UI freeze due to deadlock when analysis is running and lots of types are being created

[WeiN76LQh]

Version and Platform (required):

• Binary Ninja Version: 5.2.8144-dev (eed8ffcf)
• Edition: Commercial
• OS: macOS
• OS Version: 15.5
• CPU Architecture: M1

Bug Description:
I had open a copy of the DSC and had let initial auto-analysis complete the loading of the default image libsystem_c.dylib. After that I loaded another image, in this case, /System/Library/PrivateFrameworks/CoreKnowledge.framework/CoreKnowledge. Upon doing so I had C++ plugins that automatically started generating a lot of types. During this time analysis was running and I was using Binary Ninja and navigating the linear view. I was not interacting with any of the sidebar views. Took something like 30 seconds before Binary Ninja's UI froze. Its been 5+ minutes at this point as I write this issue and the UI has still not unfrozen. It appears that this is likely a deadlock given Binary Ninja is not really using the CPU (< 1% usage). Fortunately I was debugging Binary Ninja so I captured the stack trace for the main thread:

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol7197 (@___lldb_unnamed_symbol7197:15)
___lldb_unnamed_symbol27012 (@___lldb_unnamed_symbol27012:174)
___lldb_unnamed_symbol27568 (@___lldb_unnamed_symbol27568:407)
___lldb_unnamed_symbol27568 (@___lldb_unnamed_symbol27568:370)
BNAddTypeMemberTokens (@BNAddTypeMemberTokens:50)
___lldb_unnamed_symbol38247 (@___lldb_unnamed_symbol38247:30)
___lldb_unnamed_symbol32034 (@___lldb_unnamed_symbol32034:70)
CrossReferenceTreeModel::data(QModelIndex const&, int) const (@CrossReferenceTreeModel::data(QModelIndex const&, int) const:1596)
QSortFilterProxyModel::data(QModelIndex const&, int) const (@QSortFilterProxyModel::data(QModelIndex const&, int) const:54)
CrossReferenceItemDelegate::sizeHint(QStyleOptionViewItem const&, QModelIndex const&) const (@CrossReferenceItemDelegate::sizeHint(QStyleOptionViewItem const&, QModelIndex const&) const:33)
QTreeViewPrivate::widthHintForIndex(QModelIndex const&, int, QStyleOptionViewItem const&, int) const (@QTreeViewPrivate::widthHintForIndex(QModelIndex const&, int, QStyleOptionViewItem const&, int) const:94)
QTreeView::sizeHintForColumn(int) const (@QTreeView::sizeHintForColumn(int) const:206)
QHeaderViewPrivate::resizeSections(QHeaderView::ResizeMode, bool) (@QHeaderViewPrivate::resizeSections(QHeaderView::ResizeMode, bool):195)
QHeaderView::sectionSize(int) const (@QHeaderView::sectionSize(int) const:66)
QTreeViewPrivate::updateScrollBars() (@QTreeViewPrivate::updateScrollBars():140)
QTreeView::updateGeometries() (@QTreeView::updateGeometries():70)
QTreeView::expandAll() (@QTreeView::expandAll():55)
non-virtual thunk to CrossReferenceTree::setNewSelection(std::__1::vector<XrefItem, std::__1::allocator<XrefItem>>&, bool, SelectionInfoForXref const&, bool) (@non-virtual thunk to CrossReferenceTree::setNewSelection(std::__1::vector<XrefItem, std::__1::allocator<XrefItem>>&, bool, SelectionInfoForXref const&, bool):32)
CrossReferenceWidget::setCurrentSelection(SelectionInfoForXref) (@CrossReferenceWidget::setCurrentSelection(SelectionInfoForXref):387)
CrossReferenceWidget::OnNewSelectionForXref(UIContext*, ViewFrame*, View*, SelectionInfoForXref const&) (@CrossReferenceWidget::OnNewSelectionForXref(UIContext*, ViewFrame*, View*, SelectionInfoForXref const&):56)
UIContext::updateCrossReferences(ViewFrame*, View*, SelectionInfoForXref const&) (@UIContext::updateCrossReferences(ViewFrame*, View*, SelectionInfoForXref const&):25)
View::updateCrossReferenceSelection(ViewFrame*) (@View::updateCrossReferenceSelection(ViewFrame*):24)
void doActivate<false>(QObject*, int, void**) (@void doActivate<false>(QObject*, int, void**):351)
QItemSelectionModel::emitSelectionChanged(QItemSelection const&, QItemSelection const&) (@QItemSelectionModel::emitSelectionChanged(QItemSelection const&, QItemSelection const&):70)
QItemSelectionModel::select(QItemSelection const&, QFlags<QItemSelectionModel::SelectionFlag>) (@QItemSelectionModel::select(QItemSelection const&, QFlags<QItemSelectionModel::SelectionFlag>):167)
