Crash while fetching the auth token

[saurabh-iOS2]

Description

We are getting crashes when firebase internally triggers Auth.getToken(forcingRefresh:completion:) pointing to Crashed: com.google.firebase.auth.globalWorkQueue EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x00000002d041d090

Reproducing the issue

This is happening for our production users across app versions, we are using 11.9.0 version of firebase via cocoa pods

Firebase SDK Version

11.9.0

Xcode Version

16.1

Installation Method

CocoaPods

Firebase Product(s)

Crashlytics, Firestore, AB Testing, Analytics, App Distribution, Performance, Remote Config

Targeted Platforms

iOS

Relevant Log Output

Crashed: com.google.firebase.auth.globalWorkQueue
0  libobjc.A.dylib                0x1b50 objc_release_x0 + 16
1  libobjc.A.dylib                0x1b50 objc_release + 16
2  Porter                         0xd61c2c closure #1 in Auth.getToken(forcingRefresh:completion:) + 1594 (User.swift:1594)
3  Porter                         0x14880 thunk for @escaping @callee_guaranteed @Sendable () -> () + 4306913408 (<compiler-generated>:4306913408)
4  libdispatch.dylib              0x1aac _dispatch_call_block_and_release + 32
5  libdispatch.dylib              0x1b584 _dispatch_client_callout + 16
6  libdispatch.dylib              0xa2d0 _dispatch_lane_serial_drain + 740
7  libdispatch.dylib              0xadac _dispatch_lane_invoke + 388
8  libdispatch.dylib              0x151dc _dispatch_root_queue_drain_deferred_wlh + 292
9  libdispatch.dylib              0x14a60 _dispatch_workloop_worker_thread + 540
10 libsystem_pthread.dylib        0x4660 _pthread_wqthread + 292
11 libsystem_pthread.dylib        0x19f8 start_wqthread + 8

If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

Replace this line with the contents of your Package.resolved.

