Skip to content

Fix use-after-free when mic and system transcription run concurrently#473

Merged
Alex-Wengg merged 3 commits intoFluidInference:mainfrom
dloomis:fix/concurrent-decoder-state-reset
Apr 1, 2026
Merged

Fix use-after-free when mic and system transcription run concurrently#473
Alex-Wengg merged 3 commits intoFluidInference:mainfrom
dloomis:fix/concurrent-decoder-state-reset

Conversation

@dloomis
Copy link
Copy Markdown
Contributor

@dloomis dloomis commented Mar 30, 2026

Summary

  • transcribe(_:source:) calls resetDecoderState() after each transcription, which resets both mic and system decoder states. When two sources transcribe concurrently (e.g. mic + system audio in a meeting recorder), whichever task finishes first frees the other source's in-flight MLMultiArray objects (hidden/cell states), causing EXC_BAD_ACCESS in the autorelease pool on the cooperative thread pool.
  • Fix: call resetDecoderState(for: source) instead, so only the completed source's state is reset.

Crash details

Thread 12 Crashed (com.apple.root.default-qos.cooperative):
  objc_release → AutoreleasePoolPage::releaseUntil → objc_autoreleasePoolPop
  → swift::runJobInEstablishedExecutorContext

Thread 13 (com.apple.coreml.DefaultAsyncPredictionQueue):
  -[MLE5Engine _predictionFromFeatures:options:completionHandler:]
  (still using freed MLMultiArray from reset)

Register x1 referenced OBJC_CLASS_$_MLMultiArray; poison values 0xa1a1a1a1 / 0xa3a3a3a3 confirmed use-after-free.

Test plan

  • Verify concurrent mic + system transcription no longer crashes
  • Verify single-source transcription still resets state correctly
  • Verify batch/streaming transcription (single source) is unaffected

🤖 Generated with Claude Code


Open with Devin

resetDecoderState() resets both mic and system decoder states. When two
sources transcribe concurrently, whichever finishes first frees the
other source's in-flight MLMultiArray objects (hidden/cell states),
causing EXC_BAD_ACCESS in the autorelease pool on the cooperative
thread pool.

Only reset the decoder state for the source that just completed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
devin-ai-integration[bot]

This comment was marked as resolved.

dloomis and others added 2 commits March 30, 2026 14:30
Also calls resetDecoderState() (both sources) after completion.
Apply the same per-source fix.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@Alex-Wengg Alex-Wengg merged commit d4e203c into FluidInference:main Apr 1, 2026
13 of 14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants