Understanding SIGKILL Crashes and Capturing Them with MetricKit on iOS

1. What is a SIGKILL crash? When a crash log contains the SIGKILL keyword, it means the operating system forcibly terminated the process (equivalent to the kill -9 command). The crash log usually includes a termination reason and an error code such as 0xdead10cc , which indicates that the app was killed while holding file or database locks.

2. How to capture SIGKILL crashes? SIGKILL cannot be caught directly because it is a non‑catchable signal in Linux/Mach kernels. Instead, developers can rely on Apple’s MetricKit framework, introduced in iOS 13, to collect crash diagnostics automatically.

2.1 What is MetricKit? MetricKit aggregates exception, crash, power, and performance data for an app. Starting with iOS 14 it can deliver crash diagnostics to the app.

2.2 Benefits of using MetricKit for SIGKILL

No need to register signal handlers.

Data is delivered once after the app restarts, without continuous monitoring.

2.3 Using MetricKit

2.3.1 Add MetricKit library (add the framework to the Xcode project).

2.3.2 Register a MetricKit subscriber

if (@available(iOS 14.0, *)) {
MXMetricManager *manager = [MXMetricManager sharedManager];
if (self && manager && [manager respondsToSelector:@selector(addSubscriber:)]) {
[manager addSubscriber:self];
}
}

2.3.3 Implement the subscriber callback

- (void)didReceiveDiagnosticPayloads:(NSArray
* _Nonnull)payloads API_AVAILABLE(ios(14.0)) {
if (@available(iOS 14.0, *)) {
for (MXDiagnosticPayload *payload in payloads) {
NSDictionary *payloadDic = [payload dictionaryRepresentation];
// Extract stack frames, termination reason, etc.
}
}
}

2.3.4 Extracting stack information

NSArray *callStackRootFrames = [dicFrame ArrayValueForKey:@"callStackRootFrames"];
if (callStackRootFrames.count <= 0) { continue; }
NSDictionary *dicZero = [callStackRootFrames objectAtIndex:0];
int rootIndex = 0;
while (dicZero && dicZero.count > 0) {
NSString *binaryUUID = [dicZero stringValueForKey:@"binaryUUID"];
NSString *binaryName = [dicZero stringValueForKey:@"binaryName"];
long long baseAdd = [[dicZero NumberValueForKey:@"offsetIntoBinaryTextSegment"] longLongValue];
long long address = [[dicZero numberValueForKey:@"address"] longLongValue];
NSArray *subFrames = [dicZero arrayValueForKey:@"subFrames"];
[strStack appendFormat:@"%d %@ 0x%llx 0x%llx + %lld\n", rootIndex, binaryName, baseAdd, address, address - model.baseAddress];
rootIndex++;
if (subFrames && subFrames.count > 0) {
dicZero = [subFrames objectAtIndex:0];
} else {
dicZero = nil;
}
}

2.3.5 Limitations of MetricKit

Only supports crash logs from iOS 14 and later (MetricKit exists from iOS 13, but crash collection starts at iOS 14).

Crash logs lack precise timestamps and launch‑time information; additional instrumentation may be required.

If the app uses “segment‑mapped” binaries, MetricKit may report incorrect UUIDs or load addresses; developers must fallback to Mach‑O parsing.

3. Meaning of termination codes in SIGKILL logs

0x8badf00d – “ate bad food”: watchdog termination (app unresponsive).

0xc00010ff – “cool off”: system killed the app due to overheating.

0xbaadca11 – “bad call”: PushKit/CallKit failure.

0xbad22222 – excessive VoIP wake‑ups.

0xc51bad01 / 0xc51bad02 – watchOS killed the app for excessive CPU usage or failing to finish background work in time.

4. Common SIGKILL issues in the Baidu App

4.1 Main‑thread long‑running tasks such as synchronous network requests on weak connections, large JSON or 3D model processing, massive Core Data saves, heavy database operations, or decoding large images. These cause the watchdog to terminate the app.

Solution: Move heavy work to a background queue and callback to the main thread when finished.

- (void)getContentArray:(void (^)(NSArray *resultArray))completeBlock {
dispatch_barrier_async(self.readWriteQueue, ^{
if (completeBlock) {
NSArray *resultArray = [NSArray arrayWithArray:self.array];
completeBlock(resultArray);
}
});
}

4.2 Main‑thread / background‑thread deadlock Example: a singleton’s sharedInstance method deadlocks during initialization, leading to a crash stack similar to the one shown.

Thread 0 Crashed:
0 libsystem_kernel.dylib ___ulock_wait
1 libdispatch.dylib __dlock_wait
2 libdispatch.dylib __dispatch_once_wait
3 BaiduBoxApp +[xxxConfig sharedInstance]
...

Resolving the deadlock typically involves removing circular dependencies and ensuring that dispatch_once blocks do not call back into code that may also try to acquire the same lock.

5. References

Apple documentation: “Addressing Watchdog Terminations”.

Understanding the Exception Types in a Crash Report.

MetricKit Framework (Objective‑C).

Examining the Fields in a Crash Report.