ci: 跳到 0 的时候要问的是 lr,不是 bt

    stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
    frame #0: 0x0000000000000000

⚠️ bt 只能说出「PC 是 0」,那是把症状重述一遍 —— 跳到地址 0 没有留下可展开的帧。
而链接寄存器里还是发出那次调用的人的返回地址,image lookup 能把它变成名字。

本机已排除的:
· LC_MAIN entryoff 124032 = 0x1e480,正是 _okm_start(不是入口错);
· __init_offsets 的十七项里前十个是 openkal 的模块初始化器,各一条 ret(合法);
· __init_array_start == __init_array_end,__libc_start_init 的循环不跑;
· _init / _fini 各一条 ret;
· 未定义符号只有三个,没有弱未定义。

⇒ 剩下的是「谁调用了 0」,那要 lr。顺带跑一次 DYLD_PRINT_INITIALIZERS 看加载器
走到哪一步。

Author: speak-agent

.github/workflows/ci.yml

@@ -296,9 +296,20 @@ jobs:
           # all look identical from outside: `Segmentation fault: 11`.
           # One CI cycle that prints a backtrace is worth several that do not.
           if ! ./art/openkal-same-source > out.log 2>&1; then
+            echo "--- how far the loader got ---"
+            DYLD_PRINT_INITIALIZERS=1 DYLD_PRINT_APIS=1 \
+              ./art/openkal-same-source 2>&1 | tail -25 || true
             echo "--- it did not run; what the debugger saw ---"
-            lldb --batch -o run -o 'bt all' -o 'image list' \
-                 -- ./art/openkal-same-source 2>&1 | tail -60 || true
+            # ⭐ `lr` IS THE DATUM. A jump to address 0 leaves no frame to
+            # unwind, so `bt` says only "frame #0: 0x0" — which is the symptom
+            # restated. The link register still holds the return address of
+            # whoever made that call, and `image lookup` turns it into a name.
+            lldb --batch \
+                 -o run \
+                 -o 'register read pc lr sp fp x8 x9 x16 x17' \
+                 -o 'image lookup --address $lr' \
+                 -o 'bt all' \
+                 -- ./art/openkal-same-source 2>&1 | tail -70 || true
             echo "--- the image's own dependencies ---"
             otool -L art/openkal-same-source || true
             otool -l art/openkal-same-source | grep -A4 LC_MAIN || true