Skip to content

Commit 7771d96

Browse files
authored
Memory leak in deallocator for ANE (#134)
### Why is this change needed? <!-- Explain the motivation for this change. What problem does it solve? --> From a developer ``` "Thread 19 crashed inside objc_retain while CoreML was trying to access an MLFeatureValue / MLMultiArray during async prediction. The crash is a SIGSEGV / KERN_INVALID_ADDRESS at an address that is not mapped → classic use-after-free / accessing deallocated memory. Load of the backtrace shows CoreML code paths (- [MLFeatureValue multiArrayValue], MLE5InputPortBinder bindMemoryObjectForFeatureValue:, MLE5ExecutionStreamOperation … prepareAsyncSubmissionForInputFeatures:) — i.e. CoreML is preparing inputs for an async execution and tried to retain an Objective-C object that was already freed. So: you passed a feature value / multiarray to CoreML, CoreML used it asynchronously, but the Swift/ObjC object backing that data was deallocated earlier (or concurrently mutated in an unsafe way). That triggered an invalid pointer dereference when CoreML tried to retain/read it." ```
1 parent 1dd434b commit 7771d96

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

Sources/FluidAudio/Shared/ANEMemoryUtils.swift

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import Accelerate
22
import CoreML
3+
import Darwin
34
import Foundation
45
import Metal
56

@@ -66,7 +67,8 @@ public enum ANEMemoryUtils {
6667
dataType: dataType,
6768
strides: strides,
6869
deallocator: { bytes in
69-
bytes.deallocate()
70+
// `posix_memalign` requires `free` for cleanup; `deallocate()` would trap.
71+
Darwin.free(bytes)
7072
}
7173
)
7274

0 commit comments

Comments
 (0)