Skip to content

Fix crash on concurrent URLSession call during swizzling - #326

Merged
ypopovych merged 1 commit into
mainfrom
fix-urlsession-swizzle-race-325
Oct 19, 2026
Merged

ypopovych merged 1 commit into
mainfrom
fix-urlsession-swizzle-race-325

Conversation

@ypopovych

Copy link
Copy Markdown
Contributor

Fixes #325.

Problem

Every swizzle in URLSessionInstrumentation followed this pattern:

var originalIMP: IMP?
let block = { ... unsafeBitCast(originalIMP, ...)(...) ... }
originalIMP = method_setImplementation(original, swizzledIMP)

method_setImplementation publishes the swizzled IMP before it returns, while originalIMP is assigned only afterwards. A thread calling the method in that window enters the block with originalIMP == nil and jumps to 0x0.

At bootstrap, DDTestMonitor runs network auto-instrumentation (startInstrumenting → startNetworkAutoInstrumentation) concurrently with the SDK's own tracer settings request (startTestOptimization → getTracerConfig), which hits that window.

The customer crash report, symbolicated with the 2.7.11 iphonesimulator arm64 dSYM (UUID 5C9387A6-AADD-3844-AAA3-1F5F7B5F33E4), confirms this:

  • Crashed thread: getTracerConfig (DDTestMonitor.swift:337) → SettingsApiService.tracerSettings → HTTPClient._send → swizzled block in injectIntoNSURLSessionAsyncDataAndDownloadTaskMethods (URLSessionInstrumentation.swift:372) → 0x0
  • Concurrent thread: startNetworkAutoInstrumentation (DDTestMonitor.swift:701) → injectIntoNSURLSessionAsyncDataAndDownloadTaskMethods (:305), inside method_setImplementation

Fix

At all 10 swizzle sites (session task creation methods, resume, and the delegate injections), the original IMP is now read with method_getImplementation and captured as a let before the swizzled IMP is published. This is the same pattern injectIntoNSURLSessionCreateTaskWithParameterMethods already used.

Testing

  • macOS unit tests (DatadogSDKTestingTests): 464 tests, 0 failures

🤖 Generated with Claude Code

Swizzled blocks captured `originalIMP`, which was assigned from the return
value of `method_setImplementation` only after the swizzled IMP was already
published. A thread calling the method in that window (e.g. the SDK's own
tracer settings request racing network auto-instrumentation at bootstrap)
jumped to a nil IMP and crashed with EXC_BAD_ACCESS at 0x0.

Read the original IMP with `method_getImplementation` before publishing the
swizzled one, at all swizzle sites in URLSessionInstrumentation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ypopovych
ypopovych requested review from a team as code owners October 19, 2026 13:40
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 19, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-19T13:41:55.934267Z ac0f080 PR opened
🔒 Security Review ✅ Completed 2026-10-19T13:43:47.237015Z ac0f080 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@datadog-datadog-prod-us1 datadog-datadog-prod-us1 Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bits Code Review: PASS

More details

Capturing each original implementation before publishing its swizzled replacement closes the reported nil-IMP window across all ten affected sites.

Was this helpful? React 👍 or 👎

Open Bits AI session

🤖 Bits Code Review · Commit ac0f080

@ypopovych
ypopovych merged commit 644f672 into main Oct 19, 2026
15 of 16 checks passed
@ypopovych
ypopovych deleted the fix-urlsession-swizzle-race-325 branch October 19, 2026 14:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SIGSEGV during bootstrap: possible race between URLSession swizzling and the tracer-config request

3 participants