Initializing native SDK results in random crashes throughout the app

[dmregister]

Platform

iOS

Installed

CocoaPods

Version

8.6.0

Steps to Reproduce

We have a react-native app but are setting autoInitializeNativeSdk: false. Our first release after initializing on the native side started showing new crashes throughout our app, not on start up, with Attempted to dereference garbage pointer.

SDK init:

[SentrySDK startWithConfigureOptions:^(SentryOptions *options) {

      NSNumber *appHangSampleRate = @([[ReactNativeConfig envFor:@"SENTRY_ERRORS_APP_HANG_SAMPLE_RATE"] floatValue]);
      NSString *version = [[[NSBundle mainBundle] infoDictionary] objectForKey:@"CFBundleShortVersionString"];
      NSString *buildVersion = [[[NSBundle mainBundle] infoDictionary] objectForKey:@"CFBundleVersion"];

      options.dsn = [ReactNativeConfig envFor:@"SENTRY_DSN"];
      options.debug = @NO; // Enabled debug when first installing is always helpful
      options.releaseName = [NSString stringWithFormat:@"ios@%@+%@",version,buildVersion];
      options.dist = buildVersion;
      options.environment = [ReactNativeConfig envFor:@"BACKEND_SERVER_TYPE"];
      options.enableAutoSessionTracking = @YES;
      options.sampleRate = @([[ReactNativeConfig envFor:@"SENTRY_SAMPLE_RATE"] floatValue]);
      options.tracesSampler = ^NSNumber * (SentrySamplingContext * samplingContext) {
        return @0;
      };
      
      // return null to discard the event
      options.beforeSend = ^SentryEvent * _Nullable(SentryEvent * _Nonnull event) {

        bool isAppHangEvent = NO;
        for (SentryException *sentryException in event.exceptions) {
          if([sentryException.mechanism.type isEqual: @"AppHang"]){
            isAppHangEvent = YES;
            break;
          }
        };

        if(isAppHangEvent && [self sampler:[appHangSampleRate floatValue]]) {
         return NULL;
        }

        return event;
      };
    }];

ReactNative SDK init:

RNSentry.init({
    dsn: Config.SENTRY_DSN,
    environment: Config.BACKEND_SERVER_TYPE,
    sampleRate: Number(Config.SENTRY_SAMPLE_RATE),
    tracesSampleRate: Number(Config.SENTRY_TRACES_SAMPLE_RATE),
    release: `${Platform.OS}@${getVersion()}+${getBuildVersion()}`,
    dist: getBuildVersion(),
    normalizeDepth: 4,
    integrations: [
      new RNSentry.ReactNativeTracing({
        finalTimeoutMs: Number(Config.SENTRY_TRACING_FINAL_TIMEOUT_MS),
        routingInstrumentation: getRoutingInstrumentation(),
        tracingOrigins: [
          'localhost',
          /^\//,
          ...Config.SENTRY_TRACING_ORIGINS.split(',').map((origin) => new RegExp(origin)),
        ],
        shouldCreateSpanForRequest,
        beforeNavigate,
      }),
    ],
    debug: enableSentryDebugLogs,
    enableAutoSessionTracking: true,
    autoInitializeNativeSdk: false,
    beforeSend: eventProcessor,
    beforeSendTransaction: transactionProcessor,
  });

Expected Result

No additional crashes when initializing the SDK from the native side

Actual Result

Crash from NetworkTracking:

Hardware Model:     iPhone12,1
Process:            Example
Identifier:         com.example.iphone.consumer
Version:            4.78.0
Role:               Foreground
OS Version:         iOS 16.4.1
Exception Type:     EXC_BAD_ACCESS 
Exception Subtype:  KERN_INVALID_ADDRESS


EXC_BAD_ACCESS: Attempted to dereference garbage pointer 0xd971d12f0.