QItemSelectionModel::select(QModelIndex const&, QFlags<QItemSelectionModel::SelectionFlag>) (@QItemSelectionModel::select(QModelIndex const&, QFlags<QItemSelectionModel::SelectionFlag>):25)
QItemSelectionModel::setCurrentIndex(QModelIndex const&, QFlags<QItemSelectionModel::SelectionFlag>) (@QItemSelectionModel::setCurrentIndex(QModelIndex const&, QFlags<QItemSelectionModel::SelectionFlag>):87)
TypeBrowserView::selectTypeByName(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, bool) (@TypeBrowserView::selectTypeByName(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, bool):498)
___lldb_unnamed_symbol29647 (@___lldb_unnamed_symbol29647:100)
TypeBrowserModel::runAfterUpdate(std::__1::function<void ()>) (@TypeBrowserModel::runAfterUpdate(std::__1::function<void ()>):70)
TypeBrowserView::navigateToType(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unsigned long long) (@TypeBrowserView::navigateToType(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unsigned long long):53)
___lldb_unnamed_symbol8978 (@___lldb_unnamed_symbol8978:102)
LinearView::mouseDoubleClickEvent(QMouseEvent*) (@LinearView::mouseDoubleClickEvent(QMouseEvent*):295)
QWidget::event(QEvent*) (@QWidget::event(QEvent*):35)
QFrame::event(QEvent*) (@QFrame::event(QEvent*):17)
QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) (@QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*):68)
QApplicationPrivate::notify_helper(QObject*, QEvent*) (@QApplicationPrivate::notify_helper(QObject*, QEvent*):79)
QApplication::notify(QObject*, QEvent*) (@QApplication::notify(QObject*, QEvent*):1248)
QCoreApplication::notifyInternal2(QObject*, QEvent*) (@QCoreApplication::notifyInternal2(QObject*, QEvent*):53)
QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool, bool) (@QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool, bool):226)
QWidgetWindow::handleMouseEvent(QMouseEvent*) (@QWidgetWindow::handleMouseEvent(QMouseEvent*):315)
QWidgetWindow::event(QEvent*) (@QWidgetWindow::event(QEvent*):32)
QApplicationPrivate::notify_helper(QObject*, QEvent*) (@QApplicationPrivate::notify_helper(QObject*, QEvent*):87)
QApplication::notify(QObject*, QEvent*) (@QApplication::notify(QObject*, QEvent*):130)
QCoreApplication::notifyInternal2(QObject*, QEvent*) (@QCoreApplication::notifyInternal2(QObject*, QEvent*):53)
QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*) (@QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*):626)
QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::ProcessEventsFlag>) (@QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::ProcessEventsFlag>):105)
QCocoaEventDispatcherPrivate::postedEventsSourceCallback(void*) (@QCocoaEventDispatcherPrivate::postedEventsSourceCallback(void*):122)
__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (@__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__:10)
__CFRunLoopDoSource0 (@__CFRunLoopDoSource0:46)
__CFRunLoopDoSources0 (@__CFRunLoopDoSources0:61)
__CFRunLoopRun (@__CFRunLoopRun:213)
CFRunLoopRunSpecific (@CFRunLoopRunSpecific:146)
RunCurrentEventLoopInMode (@RunCurrentEventLoopInMode:84)
ReceiveNextEventCommon (@ReceiveNextEventCommon:57)
_BlockUntilNextEventMatchingListInModeWithFilter (@_BlockUntilNextEventMatchingListInModeWithFilter:22)
_DPSNextEvent (@_DPSNextEvent:174)
-[NSApplication(NSEventRouting) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (@-[NSApplication(NSEventRouting) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]:175)
-[NSApplication run] (@-[NSApplication run]:123)
QCocoaEventDispatcher::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (@QCocoaEventDispatcher::processEvents(QFlags<QEventLoop::ProcessEventsFlag>):543)
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (@QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>):152)
QCoreApplication::exec() (@QCoreApplication::exec():57)
___lldb_unnamed_symbol8547 (@___lldb_unnamed_symbol8547:3231)
main_bn_5_2_8144_Commercial_eed8ffcf_ (@main_bn_5_2_8144_Commercial_eed8ffcf_:6)
start (@start:1522)

