Skip to content

Guard nil asset.contentURL in ETCoreMLModel initWithAsset:#20338

Merged
meta-codesync[bot] merged 1 commit into
pytorch:mainfrom
KushalAdhvaryu:export-D108334793
Jun 17, 2026
Merged

Guard nil asset.contentURL in ETCoreMLModel initWithAsset:#20338
meta-codesync[bot] merged 1 commit into
pytorch:mainfrom
KushalAdhvaryu:export-D108334793

Conversation

@KushalAdhvaryu

@KushalAdhvaryu KushalAdhvaryu commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Summary:
Fixes EXC_BAD_ACCESS / KERN_INVALID_ADDRESS in -[ETCoreMLModel initWithAsset:configuration:orderedInputNames:orderedOutputNames:error:] at xplat/executorch/backends/apple/coreml/runtime/delegate/ETCoreMLModel.mm:197.

Root cause: the initializer calls [asset keepAliveAndReturnError:] which validates the asset's file lock but does not validate that asset.contentURL is non-nil. When the compiled .mlmodelc was reaped from disk between the lock and the load (or the asset was never fully materialized), asset.contentURL returns nil. +[MLModel modelWithContentsOfURL:configuration:error:] does not tolerate a nil URL — it deref's into CoreML internals and faults.

Fix: capture asset.contentURL into a local, return nil with ETCoreMLErrorCorruptedModel populated in the out-error if the URL is nil. No behavior change for valid assets — callers already handle the documented nil + error contract.

Reviewed By: metascroy

Differential Revision: D108334793

Summary:
Fixes EXC_BAD_ACCESS / KERN_INVALID_ADDRESS in `-[ETCoreMLModel initWithAsset:configuration:orderedInputNames:orderedOutputNames:error:]` at `xplat/executorch/backends/apple/coreml/runtime/delegate/ETCoreMLModel.mm:197`.

MID: `2bcd0a9cec05c99079249d043c273b07` — https://www.internalfb.com/logview/facebook_ios_fads/2bcd0a9cec05c99079249d043c273b07

Context from MID: 3,094 occurrences in the past 7 days, first seen 2026-04-01, last seen 2026-06-11. Surfaced in the `FBVideoHomeUnifiedPlayerViewController:warion_vdd_feed` Scuba slice (https://fburl.com/scuba/errorreporting_facebook_ios_fads/0x31y7si) but the actual fault is in the ExecuTorch CoreML delegate, not the player VC.

Root cause: the initializer calls `[asset keepAliveAndReturnError:]` which validates the asset's file lock but does not validate that `asset.contentURL` is non-nil. When the compiled `.mlmodelc` was reaped from disk between the lock and the load (or the asset was never fully materialized), `asset.contentURL` returns nil. `+[MLModel modelWithContentsOfURL:configuration:error:]` does not tolerate a nil URL — it deref's into CoreML internals and faults.

Fix: capture `asset.contentURL` into a local, return nil with `ETCoreMLErrorCorruptedModel` populated in the out-error if the URL is nil. No behavior change for valid assets — callers already handle the documented `nil` + `error` contract.

Reviewed By: metascroy

Differential Revision: D108334793
@pytorch-bot

pytorch-bot Bot commented Jun 17, 2026

Copy link
Copy Markdown

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/20338

Note: Links to docs will display an error until the docs builds have been completed.

❌ 4 New Failures, 1 Pending, 1 Unrelated Failure

As of commit 8cce690 with merge base 0eb8247 (image):

NEW FAILURES - The following jobs have failed:

FLAKY - The following job failed but was likely due to flakiness present on trunk:

This comment was automatically generated by Dr. CI and updates every 15 minutes.

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Jun 17, 2026
@meta-codesync

meta-codesync Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

@KushalAdhvaryu has exported this pull request. If you are a Meta employee, you can view the originating Diff in D108334793.

@linux-foundation-easycla

Copy link
Copy Markdown

CLA Missing ID

  • ❌ The email address for the commit (8cce690) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.

@github-actions

Copy link
Copy Markdown

This PR needs a release notes: label

If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.

To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"

For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.

@cymbalrush cymbalrush left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@meta-codesync meta-codesync Bot merged commit 03ed98b into pytorch:main Jun 17, 2026
192 of 207 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. meta-exported

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants