fix: Fix UITouch background thread access in SentryTouchTracker (#6584)

philprime · web-flow · commit b79b5529f35f · 2025-10-30T00:39:50.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Fixes
 
+- Fix crash from accessing UITouch instances from background thread in SentryTouchTracker (#6584)
 - Disable SessionSentryReplayIntegration if the environment is unsafe [#6573]
 - Fix crash when last replay info is missing some keys [#6577]
 
diff --git a/Sources/Swift/Integrations/SessionReplay/SentryTouchTracker.swift b/Sources/Swift/Integrations/SessionReplay/SentryTouchTracker.swift
@@ -19,22 +19,36 @@ import UIKit
     
     private final class TouchInfo {
         let id: Int
+        let identifier: ObjectIdentifier
         
         var startEvent: TouchEvent?
         var endEvent: TouchEvent?
         var moveEvents = [TouchEvent]()
         
-        init(id: Int) {
+        init(id: Int, identifier: ObjectIdentifier) {
             self.id = id
+            self.identifier = identifier
         }
     }
     
+    private struct ExtractedTouchData {
+        let identifier: ObjectIdentifier
+        let position: CGPoint
+        let phase: UITouch.Phase
+    }
+    
+    /**
+     * Active touches tracked by ObjectIdentifier for O(1) lookup performance.
+     * ObjectIdentifier can collide when UITouch memory is reused.
+     */
+    private var trackedTouches = [ObjectIdentifier: TouchInfo]()
+    
     /**
-     * Using UITouch as a key because the touch is the same across events
-     * for the same touch. As long we holding the reference no two UITouches
-     * will ever have the same pointer.
+     * Touches that were replaced in trackedTouches due to ObjectIdentifier collision.
+     * Preserves events when UITouch memory is reused before flushFinishedEvents().
      */
-    private var trackedTouches = [UITouch: TouchInfo]()
+    private var orphanedTouches = [TouchInfo]()
+    
     private let dispatchQueue: SentryDispatchQueueWrapper
     private var touchId = 1
     private let dateProvider: SentryCurrentDateProvider
@@ -57,32 +71,65 @@ import UIKit
         guard let touches = event.allTouches else { return }
         let timestamp = event.timestamp
         
+        // Extract touch data on the main thread before dispatching to background queue
+        // to avoid accessing UIKit objects from a background thread
+        let extractedTouches: [ExtractedTouchData] = touches.compactMap { touch in
+            guard touch.phase == .began || touch.phase == .ended || touch.phase == .moved || touch.phase == .cancelled else { return nil }
+            let position = touch.location(in: nil).applying(scale)
+            // There is no way to uniquely identify a touch, so we use the ObjectIdentifier of the UITouch instance.
+            // This is not a perfect solution, but it is the best we can do without holding references to UIKit objects.
+            return ExtractedTouchData(identifier: ObjectIdentifier(touch), position: position, phase: touch.phase)
+        }
+        
         dispatchQueue.dispatchAsync { [self] in
-            for touch in touches {
-                guard touch.phase == .began || touch.phase == .ended || touch.phase == .moved || touch.phase == .cancelled else { continue }
-                let info = trackedTouches[touch] ?? TouchInfo(id: touchId++)
-                let position = touch.location(in: nil).applying(scale)
-                let newEvent = TouchEvent(x: position.x, y: position.y, timestamp: timestamp, phase: touch.phase.toRRWebTouchPhase())
-                
-                switch touch.phase {
-                case .began:
-                    info.startEvent = newEvent
-                case .ended, .cancelled:
-                    info.endEvent = newEvent
-                case .moved:
-                    // If the distance between two points is smaller than 10 points, we don't record the second movement.
-                    // iOS event polling is fast and will capture any movement; we don't need this granularity for replay.
-                    if let last = info.moveEvents.last, touchesDelta(last.point, position) < 10 { continue }
-                    info.moveEvents.append(newEvent)
-                    self.debounceEvents(in: info)
-                default:
-                    continue
-                }
-                trackedTouches[touch] = info
+            for extractedTouch in extractedTouches {
+                processTouchEvent(extractedTouch, timestamp: timestamp)
             }
         }
     }
     
