size: %.0f×%.0f, memory: %.2fMB",
              name, width, height, memorySize / (1024.0 * 1024.0));
        
        // 上报大图监控
        [self reportLargeImage:name width:width height:height memory:memorySize];
    }
}

@end

// 图片降采样，减少内存占用
- (UIImage *)downsampleImageAt:(NSURL *)imageURL toSize:(CGSize)size {
    NSDictionary *options = @{
        (id)kCGImageSourceShouldCache: @NO
    };
    
    CGImageSourceRef source = CGImageSourceCreateWithURL((__bridge CFURLRef)imageURL, 
                                                          (__bridge CFDictionaryRef)options);
    if (!source) return nil;
    
    CGFloat maxDimension = MAX(size.width, size.height) * [UIScreen mainScreen].scale;
    
    NSDictionary *downsampleOptions = @{
        (id)kCGImageSourceCreateThumbnailFromImageAlways: @YES,
        (id)kCGImageSourceShouldCacheImmediately: @YES,
        (id)kCGImageSourceCreateThumbnailWithTransform: @YES,
        (id)kCGImageSourceThumbnailMaxPixelSize: @(maxDimension)
    };
    
    CGImageRef downsampledImage = CGImageSourceCreateThumbnailAtIndex(source, 0, 
                                                                       (__bridge CFDictionaryRef)downsampleOptions);
    CFRelease(source);
    
    if (!downsampledImage) return nil;
    
    UIImage *result = [UIImage imageWithCGImage:downsampledImage];
    CGImageRelease(downsampledImage);
    
    return result;
}

// 使用AutoreleasePool控制内存峰值
- (void)processLargeDataSet:(NSArray *)dataSet {
    for (NSInteger i = 0; i < dataSet.count; i++) {
        @autoreleasepool {
            // 处理单个数据项
            [self processItem:dataSet[i]];
            
            // 每处理100个检查一次内存
            if (i % 100 == 0) {
                uint64_t memory = [[MemoryMonitor shared] currentMemoryUsage];
                if (memory > MEMORY_THRESHOLD) {
                    // 暂停处理，等待内存释放
                    [NSThread sleepForTimeInterval:0.1];
                }
            }
        }
    }
}

@implementation AppDelegate

- (void)applicationDidReceiveMemoryWarning:(UIApplication *)application {
    // 第一级：清理缓存
    [[NSURLCache sharedURLCache] removeAllCachedResponses];
    [[SDImageCache sharedImageCache] clearMemory];
    
    // 第二级：通知各模块释放内存
    [[NSNotificationCenter defaultCenter] postNotificationName:@"AppMemoryWarning" 
                                                        object:nil];
    
    // 记录内存状态
    [self logMemoryState];
}

@end

// ViewController响应内存警告
@implementation MyViewController

- (void)didReceiveMemoryWarning {
    [super didReceiveMemoryWarning];
    
    // 只释放当前不可见或非必要的资源
    // 注意：不要释放马上会被重新访问的数据，否则会触发重新加载，反而增加内存压力
    
    // 1. 释放不在屏幕上的页面缓存
    if (!self.view.window) {
        [self.imageCache removeAllObjects];
    }
    
    // 2. 释放预加载但暂时不需要的数据
    self.preloadedData = nil;
    
    // 3. 降低缓存容量而非完全清空
    self.dataCache.countLimit = self.dataCache.countLimit / 2;
}

@end

// 推荐：使用NSCache替代NSDictionary作为缓存
// NSCache优势：
// 1. 自动响应内存警告，无需手动清理
// 2. 线程安全，无需额外加锁
// 3. 支持设置缓存数量和内存上限
// 4. 使用LRU策略自动淘汰

@interface ImageCacheManager : NSObject

@property (nonatomic, strong) NSCache<NSString *, UIImage *> *imageCache;

@end

@implementation ImageCacheManager

- (instancetype)init {
    self = [super init];
    if (self) {
        _imageCache = [[NSCache alloc] init];
        _imageCache.countLimit = 100;           // 最多缓存100张图片
        _imageCache.totalCostLimit = 50 * 1024 * 1024;  // 最大50MB
        _imageCache.name = @"com.app.imageCache";
    }
    return self;
}

- (void)cacheImage:(UIImage *)image forKey:(NSString *)key {
    if (image && key) {
        // cost可以设置为图片内存大小，用于更精确的内存控制
        NSUInteger cost = image.size.width * image.size.height * 4;
        [self.imageCache setObject:image forKey:key cost:cost];
    }
}

- (UIImage *)imageForKey:(NSString *)key {
    return [self.imageCache objectForKey:key];
}

@end

<key>com.apple.developer.kernel.increased-memory-limit</key>
<true/>
<!-- 可选：扩展的虚拟地址空间（主要给图像/AR 场景使用 64-bit VA） -->
<key>com.apple.developer.kernel.extended-virtual-addressing</key>
<true/>

