Crash in NSUrlSessionHandler

[tipa]

Apple platform

iOS

Framework version

net8.0-*

Affected platform version

.NET 8

Description

Just got this issue reported on Sentry. Only happened once, so might be very hard to reproduce, but maybe it's doable to find the problem with the help of the stack trace:

EXC_BAD_ACCESS
cancel > class > isEqual: >
KERN_INVALID_ADDRESS at 0x15326c8b184f08.

0   libobjc.A.dylib                 0x31e64bc20         objc_msgSend
1   MyApp12                         0x2048c8bf4         xamarin_get_frame_length (trampolines.m:570)
2   MyApp12                         0x2048cfe50         xamarin_dyn_objc_msgSend
3   MyApp12                         0x204ca0560         _Microsoft_iOS_ObjCRuntime_Messaging__CallVariadicFunction (Messaging.cs:164)
4   MyApp12                         0x204c3cd24         _Microsoft_iOS_Foundation_NSUrlSessionTask__Cancel (NSUrlSessionTask.g.cs:156)
5   MyApp12                         0x204c4b15c         _Microsoft_iOS_System_Net_Http_NSUrlSessionHandler__RemoveInflightData (NSUrlSessionHandler.cs:234)
6   MyApp12                         0x204c4f598         _Microsoft_iOS_System_Net_Http_NSUrlSessionHandler___c__DisplayClass58_0___SendAsync_b__0 (NSUrlSessionHandler.cs:543)
7   MyApp12                         0x204e1f380         _Microsoft_iOS_ObjCRuntime_Trampolines_NIDUIDeferredMenuElementCompletionHandler__Invoke (Trampolines.g.cs:51484)
8   MyApp12                         0x204e1fa08         _Microsoft_iOS_ObjCRuntime_Trampolines_NIDUIDeferredMenuElementCompletionHandler__Invoke (Trampolines.g.cs:51484)
9   MyApp12                         0x204e1eff8         _Microsoft_iOS_ObjCRuntime_Trampolines_NIDUIDeferredMenuElementCompletionHandler__Invoke (Trampolines.g.cs:51484)
10  MyApp12                         0x204e27c08         _Microsoft_iOS_ObjCRuntime_Trampolines_NIDUIDeferredMenuElementCompletionHandler__Invoke (Trampolines.g.cs:51484)
11  MyApp12                         0x204e26c68         _Microsoft_iOS_ObjCRuntime_Trampolines_NIDUIDeferredMenuElementCompletionHandler__Invoke (Trampolines.g.cs:51484)
12  MyApp12                         0x204e262b4         _Microsoft_iOS_ObjCRuntime_Trampolines_NIDUIDeferredMenuElementCompletionHandler__Invoke (Trampolines.g.cs:51484)
13  MyApp12                         0x204e25f84         _Microsoft_iOS_ObjCRuntime_Trampolines_NIDUIDeferredMenuElementCompletionHandler__Invoke (Trampolines.g.cs:51484)
14  MyApp12                         0x204ea97ec         _Microsoft_iOS_ObjCRuntime_Trampolines_NIDUIDeferredMenuElementCompletionHandler__Invoke (Trampolines.g.cs:51484)
15  MyApp12                         0x204e1d1ac         _Microsoft_iOS_ObjCRuntime_Trampolines_NIDUIDeferredMenuElementCompletionHandler__Invoke (Trampolines.g.cs:51484)
16  MyApp12                         0x204e1d71c         _Microsoft_iOS_ObjCRuntime_Trampolines_NIDUIDeferredMenuElementCompletionHandler__Invoke (Trampolines.g.cs:51484)
17  libsystem_pthread.dylib         0x432744378         _pthread_start

Steps to Reproduce

Can't tell...

Did you find any workaround?

No response

Relevant logs

No response

[rolfbjarne]

This part is really strange:

3 _Microsoft_iOS_ObjCRuntime_Messaging__CallVariadicFunction (Messaging.cs:164)
4 _Microsoft_iOS_Foundation_NSUrlSessionTask__Cancel (NSUrlSessionTask.g.cs:156)

because here's the implementation of NSUrlSessionTask.Cancel (it doesn't call Messaging.CallVariadicFunction):

[Export ("cancel")]
[BindingImpl (BindingImplOptions.GeneratedCode | BindingImplOptions.Optimizable)]
public virtual void Cancel ()
{
    if (IsDirectBinding) {
        global::ObjCRuntime.Messaging.void_objc_msgSend (this.Handle, Selector.GetHandle ("cancel"));
    } else {
        global::ObjCRuntime.Messaging.void_objc_msgSendSuper (this.SuperHandle, Selector.GetHandle ("cancel"));
    }
}

If increasing the app size a little bit isn't a problem for you, I would recommend adding the following to the csproj:

<PropertyGroup>
    <MtouchExtraArgs>--require-pinvoke-wrappers:true</MtouchExtraArgs>
</PropertyGroup>

This will make us emit specialized trampolines for each signature of objc_msgSend we want to call from managed code, instead of using a generic trampoline (xamarin_dyn_objc_msgSend). There might be an advantage in that if something is wrong, we get further into iOS code than just xamarin_get_frame_length (which is our own code) before the crash happens, and that might reveal a bit more. Additionally, it makes every transition from managed to native code somewhat faster.

In any case I'll leave this open to collect more information over time.

[tipa]

Just received another one of this error, in another app of mine. Same stack trace, also iOS 18. Will consider adding the MtouchExtraArgs if this turns out to happen more frequently in the future