+    private func processTouchEvent(_ extractedTouch: ExtractedTouchData, timestamp: TimeInterval) {
+        let info: TouchInfo
+        
+        if extractedTouch.phase == .began {
+            // Check for ObjectIdentifier collision - if touch already exists, orphan it
+            if let existingTouch = trackedTouches[extractedTouch.identifier] {
+                orphanedTouches.append(existingTouch)
+            }
+            
+            // Create new TouchInfo for .began
+            info = TouchInfo(id: touchId++, identifier: extractedTouch.identifier)
+            trackedTouches[extractedTouch.identifier] = info
+        } else {
+            // O(1) dictionary lookup for non-.began phases
+            if let existingInfo = trackedTouches[extractedTouch.identifier] {
+                info = existingInfo
+            } else {
+                // Create new if not found (shouldn't happen, but handle gracefully)
+                info = TouchInfo(id: touchId++, identifier: extractedTouch.identifier)
+                trackedTouches[extractedTouch.identifier] = info
+            }
+        }
+        
+        let position = extractedTouch.position
+        let newEvent = TouchEvent(x: position.x, y: position.y, timestamp: timestamp, phase: extractedTouch.phase.toRRWebTouchPhase())
+        
+        switch extractedTouch.phase {
+        case .began:
+            info.startEvent = newEvent
+        case .ended, .cancelled:
+            info.endEvent = newEvent
+        case .moved:
+            // If the distance between two points is smaller than 10 points, we don't record the second movement.
+            // iOS event polling is fast and will capture any movement; we don't need this granularity for replay.
+            if let last = info.moveEvents.last, touchesDelta(last.point, position) < 10 { return }
+            info.moveEvents.append(newEvent)
+            self.debounceEvents(in: info)
+        default:
+            return
+        }
+    }
+    
     private func touchesDelta(_ lastTouch: CGPoint, _ newTouch: CGPoint) -> CGFloat {
         let dx = newTouch.x - lastTouch.x
         let dy = newTouch.y - lastTouch.y
@@ -121,6 +168,7 @@ import UIKit
         SentrySDKLog.debug("[Session Replay] Flushing finished events")
         dispatchQueue.dispatchSync { [self] in
             trackedTouches = trackedTouches.filter { $0.value.endEvent == nil }
+            orphanedTouches = orphanedTouches.filter { $0.endEvent == nil }
         }
     }
     
@@ -134,7 +182,8 @@ import UIKit
         
         var touches = [TouchInfo]()
         dispatchQueue.dispatchSync { [self] in
-            touches = Array(trackedTouches.values)
+            // Include both active and orphaned touches to preserve all events
+            touches = Array(trackedTouches.values) + orphanedTouches
         }
         