Binary:
DYLD Shared Cache for iOS 18.1.1 for an iPhone 16 Pro Max (iPhone17,2_18.1.1_22B91 downloadable here).

Additional Information:
Seems to be related to cross references for types based on the available symbols in the stack trace. For context I did have the symbols, types and cross references views open and visible on the left hand side.

There were alot of active threads that were also waiting on a lock, here are a bunch of their call stacks, which are trimmed to just show the Binary Ninja portion:

NotificationsWorker thread (not sure why FeatureMap is doing anything here, its not visible, pretty sure I turned it off ages ago):

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
BNGetBasicBlockStart (@BNGetBasicBlockStart:12)
FeatureMap::renderAnalysisData() (@FeatureMap::renderAnalysisData():108)
___lldb_unnamed_symbol17491 (@___lldb_unnamed_symbol17491:16)
___lldb_unnamed_symbol24153 (@___lldb_unnamed_symbol24153:261)
QThreadPrivate::start(void*) (@QThreadPrivate::start(void*):93)
_pthread_start (@_pthread_start:37)

The rest are all worker threads doing analysis stuff:

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
non-virtual thunk to TypeBrowserModel::OnTypeDefined(BinaryNinja::BinaryView*, BinaryNinja::QualifiedName const&, BinaryNinja::Type*) (@non-virtual thunk to TypeBrowserModel::OnTypeDefined(BinaryNinja::BinaryView*, BinaryNinja::QualifiedName const&, BinaryNinja::Type*):11)
___lldb_unnamed_symbol32963 (@___lldb_unnamed_symbol32963:63)
___lldb_unnamed_symbol10555 (@___lldb_unnamed_symbol10555:28)
___lldb_unnamed_symbol9815 (@___lldb_unnamed_symbol9815:32)
___lldb_unnamed_symbol7205 (@___lldb_unnamed_symbol7205:603)
___lldb_unnamed_symbol7213 (@___lldb_unnamed_symbol7213:48)
BNDefineAnalysisType (@BNDefineAnalysisType:77)
BinaryNinja::BinaryView::DefineType(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, BinaryNinja::QualifiedName const&, BinaryNinja::Ref<BinaryNinja::Type>)

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol9954 (@___lldb_unnamed_symbol9954:17)
BNGetSymbolByAddress (@BNGetSymbolByAddress:17)
BinaryNinja::BinaryView::GetSymbolByAddress(unsigned long long, BinaryNinja::NameSpace const&) 

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol7197 (@___lldb_unnamed_symbol7197:15)
BNGetAnalysisTypeById (@BNGetAnalysisTypeById:45)
BinaryNinja::BinaryView::GetTypeById(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) 

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
BNGetBasicBlockEnd (@BNGetBasicBlockEnd:12)
BinaryNinja::BasicBlock::GetEnd() const

