From 76d70249fe87642ff78ddc9324b0fd4e6f56ddfd Mon Sep 17 00:00:00 2001 From: Kushal Adhvaryu Date: Wed, 17 Jun 2026 09:32:02 -0700 Subject: [PATCH] Guard nil `asset.contentURL` in `ETCoreMLModel initWithAsset:` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Summary: Fixes EXC_BAD_ACCESS / KERN_INVALID_ADDRESS in `-[ETCoreMLModel initWithAsset:configuration:orderedInputNames:orderedOutputNames:error:]` at `xplat/executorch/backends/apple/coreml/runtime/delegate/ETCoreMLModel.mm:197`. MID: `2bcd0a9cec05c99079249d043c273b07` — https://www.internalfb.com/logview/facebook_ios_fads/2bcd0a9cec05c99079249d043c273b07 Context from MID: 3,094 occurrences in the past 7 days, first seen 2026-04-01, last seen 2026-06-11. Surfaced in the `FBVideoHomeUnifiedPlayerViewController:warion_vdd_feed` Scuba slice (https://fburl.com/scuba/errorreporting_facebook_ios_fads/0x31y7si) but the actual fault is in the ExecuTorch CoreML delegate, not the player VC. Root cause: the initializer calls `[asset keepAliveAndReturnError:]` which validates the asset's file lock but does not validate that `asset.contentURL` is non-nil. When the compiled `.mlmodelc` was reaped from disk between the lock and the load (or the asset was never fully materialized), `asset.contentURL` returns nil. `+[MLModel modelWithContentsOfURL:configuration:error:]` does not tolerate a nil URL — it deref's into CoreML internals and faults. Fix: capture `asset.contentURL` into a local, return nil with `ETCoreMLErrorCorruptedModel` populated in the out-error if the URL is nil. No behavior change for valid assets — callers already handle the documented `nil` + `error` contract. Differential Revision: D108334793 --- .../apple/coreml/runtime/delegate/ETCoreMLModel.mm | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/backends/apple/coreml/runtime/delegate/ETCoreMLModel.mm b/backends/apple/coreml/runtime/delegate/ETCoreMLModel.mm index d4d2b584821..206714768b1 100644 --- a/backends/apple/coreml/runtime/delegate/ETCoreMLModel.mm +++ b/backends/apple/coreml/runtime/delegate/ETCoreMLModel.mm @@ -194,7 +194,15 @@ - (nullable instancetype)initWithAsset:(ETCoreMLAsset *)asset return nil; } - MLModel *mlModel = [MLModel modelWithContentsOfURL:asset.contentURL + NSURL *contentURL = asset.contentURL; + if (contentURL == nil) { + ETCoreMLLogErrorAndSetNSError(error, + ETCoreMLErrorCorruptedModel, + "asset.contentURL is nil"); + return nil; + } + + MLModel *mlModel = [MLModel modelWithContentsOfURL:contentURL configuration:configuration error:error]; if (!mlModel) {