Repository navigation
Fix crash on concurrent URLSession call during swizzling - #326
Merged
Merged
Conversation
Swizzled blocks captured `originalIMP`, which was assigned from the return value of `method_setImplementation` only after the swizzled IMP was already published. A thread calling the method in that window (e.g. the SDK's own tracer settings request racing network auto-instrumentation at bootstrap) jumped to a nil IMP and crashed with EXC_BAD_ACCESS at 0x0. Read the original IMP with `method_getImplementation` before publishing the swizzled one, at all swizzle sites in URLSessionInstrumentation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
More details
Capturing each original implementation before publishing its swizzled replacement closes the reported nil-IMP window across all ten affected sites.
🤖 Bits Code Review · Commit ac0f080
gnufede
approved these changes
Oct 19, 2026
daniel-mohedano
approved these changes
Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #325.
Problem
Every swizzle in
URLSessionInstrumentationfollowed this pattern:method_setImplementationpublishes the swizzled IMP before it returns, whileoriginalIMPis assigned only afterwards. A thread calling the method in that window enters the block withoriginalIMP == niland jumps to0x0.At bootstrap,
DDTestMonitorruns network auto-instrumentation (startInstrumenting→startNetworkAutoInstrumentation) concurrently with the SDK's own tracer settings request (startTestOptimization→getTracerConfig), which hits that window.The customer crash report, symbolicated with the 2.7.11 iphonesimulator arm64 dSYM (UUID
5C9387A6-AADD-3844-AAA3-1F5F7B5F33E4), confirms this:getTracerConfig(DDTestMonitor.swift:337) →SettingsApiService.tracerSettings→HTTPClient._send→ swizzled block ininjectIntoNSURLSessionAsyncDataAndDownloadTaskMethods(URLSessionInstrumentation.swift:372) →0x0startNetworkAutoInstrumentation(DDTestMonitor.swift:701) →injectIntoNSURLSessionAsyncDataAndDownloadTaskMethods(:305), insidemethod_setImplementationFix
At all 10 swizzle sites (session task creation methods,
resume, and the delegate injections), the original IMP is now read withmethod_getImplementationand captured as aletbefore the swizzled IMP is published. This is the same patterninjectIntoNSURLSessionCreateTaskWithParameterMethodsalready used.Testing
DatadogSDKTestingTests): 464 tests, 0 failures🤖 Generated with Claude Code