For a long time our app had this creation of a URLRequest:
var urlRequest = URLRequest(url: url, cachePolicy: .reloadIgnoringLocalAndRemoteCacheData, timeoutInterval: timeout)
But since iOS 26 was released we started to get crashes in this call. It is created on a background thread.
Thread 10 Crashed:
0 libsystem_malloc.dylib 0x00000001920e309c _xzm_xzone_malloc_freelist_outlined + 864 (xzone_malloc.c:1869)
1 libswiftCore.dylib 0x0000000184030360 swift::swift_slowAllocTyped(unsigned long, unsigned long, unsigned long long) + 56 (Heap.cpp:110)
2 libswiftCore.dylib 0x0000000184030754 swift_allocObject + 136 (HeapObject.cpp:245)
3 Foundation 0x00000001845dab9c specialized _ArrayBuffer._consumeAndCreateNew(bufferIsUnique:minimumCapacity:growForAppend:) + 120
4 Foundation 0x00000001845daa58 specialized static _SwiftURL._makeCFURL(from:baseURL:) + 2288 (URL_Swift.swift:1192)
5 Foundation 0x00000001845da118 closure #1 in _SwiftURL._nsurl.getter + 112 (URL_Swift.swift:64)
6 Foundation 0x00000001845da160 partial apply for closure #1 in _SwiftURL._nsurl.getter + 20 (<compiler-generated>:0)
7 Foundation 0x00000001845da0a0 closure #1 in _SwiftURL._nsurl.getterpartial apply + 16
8 Foundation 0x00000001845d9a6c protocol witness for _URLProtocol.bridgeToNSURL() in conformance _SwiftURL + 196 (<compiler-generated>:974)
9 Foundation 0x000000018470f31c URLRequest.init(url:cachePolicy:timeoutInterval:) + 92 (URLRequest.swift:44)# Live For Studio
Any idea if this crash is caused by our code or if it is a known problem in iOS 26?
I have attached one of the crash reports from Xcode:
[For those following along at home, I got a non-corrupted copy of bims’s crash report via other means.]
Consider the crashing thread backtrace:
0 libsystem_malloc.dylib … _xzm_xzone_malloc_freelist_outlined + 864 (xzone_malloc.c:1869)
1 libswiftCore.dylib … swift::swift_slowAllocTyped(unsigned long, unsigned long, unsigned long long) + 56 …
2 libswiftCore.dylib … swift_allocObject + 136 (HeapObject.cpp:245)
3 Foundation … specialized _ArrayBuffer._consumeAndCreateNew(bufferIsUnique:minimumCapacity:growFo…
… …
9 Foundation … URLRequest.init(url:cachePolicy:timeoutInterval:) + 92 (URLRequest.swift:44)
10 Live … Fetcher.fetchData(withPathAndQuery:httpHeaderFields:for:withTimeout:andCompletion:)…
Frame 10 shows your code creating a URLRequest, frames 9 through 3 are it working its way through Foundation, frames 2 and 1 are the Swift runtime, and frame 0 is the system memory allocator.
Unfortunately I just updated my iOS 26 test device to iOS 26.1, so it’s hard to be 100% sure what’s going on here. However, I suspect that iOS 26.1 and 26.0 have basically the same code, and if you disassemble the crashing instruction on iOS 26.1 you see tihs:
(lldb) disas -n _xzm_xzone_malloc_freelist_outlined
libsystem_malloc.dylib`_xzm_xzone_malloc_freelist_outlined:
…
0x192a19078 <+828>: mov x8, x4
0x192a1907c <+832>: stp x20, x21, [sp, #-0x10]!
0x192a19080 <+836>: adrp x20, 60
0x192a19084 <+840>: add x20, x20, #0xc6c ; "BUG IN CLIENT OF LIBMALLOC: memory corruption of free block"
0x192a19088 <+844>: adrp x21, 378706
0x192a1908c <+848>: add x21, x21, #0x638 ; gCRAnnotations
0x192a19090 <+852>: str x20, [x21, #0x8]
0x192a19094 <+856>: str x8, [x21, #0x38]
0x192a19098 <+860>: ldp x20, x21, [sp], #0x10
0x192a1909c <+864>: brk #0x1
…
Note the brk instruction at +864. That gels with this line from your crash report:
Exception Type: EXC_BREAKPOINT (SIGTRAP)
So, the memory allocator has trapped. And the message at +840 is pretty darned suspicious.
Next, look at thread 11:
Thread 11:
0 libsystem_malloc.dylib … _xzm_free_abort + 36 (xzone_malloc.c:2311)
1 libsystem_malloc.dylib … _xzm_free + 1340 (xzone_malloc.c:4739)
2 libsystem_blocks.dylib … _Block_release + 260 (runtime.cpp:1019)
3 libdispatch.dylib … _dispatch_client_callout + 16 (client_callout.mm:85)
4 libdispatch.dylib … <deduplicated_symbol> + 32 (:-1)
5 libdispatch.dylib … _dispatch_workloop_invoke + 1980 (queue.c:4761)
6 libdispatch.dylib … _dispatch_root_queue_drain_deferred_wlh + 292 (queue.c:7265)
7 libdispatch.dylib … _dispatch_workloop_worker_thread + 692 (queue.c:6859)
8 libsystem_pthread.dylib … _pthread_wqthread + 292 (pthread.c:2696)
9 libsystem_pthread.dylib … start_wqthread + 8 (:-1)
Frame 1 shows that some is freeing memory and frame 0 shows that the memory allocator is just about to abort.
So, threads 10 and 11 have both trapped due to memory corruption. That seems like a smoking gun.
As to what’s caused that memory corruption, it’s hard to say. My advice in such situations is to run your program under the standard memory debugging tools. These can help make the problem more reproducible, and reliably reproducing the problem is key to investigations like this.
Oh, and if you have a shiny new iPhone 17, try enabling MTE. That’s can be really helpful in situations like this. See Enabling enhanced security for your app for more.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"