Guard nil asset.contentURL in ETCoreMLModel initWithAsset:

Summary:
Fixes EXC_BAD_ACCESS / KERN_INVALID_ADDRESS in `-[ETCoreMLModel initWithAsset:configuration:orderedInputNames:orderedOutputNames:error:]` at `xplat/executorch/backends/apple/coreml/runtime/delegate/ETCoreMLModel.mm:197`.

MID: `2bcd0a9cec05c99079249d043c273b07` — https://www.internalfb.com/logview/facebook_ios_fads/2bcd0a9cec05c99079249d043c273b07

Context from MID: 3,094 occurrences in the past 7 days, first seen 2026-04-01, last seen 2026-06-11. Surfaced in the `FBVideoHomeUnifiedPlayerViewController:warion_vdd_feed` Scuba slice (https://fburl.com/scuba/errorreporting_facebook_ios_fads/0x31y7si) but the actual fault is in the ExecuTorch CoreML delegate, not the player VC.

Root cause: the initializer calls `[asset keepAliveAndReturnError:]` which validates the asset's file lock but does not validate that `asset.contentURL` is non-nil. When the compiled `.mlmodelc` was reaped from disk between the lock and the load (or the asset was never fully materialized), `asset.contentURL` returns nil. `+[MLModel modelWithContentsOfURL:configuration:error:]` does not tolerate a nil URL — it deref's into CoreML internals and faults.

Fix: capture `asset.contentURL` into a local, return nil with `ETCoreMLErrorCorruptedModel` populated in the out-error if the URL is nil. No behavior change for valid assets — callers already handle the documented `nil` + `error` contract.

Differential Revision: D108334793

Author: Kushal Adhvaryu

backends/apple/coreml/runtime/delegate/ETCoreMLModel.mm

@@ -194,7 +194,15 @@ - (nullable instancetype)initWithAsset:(ETCoreMLAsset *)asset
         return nil;
     }
 
-    MLModel *mlModel = [MLModel modelWithContentsOfURL:asset.contentURL
+    NSURL *contentURL = asset.contentURL;
+    if (contentURL == nil) {
+        ETCoreMLLogErrorAndSetNSError(error,
+                                      ETCoreMLErrorCorruptedModel,
+                                      "asset.contentURL is nil");
+        return nil;
+    }
+
+    MLModel *mlModel = [MLModel modelWithContentsOfURL:contentURL
                                          configuration:configuration
                                                  error:error];
     if (!mlModel) {