0  libobjc.A.dylib +0x4174        _objc_release_x0
1  Example +0x6d8e20              -[SentryDispatchQueueWrapper dispatchAfter:block:] (SentryDispatchQueueWrapper.m:62:1)
2  Example +0x714840              -[SentryTracer dispatchIdleTimeout] (SentryTracer.m:185:9)
3  Example +0x715714              -[SentryTracer spanFinished:] (SentryTracer.m:327:5)
4  Example +0x70cb38              -[SentrySpan finishWithStatus:] (SentrySpan.m:157:5)
5  Example +0x6f05bc              -[SentryNetworkTracker urlSessionTask:setState:] (SentryNetworkTracker.m:300:5)
6  Example +0x6f1d40              __57+[SentryNetworkTrackingIntegration swizzleURLSessionTask]_block_invoke_2.27 (SentryNetworkTrackingIntegration.m:72:9)
7  CFNetwork +0x8bfec             0x1880a5fec (0x1880a5fa8 + 68)
8  CFNetwork +0x5c4e8             0x1880764e8 (0x188076424 + 196)
9  CFNetwork +0x8bc78             0x1880a5c78 (0x1880a5bc8 + 176)
10 CFNetwork +0x8bba4             0x1880a5ba4 (0x1880a5a9c + 264)
11 CFNetwork +0x63b1c             0x18807db1c (0x18807dab0 + 108)
12 CFNetwork +0x173e0             0x1880313e0 (0x188031378 + 104)
13 CFNetwork +0xf6e58             0x188110e58 (0x188110d3c + 284)
14 CFNetwork +0x1c2754            0x1881dc754 (0x1881dc710 + 68)
15 CFNetwork +0x2311c             0x18803d11c (0x18803d0fc + 32)
16 libdispatch.dylib +0x12fc0     __dispatch_block_async_invoke2
17 libdispatch.dylib +0x3ea8      __dispatch_client_callout
18 libdispatch.dylib +0xb530      __dispatch_lane_serial_drain
19 libdispatch.dylib +0xc0d4      __dispatch_lane_invoke
20 libdispatch.dylib +0x16cd8     __dispatch_workloop_worker_thread
21 libsystem_pthread.dylib +0xdd8 __pthread_wqthread

Crash from NSData:

CrashReporter Key:  35a675ac35ddb93f382768235e058f2676c7f39c
Hardware Model:     iPhone14,2
Process:            Example
Identifier:         com.example.iphone.consumer
Version:            4.78.0
Role:               Foreground
OS Version:         iOS 16.1.1
Exception Type:     EXC_BAD_ACCESS 
Exception Subtype:  KERN_INVALID_ADDRESS


EXC_BAD_ACCESS: Attempted to dereference garbage pointer 0xb5421fc78bc0.

0  libswiftCore.dylib +0x3da11c   __swift_release_dealloc
1  Example +0x6d8e20              -[SentryDispatchQueueWrapper dispatchAfter:block:] (SentryDispatchQueueWrapper.m:62:1)
2  Example +0x714840              -[SentryTracer dispatchIdleTimeout] (SentryTracer.m:185:9)
3  Example +0x715714              -[SentryTracer spanFinished:] (SentryTracer.m:327:5)
4  Example +0x70cb38              -[SentrySpan finishWithStatus:] (SentrySpan.m:157:5)
5  Example +0x6f3d84              -[SentryNSDataTracker finishTrackingNSData:span:] (SentryNSDataTracker.m:258:5)
6  Example +0x6f3074              -[SentryNSDataTracker measureNSData:writeToFile:options:error:method:] (SentryNSDataTracker.m:86:9)
7  Example +0x6f26f0              __38+[SentryNSDataSwizzling swizzleNSData]_block_invoke_2.47 (SentryNSDataSwizzling.m:68:5)
8  Example +0x17701c              __56-[BugsnagBreadcrumbs addBreadcrumbWithData:writeToDisk:]_block_invoke (BugsnagBreadcrumbs.m:170:22)
9  libdispatch.dylib +0x24b0      __dispatch_call_block_and_release
10 libdispatch.dylib +0x3fd8      __dispatch_client_callout
11 libdispatch.dylib +0xb690      __dispatch_lane_serial_drain
12 libdispatch.dylib +0xc1dc      __dispatch_lane_invoke
13 libdispatch.dylib +0x16e0c     __dispatch_workloop_worker_thread
14 libsystem_pthread.dylib +0xdf4 __pthread_wqthread

Null Reference:

CrashReporter Key:  3288fb3bd754e726d18bf8b4587bde9910d49aa1
Hardware Model:     iPhone13,2
Process:            Example
Identifier:         com.example.iphone.consumer
Version:            4.78.0
Role:               Foreground
OS Version:         iOS 16.0.3
Exception Type:     EXC_BAD_ACCESS
Exception Subtype:  KERN_INVALID_ADDRESS


EXC_BAD_ACCESS: Attempted to dereference null pointer.