// 统一的Swizzle工具
@implementation NSObject (Swizzle)

+ (void)swizzleInstanceMethod:(SEL)originalSel with:(SEL)swizzledSel {
    Class class = [self class];
    
    Method originalMethod = class_getInstanceMethod(class, originalSel);
    Method swizzledMethod = class_getInstanceMethod(class, swizzledSel);
    
    BOOL didAddMethod = class_addMethod(class,
                                        originalSel,
                                        method_getImplementation(swizzledMethod),
                                        method_getTypeEncoding(swizzledMethod));
    
    if (didAddMethod) {
        class_replaceMethod(class,
                           swizzledSel,
                           method_getImplementation(originalMethod),
                           method_getTypeEncoding(originalMethod));
    } else {
        method_exchangeImplementations(originalMethod, swizzledMethod);
    }
}

@end

@implementation NSArray (CrashProtection)

+ (void)load {
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        // __NSArrayI是不可变数组的真实类
        Class __NSArrayI = NSClassFromString(@"__NSArrayI");
        [__NSArrayI swizzleInstanceMethod:@selector(objectAtIndex:) 
                                     with:@selector(safe_objectAtIndex:)];
        
        // __NSArray0是空数组的类
        Class __NSArray0 = NSClassFromString(@"__NSArray0");
        [__NSArray0 swizzleInstanceMethod:@selector(objectAtIndex:) 
                                     with:@selector(safe_objectAtIndex:)];
        
        // __NSSingleObjectArrayI是单元素数组的类
        Class __NSSingleObjectArrayI = NSClassFromString(@"__NSSingleObjectArrayI");
        [__NSSingleObjectArrayI swizzleInstanceMethod:@selector(objectAtIndex:) 
                                                 with:@selector(safe_objectAtIndex:)];

        // __NSArrayM是可变数组的类
        Class __NSArrayM = NSClassFromString(@"__NSArrayM");
        [__NSArrayM swizzleInstanceMethod:@selector(objectAtIndex:)
                                     with:@selector(safe_objectAtIndex:)];
    });
}

- (id)safe_objectAtIndex:(NSUInteger)index {
    if (index < self.count) {
        return [self safe_objectAtIndex:index];
    }
    
    // 记录错误
    NSLog(@"Array index out of bounds: %lu >= %lu", (unsigned long)index, (unsigned long)self.count);
    
    return nil;
}

@end

@implementation NSMutableDictionary (CrashProtection)

+ (void)load {
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        Class class = NSClassFromString(@"__NSDictionaryM");
        
        [class swizzleInstanceMethod:@selector(setObject:forKey:) 
                                with:@selector(safe_setObject:forKey:)];
        
        [class swizzleInstanceMethod:@selector(setObject:forKeyedSubscript:) 
                                with:@selector(safe_setObject:forKeyedSubscript:)];
    });
}

- (void)safe_setObject:(id)anObject forKey:(id<NSCopying>)aKey {
    if (!aKey) {
        NSLog(@"Attempted to set object for nil key");
        return;
    }
    if (!anObject) {
        NSLog(@"Attempted to set nil object for key: %@", aKey);
        return;
    }
    [self safe_setObject:anObject forKey:aKey];
}

- (void)safe_setObject:(id)obj forKeyedSubscript:(id<NSCopying>)key {
    if (!key) {
        NSLog(@"Attempted to set object for nil key");
        return;
    }
    if (!obj) {
        [self removeObjectForKey:key];
        return;
    }
    [self safe_setObject:obj forKeyedSubscript:key];
}

@end

@implementation NSString (CrashProtection)

+ (void)load {
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        // NSString的substringFromIndex:
        Class __NSCFConstantString = NSClassFromString(@"__NSCFConstantString");
        [__NSCFConstantString swizzleInstanceMethod:@selector(substringFromIndex:) 
                                               with:@selector(safe_substringFromIndex:)];
        
        Class __NSCFString = NSClassFromString(@"__NSCFString");
        [__NSCFString swizzleInstanceMethod:@selector(substringFromIndex:) 
                                       with:@selector(safe_substringFromIndex:)];
    });
}

- (NSString *)safe_substringFromIndex:(NSUInteger)from {
    if (from > self.length) {
        NSLog(@"substringFromIndex: index %lu out of bounds; string length %lu", 
              (unsigned long)from, (unsigned long)self.length);
        return @"";
    }
    return [self safe_substringFromIndex:from];
}

@end

// 创建一个能处理任何消息的桩对象
@interface CrashStub : NSObject
+ (instancetype)shared;
@end

@implementation CrashStub

+ (instancetype)shared {
    static CrashStub *instance;
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        instance = [[CrashStub alloc] init];
    });
    return instance;
}

// 返回方法签名
- (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector {
    // 返回一个通用的方法签名
    return [NSMethodSignature signatureWithObjCTypes:"v@:"];
}