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol7028 (@___lldb_unnamed_symbol7028:17)
___lldb_unnamed_symbol15321 (@___lldb_unnamed_symbol15321:35)
___lldb_unnamed_symbol22189 (@___lldb_unnamed_symbol22189:3098)
___lldb_unnamed_symbol22204 (@___lldb_unnamed_symbol22204:234)
___lldb_unnamed_symbol22209 (@___lldb_unnamed_symbol22209:62)
___lldb_unnamed_symbol21782 (@___lldb_unnamed_symbol21782:19)
BinaryNinja::LowLevelILFunction::GenerateSSAForm()

Not sure if the remaining worker thread stack traces are of any use given they're all unnamed symbols:

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol7028 (@___lldb_unnamed_symbol7028:17)
___lldb_unnamed_symbol7027 (@___lldb_unnamed_symbol7027:24)
___lldb_unnamed_symbol17800 (@___lldb_unnamed_symbol17800:75)
___lldb_unnamed_symbol19720 (@___lldb_unnamed_symbol19720:2265)
___lldb_unnamed_symbol19720 (@___lldb_unnamed_symbol19720:4687)
___lldb_unnamed_symbol19883 (@___lldb_unnamed_symbol19883:495)
___lldb_unnamed_symbol19894 (@___lldb_unnamed_symbol19894:33)
___lldb_unnamed_symbol15279 (@___lldb_unnamed_symbol15279:156)
___lldb_unnamed_symbol16267 (@___lldb_unnamed_symbol16267:15)
___lldb_unnamed_symbol6513 (@___lldb_unnamed_symbol6513:20)
___lldb_unnamed_symbol29907 (@___lldb_unnamed_symbol29907:375)
___lldb_unnamed_symbol29932 (@___lldb_unnamed_symbol29932:113)
___lldb_unnamed_symbol29931 (@___lldb_unnamed_symbol29931:10)
___lldb_unnamed_symbol30124 (@___lldb_unnamed_symbol30124:23)
___lldb_unnamed_symbol27257 (@___lldb_unnamed_symbol27257:18)
___lldb_unnamed_symbol29574 (@___lldb_unnamed_symbol29574:850)

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol7028 (@___lldb_unnamed_symbol7028:17)
___lldb_unnamed_symbol15321 (@___lldb_unnamed_symbol15321:35)
___lldb_unnamed_symbol22189 (@___lldb_unnamed_symbol22189:3098)
___lldb_unnamed_symbol22204 (@___lldb_unnamed_symbol22204:234)
___lldb_unnamed_symbol22209 (@___lldb_unnamed_symbol22209:62)
___lldb_unnamed_symbol21782 (@___lldb_unnamed_symbol21782:19)
___lldb_unnamed_symbol15256 (@___lldb_unnamed_symbol15256:106)
___lldb_unnamed_symbol16267 (@___lldb_unnamed_symbol16267:15)
___lldb_unnamed_symbol6513 (@___lldb_unnamed_symbol6513:20)
___lldb_unnamed_symbol29907 (@___lldb_unnamed_symbol29907:375)
___lldb_unnamed_symbol29932 (@___lldb_unnamed_symbol29932:113)
___lldb_unnamed_symbol29931 (@___lldb_unnamed_symbol29931:10)
___lldb_unnamed_symbol30124 (@___lldb_unnamed_symbol30124:23)
___lldb_unnamed_symbol27257 (@___lldb_unnamed_symbol27257:18)
___lldb_unnamed_symbol29574 (@___lldb_unnamed_symbol29574:850)
___lldb_unnamed_symbol29569 (@___lldb_unnamed_symbol29569:6)