         for info in touches {
diff --git a/Tests/SentryTests/Integrations/SessionReplay/SentryTouchTrackerTests.swift b/Tests/SentryTests/Integrations/SessionReplay/SentryTouchTrackerTests.swift
@@ -342,5 +342,172 @@ class SentryTouchTrackerTests: XCTestCase {
         // Assert
         wait(for: [addExp, removeExp, readExp], timeout: 5)
     }
+    
+    func testObjectIdentifierCollision_NewTouchGetsNewId() {
+        // Arrange
+        // This test simulates ObjectIdentifier collision when UITouch memory is reused.
+        // When iOS reuses memory for a new UITouch at the same address as a previous touch,
+        // the ObjectIdentifier will be the same, but it's actually a different touch gesture.
+        let sut = getSut()
+        let touch = MockUITouch(phase: .began, location: CGPoint(x: 100, y: 100))
+        
+        // Act - First touch lifecycle (began -> moved -> ended)
+        let event1 = MockUIEvent(timestamp: 1)
+        event1.addTouch(touch)
+        sut.trackTouchFrom(event: event1)
+        
+        touch.phase = .moved
+        touch.location = CGPoint(x: 150, y: 150)
+        let event2 = MockUIEvent(timestamp: 2)
+        event2.addTouch(touch)
+        sut.trackTouchFrom(event: event2)
+        
+        touch.phase = .ended
+        touch.location = CGPoint(x: 200, y: 200)
+        let event3 = MockUIEvent(timestamp: 3)
+        event3.addTouch(touch)
+        sut.trackTouchFrom(event: event3)
+        
+        // Get events from first touch before they're overwritten
+        let firstTouchEvents = sut.replayEvents(from: referenceDate, until: referenceDate.addingTimeInterval(10))
+        
+        // In real-world usage, flushFinishedEvents would be called periodically
+        // This removes finished touches from trackedTouches
+        sut.flushFinishedEvents()
+        
+        // Simulate memory reuse: same UITouch object starts a NEW touch gesture
+        // In reality this would be a new UITouch at the same memory address,
+        // but for testing we can use the same object with .began phase at a different location
+        touch.phase = .began
+        touch.location = CGPoint(x: 50, y: 50)  // Different location - this is a NEW touch
+        let event4 = MockUIEvent(timestamp: 4)
+        event4.addTouch(touch)
+        sut.trackTouchFrom(event: event4)
+        
+        touch.phase = .ended
+        touch.location = CGPoint(x: 75, y: 75)
+        let event5 = MockUIEvent(timestamp: 5)
+        event5.addTouch(touch)
+        sut.trackTouchFrom(event: event5)
+        
+        // Get second touch events
+        let secondTouchEvents = sut.replayEvents(from: referenceDate, until: referenceDate.addingTimeInterval(10))
+        
+        // Assert - First touch (captured before flush)
+        XCTAssertEqual(firstTouchEvents.count, 3, "First touch should have 3 events: start, move, end")
+        
+        let firstTouchStart = firstTouchEvents[0].data
+        let firstTouchPointerId = firstTouchStart?["pointerId"] as? Int
+        XCTAssertEqual(firstTouchStart?["x"] as? Float, 100)
+        XCTAssertEqual(firstTouchStart?["y"] as? Float, 100)
+        XCTAssertEqual(firstTouchStart?["type"] as? Int, TouchEventPhase.start.rawValue)
+        XCTAssertEqual(firstTouchPointerId, 1, "First touch should have pointer ID 1")
+        
+        let firstTouchMove = firstTouchEvents[1].data
+        XCTAssertEqual(firstTouchMove?["pointerId"] as? Int, firstTouchPointerId)
+        
+        let firstTouchEnd = firstTouchEvents[2].data
+        XCTAssertEqual(firstTouchEnd?["x"] as? Float, 200)
+        XCTAssertEqual(firstTouchEnd?["y"] as? Float, 200)
+        XCTAssertEqual(firstTouchEnd?["type"] as? Int, TouchEventPhase.end.rawValue)
+        XCTAssertEqual(firstTouchEnd?["pointerId"] as? Int, firstTouchPointerId)
+        
+        // Assert - Second touch (after collision)
+        XCTAssertEqual(secondTouchEvents.count, 2, "Second touch should have 2 events: start, end")
+        
+        let secondTouchStart = secondTouchEvents[0].data
+        let secondTouchPointerId = secondTouchStart?["pointerId"] as? Int
+        XCTAssertEqual(secondTouchStart?["x"] as? Float, 50)
+        XCTAssertEqual(secondTouchStart?["y"] as? Float, 50)
+        XCTAssertEqual(secondTouchStart?["type"] as? Int, TouchEventPhase.start.rawValue)
+        XCTAssertEqual(secondTouchPointerId, 2, "Second touch should have pointer ID 2")
