Why Does Your iOS App Get Killed? Decoding SIGKILL Crashes and MetricKit Solutions

What is a SIGKILL crash

When a crash log contains SIGKILL , the operating system forcibly terminated the process, equivalent to the kill -9 command. The termination reason often includes a code such as 0xdead10cc, which indicates that the app was killed while holding file or database locks.

Capturing SIGKILL crashes

Why SIGKILL cannot be caught

SIGKILL is reserved by the kernel; it cannot be intercepted by a signal handler so that the OS can guarantee termination of an unresponsive process.

Using MetricKit (iOS 13+)

MetricKit is a dynamic library that aggregates crash diagnostics, power, and performance metrics. Starting with iOS 14 it provides crash‑log delivery.

Adding the MetricKit framework

Registering a subscriber

if (@available(iOS 14.0, *)) {
    MXMetricManager *manager = [MXMetricManager sharedManager];
    if (self && manager && [manager respondsToSelector:@selector(addSubscriber:)]) {
        [manager addSubscriber:self];
    }
}

Implementing the subscriber method

- (void)didReceiveDiagnosticPayloads:(NSArray<MXDiagnosticPayload *> * _Nonnull)payloads API_AVAILABLE(ios(14.0)) {
    if (@available(iOS 14.0, *)) {
        for (MXDiagnosticPayload *payload in payloads) {
            NSDictionary *payloadDic = [payload dictionaryRepresentation];
            // Process payloadDic as needed
        }
    }
}

Extracting the crash stack from the payload

NSArray *callStackRootFrames = [dicFrame ArrayValueForKey:@"callStackRootFrames"];
if (callStackRootFrames.count <= 0) { continue; }
NSDictionary *dicZero = [callStackRootFrames objectAtIndex:0];
int rootIndex = 0;
while (dicZero && dicZero.count > 0) {
    NSString *binaryUUID = [dicZero stringValueForKey:@"binaryUUID"];
    NSString *binaryName = [dicZero stringValueForKey:@"binaryName"];
    long long baseAdd = [[dicZero NumberValueForKey:@"offsetIntoBinaryTextSegment"] longLongValue];
    long long address = [[dicZero numberValueForKey:@"address"] longLongValue];
    NSArray *subFrames = [dicZero arrayValueForKey:@"subFrames"];
    [strStack appendFormat:@"%d %@ 0x%llx 0x%llx + %lld
", rootIndex, binaryName, baseAdd, address, address - model.baseAddress];
    rootIndex++;
    if (subFrames && subFrames.count > 0) {
        dicZero = [subFrames objectAtIndex:0];
    } else {
        dicZero = nil;
    }
}

Limitations of MetricKit

Crash‑log collection via MetricKit is available only on iOS 14 and later (the framework itself exists from iOS 13).

The delivered logs contain stack traces but lack explicit timestamps or launch‑time context.

When the app uses segmented Mach‑O binaries, MetricKit may report incorrect UUIDs; a fallback using the LC‑MAIN entry of the Mach‑O file is required to compute the correct load address.

SIGKILL termination codes

0x8badf00d : Watchdog termination – the app was unresponsive for too long.

0xc00010ff : Overheating termination – the device killed the app due to excessive temperature.

0xbaadca11 : PushKit/CallKit failure – the app failed to handle a VoIP push or CallKit request.

0xbad22222 : Excessive VoIP wake‑ups – the system terminated the app for too many VoIP activations.

0xc51bad01 / 0xc51bad02 : watchOS background‑task CPU overuse or timeout – reduce CPU consumption or task count.

Common SIGKILL issues in the Baidu app

Main‑thread blocking operations

Synchronous network requests on a weak connection.

Heavy data processing such as large JSON files or 3D model loading.

Massive Core Data synchronous saves.

Intensive database operations.

Decoding large images or decompressing files on the main thread.

General solution: Move time‑consuming work to a background queue and invoke a callback on the main thread when finished.

- (void)getContentArray:(void (^)(NSArray *resultArray))completeBlock {
    dispatch_barrier_async(self.readWriteQueue, ^{
        if (completeBlock) {
            NSArray *resultArray = [NSArray arrayWithArray:self.array];
            completeBlock(resultArray);
        }
    });
}

Main‑thread and background‑thread deadlock

Example: a singleton initialization deadlock during [xxxConfig sharedInstance] caused the following crash stack:

Thread 0 Crashed:
0 libsystem_kernel.dylib ___ulock_wait (in libsystem_kernel.dylib) 8
1 libdispatch.dylib __dlock_wait (in libdispatch.dylib) 56
2 libdispatch.dylib __dispatch_once_wait (in libdispatch.dylib) 120
3 BaiduBoxApp +[xxxConfig sharedInstance] (in BaiduBoxApp) 20
4 BaiduBoxApp +[xxxConfig updateABConfig] (in BaiduBoxApp) 0
5 BaiduBoxApp -[xxxManager startOnce] (in BaiduBoxApp) 20

Resolution: avoid synchronous dispatches inside singleton initialization and use thread‑safe patterns such as dispatch_once without blocking calls.

References

Addressing Watchdog Terminations – Apple Documentation

Understanding the Exception Types in a Crash Report – Apple Documentation

MetricKit Framework – Apple Documentation

Examining the Fields in a Crash Report – Apple Documentation

https://github.com/alibaba/dexposed