// 处理消息
- (void)forwardInvocation:(NSInvocation *)anInvocation {
    // 什么都不做，吞掉消息
    NSLog(@"CrashStub swallowed selector: %@", NSStringFromSelector(anInvocation.selector));
}

@end

// 崩溃率计算
@interface CrashRateMonitor : NSObject

@property (nonatomic, assign) NSUInteger launchCount;
@property (nonatomic, assign) NSUInteger crashCount;

@end

@implementation CrashRateMonitor

- (void)recordLaunch {
    self.launchCount++;
    [self saveToStorage];
}

- (void)recordCrash {
    self.crashCount++;
    [self saveToStorage];
}

- (double)crashRate {
    if (self.launchCount == 0) return 0;
    return (double)self.crashCount / self.launchCount;
}

// 按版本统计
- (NSDictionary *)crashRateByVersion {
    // 从存储中读取各版本的崩溃数据
    // ...
}

// 按设备统计
- (NSDictionary *)crashRateByDevice {
    // 从存储中读取各设备的崩溃数据
    // ...
}

@end

// 崩溃报警配置
@interface CrashAlertConfig : NSObject

@property (nonatomic, assign) double crashRateThreshold;      // 崩溃率阈值
@property (nonatomic, assign) NSUInteger crashCountThreshold; // 崩溃次数阈值
@property (nonatomic, assign) NSTimeInterval checkInterval;   // 检查间隔

@end

// 报警检查
- (void)checkAndAlert {
    double currentCrashRate = [self.monitor crashRate];
    
    // 崩溃率超过阈值
    if (currentCrashRate > self.config.crashRateThreshold) {
        [self sendAlert:@"崩溃率超过阈值" 
                  value:currentCrashRate 
              threshold:self.config.crashRateThreshold];
    }
    
    // 新崩溃检测
    NSArray *newCrashes = [self detectNewCrashes];
    for (CrashInfo *crash in newCrashes) {
        if (crash.count > self.config.crashCountThreshold) {
            [self sendAlert:@"新增高频崩溃" crash:crash];
        }
    }
}

# 1. 从崩溃日志头部找到二进制的 UUID 和 Load Address
# Binary Images 段形如：
#   0x104a3c000 - 0x104b3ffff MyApp arm64  <abc123...def> /var/.../MyApp

# 2. 在 dSYM 仓库中根据 UUID 查找对应 dSYM
dwarfdump --uuid MyApp.app.dSYM
# UUID: ABC123DE-F456-... (arm64)  必须与崩溃日志中的 UUID 一致

# 3. 使用 atos 手动符号化
atos -arch arm64 \
     -o MyApp.app.dSYM/Contents/Resources/DWARF/MyApp \
     -l 0x104a3c000 \
     0x104a3d234
# 输出：-[MyClass method] (in MyApp) (MyClass.m:42)

# 4. 批量符号化整份崩溃日志
xcrun symbolicatecrash MyApp.crash MyApp.app.dSYM > symbolicated.crash

# 5. 将 dSYM 补传到崩溃平台（Bugly/Firebase/Sentry 等），触发自动重新符号化
# 例如 Firebase Crashlytics：
fastlane run upload_symbols_to_crashlytics dsym_path:./MyApp.app.dSYM

# 使用Clang静态分析器
xcodebuild analyze -scheme MyApp -configuration Debug

# 常见检测项：
# - 空指针解引用
# - 内存泄漏
# - 未初始化变量
# - 逻辑错误

// 边界条件测试
func testArraySafeAccess() {
    let array = [1, 2, 3]
    
    // 正常访问
    XCTAssertEqual(array[safe: 0], 1)
    XCTAssertEqual(array[safe: 2], 3)
    
    // 越界访问
    XCTAssertNil(array[safe: 3])
    XCTAssertNil(array[safe: 100])
    
    // 空数组测试
    let emptyArray: [Int] = []
    XCTAssertNil(emptyArray[safe: 0])
}

// 并发测试
func testConcurrentAccess() {
    let safeArray = SafeArray<Int>()
    let expectation = XCTestExpectation(description: "Concurrent access")
    expectation.expectedFulfillmentCount = 1000
    
    for i in 0..<1000 {
        DispatchQueue.global().async {
            safeArray.append(i)
            _ = safeArray.count
            expectation.fulfill()
        }
    }
    
    wait(for: [expectation], timeout: 10)
}

// 方案1：功能开关（Feature Toggle）
// 通过服务端下发配置来控制功能的开启/关闭

@interface FeatureToggle : NSObject

+ (BOOL)isFeatureEnabled:(NSString *)featureName;
+ (void)fetchRemoteConfig;

@end

// 使用
if ([FeatureToggle isFeatureEnabled:@"new_feature"]) {
    // 新功能代码
} else {
    // 降级方案或旧逻辑
}

// 方案2：服务端降级
// 将有问题的逻辑移到服务端，通过接口返回不同的数据来规避客户端问题

// 方案3：紧急发版
// 对于严重问题，申请 App Store 加急审核（通常1-2天）