If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

  - Firebase/Analytics (11.9.0):
    - Firebase/Core
  - Firebase/Auth (11.9.0):
    - Firebase/CoreOnly
    - FirebaseAuth (~> 11.9.0)
  - Firebase/Core (11.9.0):
    - Firebase/CoreOnly
    - FirebaseAnalytics (~> 11.9.0)
  - Firebase/CoreOnly (11.9.0):
    - FirebaseCore (~> 11.9.0)
  - Firebase/Crashlytics (11.9.0):
    - Firebase/CoreOnly
    - FirebaseCrashlytics (~> 11.9.0)
  - Firebase/Firestore (11.9.0):
    - Firebase/CoreOnly
    - FirebaseFirestore (~> 11.9.0)
  - FirebaseABTesting (11.9.0):
    - FirebaseCore (~> 11.9.0)
  - FirebaseAnalytics (11.9.0):
    - FirebaseAnalytics/AdIdSupport (= 11.9.0)
    - FirebaseCore (~> 11.9.0)
    - FirebaseInstallations (~> 11.0)
    - GoogleUtilities/AppDelegateSwizzler (~> 8.0)
    - GoogleUtilities/MethodSwizzler (~> 8.0)
    - GoogleUtilities/Network (~> 8.0)
    - "GoogleUtilities/NSData+zlib (~> 8.0)"
    - nanopb (~> 3.30910.0)
  - FirebaseAnalytics/AdIdSupport (11.9.0):
    - FirebaseCore (~> 11.9.0)
    - FirebaseInstallations (~> 11.0)
    - GoogleAppMeasurement (= 11.9.0)
    - GoogleUtilities/AppDelegateSwizzler (~> 8.0)
    - GoogleUtilities/MethodSwizzler (~> 8.0)
    - GoogleUtilities/Network (~> 8.0)
    - "GoogleUtilities/NSData+zlib (~> 8.0)"
    - nanopb (~> 3.30910.0)
  - FirebaseAppCheckInterop (11.9.0)
  - FirebaseAuth (11.9.0):
    - FirebaseAppCheckInterop (~> 11.0)
    - FirebaseAuthInterop (~> 11.0)
    - FirebaseCore (~> 11.9.0)
    - FirebaseCoreExtension (~> 11.9.0)
    - GoogleUtilities/AppDelegateSwizzler (~> 8.0)
    - GoogleUtilities/Environment (~> 8.0)
    - GTMSessionFetcher/Core (< 5.0, >= 3.4)
    - RecaptchaInterop (~> 101.0)
  - FirebaseAuthInterop (11.9.0)
  - FirebaseCore (11.9.0):
    - FirebaseCoreInternal (~> 11.9.0)
    - GoogleUtilities/Environment (~> 8.0)
    - GoogleUtilities/Logger (~> 8.0)
  - FirebaseCoreExtension (11.9.0):
    - FirebaseCore (~> 11.9.0)
  - FirebaseCoreInternal (11.9.0):
    - "GoogleUtilities/NSData+zlib (~> 8.0)"
  - FirebaseCrashlytics (11.9.0):
    - FirebaseCore (~> 11.9.0)
    - FirebaseInstallations (~> 11.0)
    - FirebaseRemoteConfigInterop (~> 11.0)
    - FirebaseSessions (~> 11.0)
    - GoogleDataTransport (~> 10.0)
    - GoogleUtilities/Environment (~> 8.0)
    - nanopb (~> 3.30910.0)
    - PromisesObjC (~> 2.4)
  - FirebaseFirestore (11.9.0):
    - FirebaseCore (~> 11.9.0)
    - FirebaseCoreExtension (~> 11.9.0)
    - FirebaseFirestoreInternal (= 11.9.0)
    - FirebaseSharedSwift (~> 11.0)
  - FirebaseFirestoreInternal (11.9.0):
    - abseil/algorithm (~> 1.20240722.0)
    - abseil/base (~> 1.20240722.0)
    - abseil/container/flat_hash_map (~> 1.20240722.0)
    - abseil/memory (~> 1.20240722.0)
    - abseil/meta (~> 1.20240722.0)
    - abseil/strings/strings (~> 1.20240722.0)
    - abseil/time (~> 1.20240722.0)
    - abseil/types (~> 1.20240722.0)
    - FirebaseAppCheckInterop (~> 11.0)
    - FirebaseCore (~> 11.9.0)
    - "gRPC-C++ (~> 1.69.0)"
    - gRPC-Core (~> 1.69.0)
    - leveldb-library (~> 1.22)
    - nanopb (~> 3.30910.0)
  - FirebaseInstallations (11.9.0):
    - FirebaseCore (~> 11.9.0)
    - GoogleUtilities/Environment (~> 8.0)
    - GoogleUtilities/UserDefaults (~> 8.0)
    - PromisesObjC (~> 2.4)
  - FirebasePerformance (11.9.0):
    - FirebaseCore (~> 11.9.0)
    - FirebaseInstallations (~> 11.0)
    - FirebaseRemoteConfig (~> 11.0)
    - FirebaseSessions (~> 11.0)
    - GoogleDataTransport (~> 10.0)
    - GoogleUtilities/Environment (~> 8.0)
    - GoogleUtilities/MethodSwizzler (~> 8.0)
    - GoogleUtilities/UserDefaults (~> 8.0)
    - nanopb (~> 3.30910.0)
  - FirebaseRemoteConfig (11.9.0):
    - FirebaseABTesting (~> 11.0)
    - FirebaseCore (~> 11.9.0)
    - FirebaseInstallations (~> 11.0)
    - FirebaseRemoteConfigInterop (~> 11.0)
    - FirebaseSharedSwift (~> 11.0)
    - GoogleUtilities/Environment (~> 8.0)
    - "GoogleUtilities/NSData+zlib (~> 8.0)"
  - FirebaseRemoteConfigInterop (11.9.0)
  - FirebaseSessions (11.9.0):
    - FirebaseCore (~> 11.9.0)
    - FirebaseCoreExtension (~> 11.9.0)
    - FirebaseInstallations (~> 11.0)
    - GoogleDataTransport (~> 10.0)
    - GoogleUtilities/Environment (~> 8.0)
    - GoogleUtilities/UserDefaults (~> 8.0)
    - nanopb (~> 3.30910.0)
    - PromisesSwift (~> 2.1)
  - FirebaseSharedSwift (11.9.0)

[ncooke3]

Hi @saurabh-iOS2, this crash looks like it may be caused by your app's implementation of the completion handler parameter that's passed to the Auth.getToken(forcingRefresh:completion:) method. Specifically, an already released object is attempting to be released again.