+        
+        let secondTouchEnd = secondTouchEvents[1].data
+        XCTAssertEqual(secondTouchEnd?["x"] as? Float, 75)
+        XCTAssertEqual(secondTouchEnd?["y"] as? Float, 75)
+        XCTAssertEqual(secondTouchEnd?["type"] as? Int, TouchEventPhase.end.rawValue)
+        XCTAssertEqual(secondTouchEnd?["pointerId"] as? Int, secondTouchPointerId)
+        
+        // Critical assertion: The two touches should have DIFFERENT pointer IDs
+        XCTAssertNotEqual(firstTouchPointerId, secondTouchPointerId,
+                         "Memory-reused touch should get a new pointer ID, not inherit the old one")
+    }
+    
+    func testObjectIdentifierCollision_WithoutFlush_DoesNotOrphanEvents() {
+        // Arrange
+        // This test covers the case where a collision happens BEFORE flushFinishedEvents()
+        // The old touch's events should still be accessible, not orphaned
+        let sut = getSut()
+        let touch = MockUITouch(phase: .began, location: CGPoint(x: 100, y: 100))
+        
+        // Act - First touch begins but doesn't end
+        let event1 = MockUIEvent(timestamp: 1)
+        event1.addTouch(touch)
+        sut.trackTouchFrom(event: event1)
+        
+        touch.phase = .moved
+        touch.location = CGPoint(x: 150, y: 150)
+        let event2 = MockUIEvent(timestamp: 2)
+        event2.addTouch(touch)
+        sut.trackTouchFrom(event: event2)
+        
+        // Collision happens BEFORE first touch ends and BEFORE flush
+        // Same ObjectIdentifier starts a NEW touch
+        touch.phase = .began
+        touch.location = CGPoint(x: 50, y: 50)
+        let event3 = MockUIEvent(timestamp: 3)
+        event3.addTouch(touch)
+        sut.trackTouchFrom(event: event3)
+        
+        touch.phase = .ended
+        touch.location = CGPoint(x: 75, y: 75)
+        let event4 = MockUIEvent(timestamp: 4)
+        event4.addTouch(touch)
+        sut.trackTouchFrom(event: event4)
+        
+        // Assert
+        let result = sut.replayEvents(from: referenceDate, until: referenceDate.addingTimeInterval(10))
+        
+        // We should have events from BOTH touches, even though the first didn't end:
+        // - Touch 1 start at (100, 100)
+        // - Touch 1 move at (150, 150)
+        // - Touch 2 start at (50, 50)  <- collision without flush
+        // - Touch 2 end at (75, 75)
+        //
+        // The first touch's events should NOT be orphaned/lost
+        
+        XCTAssertEqual(result.count, 4, "Should have 4 events: both touches' events should be preserved")
+        
+        // First touch events (incomplete, no end)
+        let firstTouchStart = result[0].data
+        let firstTouchPointerId = firstTouchStart?["pointerId"] as? Int
+        XCTAssertEqual(firstTouchStart?["x"] as? Float, 100)
+        XCTAssertEqual(firstTouchStart?["y"] as? Float, 100)
+        XCTAssertEqual(firstTouchStart?["type"] as? Int, TouchEventPhase.start.rawValue)
+        
+        let firstTouchMove = result[1].data
+        XCTAssertEqual(firstTouchMove?["pointerId"] as? Int, firstTouchPointerId)
+        let positions = firstTouchMove?["positions"] as? [[String: Any]]
+        XCTAssertEqual(positions?.first?["x"] as? Float, 150)
+        XCTAssertEqual(positions?.first?["y"] as? Float, 150)
+        
+        // Second touch events (after collision)
+        let secondTouchStart = result[2].data
+        let secondTouchPointerId = secondTouchStart?["pointerId"] as? Int
+        XCTAssertEqual(secondTouchStart?["x"] as? Float, 50)
+        XCTAssertEqual(secondTouchStart?["y"] as? Float, 50)
+        XCTAssertEqual(secondTouchStart?["type"] as? Int, TouchEventPhase.start.rawValue)
+        
+        let secondTouchEnd = result[3].data
+        XCTAssertEqual(secondTouchEnd?["x"] as? Float, 75)
+        XCTAssertEqual(secondTouchEnd?["y"] as? Float, 75)
+        XCTAssertEqual(secondTouchEnd?["type"] as? Int, TouchEventPhase.end.rawValue)
+        XCTAssertEqual(secondTouchEnd?["pointerId"] as? Int, secondTouchPointerId)
+        
+        // Critical assertion: Different IDs and NO orphaned events
+        XCTAssertNotEqual(firstTouchPointerId, secondTouchPointerId,
+                         "Touches should have different IDs")
+        XCTAssertNotNil(firstTouchPointerId, "First touch events should not be orphaned")
+    }
 }
 #endif