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol7024 (@___lldb_unnamed_symbol7024:19)
___lldb_unnamed_symbol7027 (@___lldb_unnamed_symbol7027:63)
___lldb_unnamed_symbol17800 (@___lldb_unnamed_symbol17800:75)
___lldb_unnamed_symbol19720 (@___lldb_unnamed_symbol19720:2265)
___lldb_unnamed_symbol19720 (@___lldb_unnamed_symbol19720:4687)
___lldb_unnamed_symbol19883 (@___lldb_unnamed_symbol19883:495)
___lldb_unnamed_symbol19894 (@___lldb_unnamed_symbol19894:33)
___lldb_unnamed_symbol15279 (@___lldb_unnamed_symbol15279:156)
___lldb_unnamed_symbol16267 (@___lldb_unnamed_symbol16267:15)
___lldb_unnamed_symbol6513 (@___lldb_unnamed_symbol6513:20)
___lldb_unnamed_symbol29907 (@___lldb_unnamed_symbol29907:375)
___lldb_unnamed_symbol29932 (@___lldb_unnamed_symbol29932:113)
___lldb_unnamed_symbol29931 (@___lldb_unnamed_symbol29931:10)
___lldb_unnamed_symbol30124 (@___lldb_unnamed_symbol30124:23)
___lldb_unnamed_symbol27257 (@___lldb_unnamed_symbol27257:18)
___lldb_unnamed_symbol29574 (@___lldb_unnamed_symbol29574:850)

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol10110 (@___lldb_unnamed_symbol10110:18)
___lldb_unnamed_symbol21971 (@___lldb_unnamed_symbol21971:1650)
___lldb_unnamed_symbol22042 (@___lldb_unnamed_symbol22042:53)
___lldb_unnamed_symbol23383 (@___lldb_unnamed_symbol23383:16)
___lldb_unnamed_symbol5525 (@___lldb_unnamed_symbol5525:18)
___lldb_unnamed_symbol5525 (@___lldb_unnamed_symbol5525:77)
___lldb_unnamed_symbol23323 (@___lldb_unnamed_symbol23323:248)
___lldb_unnamed_symbol15260 (@___lldb_unnamed_symbol15260:310)
___lldb_unnamed_symbol16267 (@___lldb_unnamed_symbol16267:15)
___lldb_unnamed_symbol6513 (@___lldb_unnamed_symbol6513:20)
___lldb_unnamed_symbol29907 (@___lldb_unnamed_symbol29907:375)
___lldb_unnamed_symbol29932 (@___lldb_unnamed_symbol29932:113)
___lldb_unnamed_symbol29931 (@___lldb_unnamed_symbol29931:10)
___lldb_unnamed_symbol30124 (@___lldb_unnamed_symbol30124:23)
___lldb_unnamed_symbol27257 (@___lldb_unnamed_symbol27257:18)
___lldb_unnamed_symbol29574 (@___lldb_unnamed_symbol29574:850)

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol7013 (@___lldb_unnamed_symbol7013:17)
___lldb_unnamed_symbol27563 (@___lldb_unnamed_symbol27563:486)
___lldb_unnamed_symbol23022 (@___lldb_unnamed_symbol23022:27)
___lldb_unnamed_symbol23021 (@___lldb_unnamed_symbol23021:24)
___lldb_unnamed_symbol29136 (@___lldb_unnamed_symbol29136:138)
___lldb_unnamed_symbol29137 (@___lldb_unnamed_symbol29137:441)
___lldb_unnamed_symbol29145 (@___lldb_unnamed_symbol29145:460)
___lldb_unnamed_symbol29167 (@___lldb_unnamed_symbol29167:115)
___lldb_unnamed_symbol23323 (@___lldb_unnamed_symbol23323:9449)
___lldb_unnamed_symbol15260 (@___lldb_unnamed_symbol15260:310)
___lldb_unnamed_symbol16267 (@___lldb_unnamed_symbol16267:15)
___lldb_unnamed_symbol6513 (@___lldb_unnamed_symbol6513:20)
___lldb_unnamed_symbol29907 (@___lldb_unnamed_symbol29907:375)
___lldb_unnamed_symbol29932 (@___lldb_unnamed_symbol29932:113)
___lldb_unnamed_symbol29931 (@___lldb_unnamed_symbol29931:10)
___lldb_unnamed_symbol30124 (@___lldb_unnamed_symbol30124:23)

