[CI] NativeAOT CGImageMetadataTest crashes retaining CGImageMetadataTag proxy

[dalexsoto]

Summary

MonoTouchFixtures.CoreGraphics.CGImageMetadataTest.EnumerateMetadata intermittently crashes in NativeAOT while constructing and retaining a CGImageMetadataTag proxy returned by CGImageMetadataEnumerateTagsUsingBlock.

• Stable signature: iOS simulator NativeAOT CGImageMetadataTest.EnumerateMetadata crashes in CGImageMetadataTag proxy retain (objc_retain EXC_BAD_ACCESS/SIGSEGV)
• Classification: genuine intermittent NativeAOT interop/product crash
• Distinct monitored PRs: 2
• Confirmed occurrences: 3
• First retained occurrence: 2026-09-01
• Latest occurrence: 2026-09-02T18:16:42Z

Confirmed occurrences

PR #26424

Two different heads reproduced the same crash:

• Head f4d27dbb1d3365e1729bf029041aac72cb8c28cb, build 15118520 attempt 1, T: monotouch_ios.
• Head f405da213809a39a7ae21ec5391237633659b77c, build 15157901 attempt 1, T: monotouch_ios.

A later #26424 head completed its simulator build successfully and the PR merged, consistent with an intermittent failure rather than a deterministic merge regression.

PR #26539

• Head: a279fec7a28ee8515c20640c2c78c7ec8ad11c28
• Build 15185386 attempt 1, T: monotouch_ios / Run tests
• Worker: AcesShared 159
• Configuration: iOS simulator Release, trimmable static registrar, NativeAOT
• Simulator: iPhone 14 / iOS 26.5
• Exception: EXC_BAD_ACCESS, SIGSEGV, invalid address in objc_retain
• Faulting stack:
  • objc_retain
  • CFObject.CFRetain
  • NativeObject.Retain
  • CGImageMetadataTag proxy CreateObject
  • Runtime.ConstructINativeObject
  • Runtime.GetINativeObject
  • CGImageMetadata.TagEnumerator
  • CGImageMetadataEnumerateTagsUsingBlock
  • CGImageMetadataTest.EnumerateMetadata

PR #26539 only changes AppKit enum documentation and documentation-test baselines, which are unrelated to CoreGraphics, ImageIO, or NativeAOT object construction.

Impact and reproduction pattern

The crash terminates the entire NativeAOT test application, loses the rest of that configuration’s test results, and fails monotouch_ios. The same managed test and native proxy-retain stack have occurred on multiple heads and unrelated PRs.

Investigation

The Azure timelines, TestSummary and HTML artifacts, raw .ips crash report, faulting-thread image map, retained occurrence ledger, PR file lists, and later passing build progression were compared. The newest run also contains a separate NativeAOT CTLineTests.EnumerateCaretOffsets Objective-C cache abort; that is a different signature and is not grouped here.

Separate searches across every open and closed issue used the exact test name, CGImageMetadataTag, objc_retain, CGImageMetadataEnumerateTagsUsingBlock, proxy construction, and NativeAOT terms. No matching issue was found.

Current diagnosis and workaround

The native callback supplies a metadata-tag handle that is invalid by the time the generated proxy path calls CFRetain/objc_retain, or its ownership classification is intermittently incorrect. The exact lifetime transition is unresolved.

The current workaround is an evidence-backed simulator-stage retry when the parent run is terminal and no deterministic failure would be rerun. Useful follow-up diagnostics would record the callback-provided handle, ownership flag, native type, proxy creation path, and retain timing before dereferencing it.

Azure logs and artifacts are retention-limited.

[dalexsoto]

Retry update for PR #26539 @ a279fec7a28ee8515c20640c2c78c7ec8ad11c28:

• Build 15185386 attempt 1 completed failed after T: monotouch_ios produced the CGImageMetadataTest.EnumerateMetadata proxy-retain crash documented above and a separate CTLineTests.EnumerateCaretOffsets Objective-C cache-corruption abort.
• The unchanged head is conflict-free. The only failed simulator job was monotouch_ios; the PR has one automatic simulator build and no observable prior retries.
• The monitor requested the Azure DevOps equivalent of Rerun failed jobs for simulator_tests (forceRetryAllJobs: false). Azure accepted it and created simulator stage attempt 2; monotouch_ios is currently active.
• Retry usage is 1 lifetime / 1 for this head.

The issue body has no Additional info to collect checklist. The retry outcome will be reported when attempt 2 reaches a terminal state.

[dalexsoto]

Retry outcome for PR #26539 @ a279fec7a28ee8515c20640c2c78c7ec8ad11c28:

• T: monotouch_ios attempt 2 succeeded on AcesShared 2, running from 2026-09-02T19:05:08Z to 21:06:22Z.
• Simulator stage attempt 2 completed successfully at 21:06:31Z; build 15185386 completed successfully at 21:10:21Z.
• Neither the CGImageMetadataTest.EnumerateMetadata proxy-retain crash nor the separate CTLineTests.EnumerateCaretOffsets Objective-C cache abort recurred.
• PR [AppKit] Document ten AppKit enum types #26539 merged at 21:11:26Z.
• Retry accounting remains 1 lifetime / 1 for this head.

The canonical count remains 3 confirmed CGImageMetadata occurrences across 2 PRs. The issue body has no Additional info to collect checklist.

[dalexsoto]

New occurrence and retry update for PR #26561 @ 626d112132dd1e8962770958258776cb20c3c0a9:

• Simulator build 15213246 attempt 1, T: monotouch_ios / Run tests crashed in iOS simulator Release NativeAOT on AcesShared 65.
• Simulator: iPhone 14 / iOS 26.5.
• Exception: EXC_BAD_ACCESS / SIGSEGV / KERN_INVALID_ADDRESS; termination signal 11.
• Faulting stack:
  • objc_retain
  • CFObject.CFRetain
  • NativeObject.Retain
  • CGImageMetadataTag proxy CreateObject
  • Runtime.ConstructINativeObject
  • Runtime.GetINativeObject
  • CGImageMetadata.TagEnumerator
  • CGImageMetadataTest.EnumerateMetadata
• PR [tests] Test in-proc crash reports on macOS. Fixes #23864. #26561 changes only crash-report tests and their documentation, not CoreGraphics, ImageIO, or NativeAOT proxy lifetime.

This raises the canonical count to 4 confirmed occurrences across 3 distinct monitored PRs (#26424, #26539, and #26561).

The unchanged head is conflict-free, the run is terminal, no equivalent retry existed, and the PR had no observable prior retry. The monitor requested the Azure DevOps equivalent of Rerun failed jobs for simulator_tests (forceRetryAllJobs: false). Azure accepted it and created attempt 2 with only monotouch_ios pending. Retry usage is now 1/25 PR lifetime and 1/10 for this head.

Issue-specific checklist: none; the issue body has no Additional info to collect section.

[dalexsoto]

Retry outcome for PR #26561 @ 626d112132dd1e8962770958258776cb20c3c0a9:

• Build 15213246 attempt 2 reran only the failed T: monotouch_ios job.
• monotouch_ios succeeded from 2026-09-04T12:39:23Z to 14:40:14Z.
• The simulator stage completed successfully at 14:40:24Z.
• Build 15213246 completed successfully at 14:45:15Z.
• Attempt 2 contained no failed, canceled, or succeededWithIssues records.
• The CGImageMetadataTest.EnumerateMetadata objc_retain crash did not recur.
• Retry accounting remains 1/25 PR lifetime and 1/10 for this head.

The canonical count remains 4 confirmed occurrences across 3 monitored PRs.

Issue-specific checklist: none; the issue body has no Additional info to collect section.

[dalexsoto]

PR #26561 merged at 2026-09-04T15:37:20Z after its monotouch_ios retry and simulator stage completed successfully.

The CGImageMetadataTest.EnumerateMetadata NativeAOT crash did not recur on attempt 2. The canonical count remains 4 confirmed occurrences across 3 monitored PRs, and retry accounting for #26561 remains 1/25 lifetime and 1/10 for head 626d112132dd1e8962770958258776cb20c3c0a9.

Issue-specific checklist: none; the issue body has no Additional info to collect section.