0 Example +0x6d8e64              __50-[SentryDispatchQueueWrapper dispatchAfter:block:]_block_invoke (SentryDispatchQueueWrapper.m:59:13)
1 libdispatch.dylib +0x3fd8      __dispatch_client_callout
2 libdispatch.dylib +0x7468      __dispatch_continuation_pop
3 libdispatch.dylib +0x1aa54     __dispatch_source_invoke
4 libdispatch.dylib +0xb568      __dispatch_lane_serial_drain
5 libdispatch.dylib +0xc1dc      __dispatch_lane_invoke
6 libdispatch.dylib +0x16e0c     __dispatch_workloop_worker_thread
7 libsystem_pthread.dylib +0xdf4 __pthread_wqthread

EXC_BAD_ACCESS KERN_PROTECTION_FAILURE 0x00000001021fd338

Crashed: sentry-default
0  ???                            0x1021fd338 (Missing)
1  Example                        0x6d8e68 __50-[SentryDispatchQueueWrapper dispatchAfter:block:]_block_invoke + 60 (SentryDispatchQueueWrapper.m:60)
2  libdispatch.dylib              0x3fdc _dispatch_client_callout + 20
3  libdispatch.dylib              0x746c _dispatch_continuation_pop + 504
4  libdispatch.dylib              0x1aa58 _dispatch_source_invoke + 1588
5  libdispatch.dylib              0xb56c _dispatch_lane_serial_drain + 376
6  libdispatch.dylib              0xc1e0 _dispatch_lane_invoke + 384
7  libdispatch.dylib              0x16e10 _dispatch_workloop_worker_thread + 652
8  libsystem_pthread.dylib        0xdf8 _pthread_wqthread + 288
9  libsystem_pthread.dylib        0xb98 start_wqthread + 8

Crashed: com.apple.NSURLSession-work
EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x0000000d971d12f0

0  libobjc.A.dylib                0x4174 objc_release + 16
1  libobjc.A.dylib                0x4174 objc_release_x0 + 16
2  Example                        0x6d8e24 -[SentryDispatchQueueWrapper dispatchAfter:block:] + 62 (SentryDispatchQueueWrapper.m:62)
3  Example                        0x714844 -[SentryTracer dispatchIdleTimeout] + 185 (SentryTracer.m:185)
4  Example                        0x715718 -[SentryTracer spanFinished:] + 327 (SentryTracer.m:327)
5  Example                        0x70cb3c -[SentrySpan finishWithStatus:] + 157 (SentrySpan.m:157)
6  Example                        0x6f05c0 -[SentryNetworkTracker urlSessionTask:setState:] + 301 (SentryNetworkTracker.m:301)
7  Example                        0x6f1d44 __57+[SentryNetworkTrackingIntegration swizzleURLSessionTask]_block_invoke_2.27 + 72 (SentryNetworkTrackingIntegration.m:72)
8  CFNetwork                      0x8bff0 _CFHTTPMessageSetResponseProxyURL + 3976
9  CFNetwork                      0x5c4ec CFHTTPCookieStorageCreateFromFile + 2512
10 CFNetwork                      0x8bc7c _CFHTTPMessageSetResponseProxyURL + 3092
11 CFNetwork                      0x8bba8 _CFHTTPMessageSetResponseProxyURL + 2880
12 CFNetwork                      0x63b20 CFURLResponseGetTextEncodingName + 9108
13 CFNetwork                      0x173e4 CFURLRequestSetURL + 10864
14 CFNetwork                      0xf6e5c CFURLDownloadCancel + 42704
15 CFNetwork                      0x1c2758 _CFNetworkErrorGetLocalizedDescription + 683072
16 CFNetwork                      0x23120 CFURLRequestCopyHTTPRequestBodyStream + 2328
17 libdispatch.dylib              0x12fc4 _dispatch_block_async_invoke2 + 148
18 libdispatch.dylib              0x3eac _dispatch_client_callout + 20
19 libdispatch.dylib              0xb534 _dispatch_lane_serial_drain + 668
20 libdispatch.dylib              0xc0d8 _dispatch_lane_invoke + 436
21 libdispatch.dylib              0x16cdc _dispatch_workloop_worker_thread + 648
22 libsystem_pthread.dylib        0xddc _pthread_wqthread + 288
23 libsystem_pthread.dylib        0xb7c start_wqthread + 8