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol16484 (@___lldb_unnamed_symbol16484:211)
___lldb_unnamed_symbol15371 (@___lldb_unnamed_symbol15371:100)
___lldb_unnamed_symbol16457 (@___lldb_unnamed_symbol16457:57)
___lldb_unnamed_symbol5525 (@___lldb_unnamed_symbol5525:18)
___lldb_unnamed_symbol5525 (@___lldb_unnamed_symbol5525:77)
___lldb_unnamed_symbol15264 (@___lldb_unnamed_symbol15264:223)
___lldb_unnamed_symbol16267 (@___lldb_unnamed_symbol16267:15)
___lldb_unnamed_symbol6513 (@___lldb_unnamed_symbol6513:20)
___lldb_unnamed_symbol29907 (@___lldb_unnamed_symbol29907:375)
___lldb_unnamed_symbol29932 (@___lldb_unnamed_symbol29932:113)
___lldb_unnamed_symbol29931 (@___lldb_unnamed_symbol29931:10)
___lldb_unnamed_symbol30124 (@___lldb_unnamed_symbol30124:23)
___lldb_unnamed_symbol27257 (@___lldb_unnamed_symbol27257:18)
___lldb_unnamed_symbol29574 (@___lldb_unnamed_symbol29574:850)
___lldb_unnamed_symbol29569 (@___lldb_unnamed_symbol29569:6)
_pthread_start (@_pthread_start:37)

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol9849 (@___lldb_unnamed_symbol9849:11)
___lldb_unnamed_symbol23641 (@___lldb_unnamed_symbol23641:56)
___lldb_unnamed_symbol23323 (@___lldb_unnamed_symbol23323:9353)
___lldb_unnamed_symbol15260 (@___lldb_unnamed_symbol15260:310)
___lldb_unnamed_symbol16267 (@___lldb_unnamed_symbol16267:15)
___lldb_unnamed_symbol6513 (@___lldb_unnamed_symbol6513:20)
___lldb_unnamed_symbol29907 (@___lldb_unnamed_symbol29907:375)
___lldb_unnamed_symbol29932 (@___lldb_unnamed_symbol29932:113)
___lldb_unnamed_symbol29931 (@___lldb_unnamed_symbol29931:10)
___lldb_unnamed_symbol30124 (@___lldb_unnamed_symbol30124:23)
___lldb_unnamed_symbol27257 (@___lldb_unnamed_symbol27257:18)
___lldb_unnamed_symbol29574 (@___lldb_unnamed_symbol29574:850)
___lldb_unnamed_symbol29569 (@___lldb_unnamed_symbol29569:6)
_pthread_start (@_pthread_start:37)

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol7028 (@___lldb_unnamed_symbol7028:17)
___lldb_unnamed_symbol15321 (@___lldb_unnamed_symbol15321:35)
___lldb_unnamed_symbol23007 (@___lldb_unnamed_symbol23007:87)
___lldb_unnamed_symbol23013 (@___lldb_unnamed_symbol23013:319)
___lldb_unnamed_symbol23101 (@___lldb_unnamed_symbol23101:7464)
___lldb_unnamed_symbol22605 (@___lldb_unnamed_symbol22605:27)
___lldb_unnamed_symbol23323 (@___lldb_unnamed_symbol23323:9764)
___lldb_unnamed_symbol15260 (@___lldb_unnamed_symbol15260:310)
___lldb_unnamed_symbol16267 (@___lldb_unnamed_symbol16267:15)
___lldb_unnamed_symbol6513 (@___lldb_unnamed_symbol6513:20)
___lldb_unnamed_symbol29907 (@___lldb_unnamed_symbol29907:375)
___lldb_unnamed_symbol29932 (@___lldb_unnamed_symbol29932:113)
___lldb_unnamed_symbol29931 (@___lldb_unnamed_symbol29931:10)
___lldb_unnamed_symbol30124 (@___lldb_unnamed_symbol30124:23)
___lldb_unnamed_symbol27257 (@___lldb_unnamed_symbol27257:18)
___lldb_unnamed_symbol29574 (@___lldb_unnamed_symbol29574:850)