0  libobjc.A.dylib                0x1b50 objc_release_x0 + 16
1  libobjc.A.dylib                0x1b50 objc_release + 16
2  Porter                         0xd61c2c closure #1 in Auth.getToken(forcingRefresh:completion:) + 1594 (User.swift:1594)

[saurabh-iOS2]

Hey @ncooke3 getToken api is internally invoked in FirebaseAuth which thereby provides the completion handler that is consumed downstream and is not being triggered by our app. The documentation explicitly mentions its usage is only for AuthInterop and not for public use. Can you please help resolve this.

/// Retrieves the Firebase authentication token, possibly refreshing it if it has expired. /// /// This method is not for public use. It is for Firebase clients of AuthInterop. @objc(getTokenForcingRefresh:withCallback:) public func getToken(forcingRefresh forceRefresh: Bool, completion callback: @escaping (String?, Error?) -> Void)

[ncooke3]

Apologies for the oversight. I will take a closer look.

[ncooke3]

This looks like a crash within the callback supplied by Firestore's use of Auth interop's getToken API. Perhaps related to the recursive call of GetToken?

firebase-ios-sdk/Firestore/core/src/credentials/firebase_auth_credentials_provider_apple.mm

Lines 75 to 128 in 5902b40

	void FirebaseAuthCredentialsProvider::GetToken(
	TokenListener<AuthToken> completion) {
	HARD_ASSERT(auth_listener_handle_,
	"GetToken cannot be called after listener removed.");
	// Take note of the current value of the token_counter so that this method can
	// fail if there is a token change while the request is outstanding.
	int initial_token_counter = contents_->token_counter;
	std::weak_ptr<Contents> weak_contents = contents_;
	void (^get_token_callback)(NSString*, NSError*) =
	^(NSString* _Nullable token, NSError* _Nullable error) {
	std::shared_ptr<Contents> contents = weak_contents.lock();
	if (!contents) {
	return;
	}
	std::unique_lock<std::mutex> lock(contents->mutex);
	if (initial_token_counter != contents->token_counter) {
	// Cancel the request since the user changed while the request was
	// outstanding so the response is likely for a previous user (which
	// user, we can't be sure).
	LOG_DEBUG("GetToken aborted due to token change.");
	return GetToken(completion);
	} else {
	if (error == nil) {
	if (token != nil) {
	completion(
	AuthToken{util::MakeString(token), contents->current_user});
	} else {
	completion(AuthToken::Unauthenticated());
	}
	} else {
	Error error_code = Error::kErrorUnknown;
	if (error.domain == FIRFirestoreErrorDomain) {
	error_code = static_cast<Error>(error.code);
	}
	completion(util::Status(
	error_code, util::MakeString(error.localizedDescription)));
	}
	}
	};
	// TODO(wilhuff): Need a better abstraction over a missing auth provider.
	if (contents_->auth) {
	[contents_->auth getTokenForcingRefresh:force_refresh_
	withCallback:get_token_callback];
	} else {
	// If there's no Auth provider, call back immediately with a nil
	// (unauthenticated) token.
	get_token_callback(nil, nil);
	}
	force_refresh_ = false;
	}

[saurabh-iOS2]

Seems like it, could you also suggest a solution to address this for Firebase user apps please

[wu-hui]

This particular code path has remain unchanged for years, i am curious what has changed that might have triggered this.

1. Do you have debug logs from the SDK with an instance of this error? If not, is it possible to get logs?
2. Were you able to reproduce this error?
3. When do you start seeing this error, and does it stop at some point or is it still on-going?

Thanks.

[saurabh-iOS2]

Hey @wu-hui
1 & 2. Our users are facing this in production app and currently this amounts to highest number of crashes overall, we did not encounter this in debug environment though
3. The mentioned crash started surfacing from 21st March'25 and is still on-going