Crashed: com.onevcat.Kingfisher.ImageCache.ioQueue.D3466E1B-DBF7-4CD0-A3D7-0DCE467FA001
EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x00000000c0c7b970

0  libobjc.A.dylib                0x286c objc_retain_x0 + 16
1  libobjc.A.dylib                0x286c objc_retain + 16
2  Example                        0x6d8dac -[SentryDispatchQueueWrapper dispatchAfter:block:] + 53 (SentryDispatchQueueWrapper.m:53)
3  Example                        0x714844 -[SentryTracer dispatchIdleTimeout] + 185 (SentryTracer.m:185)
4  Example                        0x715718 -[SentryTracer spanFinished:] + 327 (SentryTracer.m:327)
5  Example                        0x70cb3c -[SentrySpan finishWithStatus:] + 157 (SentrySpan.m:157)
6  Example                        0x6f3d88 -[SentryNSDataTracker finishTrackingNSData:span:] + 260 (SentryNSDataTracker.m:260)
7  Example                        0x6f3078 -[SentryNSDataTracker measureNSData:writeToFile:options:error:method:] + 90 (SentryNSDataTracker.m:90)
8  Example                        0x6f26f4 __38+[SentryNSDataSwizzling swizzleNSData]_block_invoke_2.47 + 68 (SentryNSDataSwizzling.m:68)
9  Foundation                     0x365d28 closure #1 in Data.write(to:options:) + 64
10 Foundation                     0x359e28 specialized __DataStorage.withInteriorPointerReference<A>(_:_:) + 164
11 Foundation                     0x3620e4 specialized Data._Representation.withInteriorPointerReference<A>(_:) + 356
12 Foundation                     0x365cd8 Data.write(to:options:) + 64
13 Example                        0x4565bc specialized DiskStorage.Backend.store(value:forKey:expiration:) + 148 (DiskStorage.swift:148)
14 Example                        0x45b31c ImageCache.syncStoreToDisk(_:forKey:processorIdentifier:callbackQueue:expiration:completionHandler:) + 416 (ImageCache.swift:416)
15 Example                        0x45ad68 closure #2 in ImageCache.store(_:original:forKey:options:toDisk:completionHandler:) + 320 (ImageCache.swift:320)
16 Example                        0x462bec partial apply for closure #2 in ImageCache.store(_:original:forKey:options:toDisk:completionHandler:) + 3158668 (<compiler-generated>:3158668)
17 Example                        0x3bc90 thunk for @escaping @callee_guaranteed () -> () + 4377738384 (<compiler-generated>:4377738384)
18 libdispatch.dylib              0x637a8 _dispatch_call_block_and_release + 24
19 libdispatch.dylib              0x64780 _dispatch_client_callout + 16
20 libdispatch.dylib              0x3f6fc _dispatch_lane_serial_drain$VARIANT$armv81 + 600
21 libdispatch.dylib              0x401b0 _dispatch_lane_invoke$VARIANT$armv81 + 380
22 libdispatch.dylib              0x49f14 _dispatch_workloop_worker_thread + 608
23 libsystem_pthread.dylib        0x1bd0 _pthread_wqthread + 284
24 libsystem_pthread.dylib        0x1720 start_wqthread + 8

I was not sure if my issues was the same as others. Let me know if I need to comment on those instead.
#3002
#2850
#2769

However, this is negatively inpacting our crash rate.

Are you willing to submit a PR?

No response

[kahest]

Hi @dmregister, thank you for the detailled report, we're investigating. Possibly related to #2993

[dmregister]

thanks @kahest. In the meantime, is there a quick solution like disabling enableNetworkTracking and enableFileIOTracing?

[philipphofmann]

@dmregister, the stacktraces point to the dispatch idle timeout code. To prevent such crashes from happening disabling options.enableUserInteractionTracing = false should help. This is a duplicate of #3002. Please add more info over there.

[philipphofmann]

Thanks for reporting this, @dmregister. This should be fixed with #3036. We are going to release a hotfix soon.