__psynch_mutexwait (@__psynch_mutexwait:5)
_pthread_mutex_firstfit_lock_wait (@_pthread_mutex_firstfit_lock_wait:24)
_pthread_mutex_firstfit_lock_slow (@_pthread_mutex_firstfit_lock_slow:58)
std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
___lldb_unnamed_symbol10112 (@___lldb_unnamed_symbol10112:17)
___lldb_unnamed_symbol21971 (@___lldb_unnamed_symbol21971:215)
___lldb_unnamed_symbol22042 (@___lldb_unnamed_symbol22042:53)
___lldb_unnamed_symbol23188 (@___lldb_unnamed_symbol23188:106)
___lldb_unnamed_symbol23188 (@___lldb_unnamed_symbol23188:1488)
___lldb_unnamed_symbol23323 (@___lldb_unnamed_symbol23323:617)
___lldb_unnamed_symbol15260 (@___lldb_unnamed_symbol15260:310)
___lldb_unnamed_symbol16267 (@___lldb_unnamed_symbol16267:15)
___lldb_unnamed_symbol6513 (@___lldb_unnamed_symbol6513:20)
___lldb_unnamed_symbol29907 (@___lldb_unnamed_symbol29907:375)
___lldb_unnamed_symbol29932 (@___lldb_unnamed_symbol29932:113)
___lldb_unnamed_symbol29931 (@___lldb_unnamed_symbol29931:10)
___lldb_unnamed_symbol30124 (@___lldb_unnamed_symbol30124:23)
___lldb_unnamed_symbol27257 (@___lldb_unnamed_symbol27257:18)
___lldb_unnamed_symbol29574 (@___lldb_unnamed_symbol29574:850)
___lldb_unnamed_symbol29569 (@___lldb_unnamed_symbol29569:6)

[bdash]

This looks like a deadlock due to lock order reversal. On the main thread:

_pthread_mutex_firstfit_lock_slow
std::__1::recursive_mutex::lock()
[ … ]
Type::AddTypeMemberTokens
[ … ]
TypeBrowserView::selectTypeByName
TypeBrowserModel::runAfterUpdate(std::__1::function<void ()>)
TypeBrowserView::navigateToType(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unsigned long long)

1. TypeBrowserModel::runAfterUpdate locks a mutex related to the model state.
2. TypeBrowserView::selectTypeByName changes the selected item. This ends up calling out to CrossReferenceWidget::OnNewSelectionForXref to update the cross references to refer to the new selection.
3. Type::AddTypeMemberTokens does work that can end trying to lock the BinaryView's main mutex. This lock is held by the background thread.

On a background thread:

std::__1::recursive_mutex::lock() (@std::__1::recursive_mutex::lock():7)
non-virtual thunk to TypeBrowserModel::OnTypeDefined(BinaryNinja::BinaryView*, BinaryNinja::QualifiedName const&, BinaryNinja::Type*)
[ ... ]
BNDefineAnalysisType
BinaryNinja::BinaryView::DefineType

1. BNDefineAnalysisType locks the BinaryView's main mutex.
2. The OnTypeDefined notification is called with that lock held.
3. TypeBrowserModel::OnTypeDefined attempts to lock the mutex related to the model state. This lock is held by the main thread.

---

The fix for this specific deadlock is probably to update TypeBrowserModel to avoid holding its lock while calling out to other code.

It's a little surprising that notifications registered via BinaryDataNotification are all delivered with the lock held. This makes it easy to hit this type of lock ordering issue if a notification handler ever needs to take the client's own lock. If that same client's code ever calls into any Binary Ninja API that might take BinaryView's lock while the client has its own lock held… that's a deadlock waiting to happen.