Crash in Amplitude Session Replay during display link (weak hash table mutation)

[VladIacobIonut]

Expected Behavior

The app should run smoothly with Amplitude Session Replay enabled, without crashing randomly.

Current Behavior

The app crashes on the main thread during a CADisplayLink callback. The crash originates in the Amplitude Session Replay SDK while manipulating an internal NSHashTable of tracked objects.

Crashed: com.apple.main-thread
0  libobjc.A.dylib                0xcb24 objc_loadWeakRetained + 164
1  libobjc.A.dylib                0xdd34 objc_loadWeak + 24
2  Foundation                     0x674ec -[NSConcreteHashTable hashGrow] + 132
3  Foundation                     0x29974 -[NSConcreteHashTable addObject:] + 144
4  AmplitudeSessionReplay         0x45a80 block_destroy_helper.7 + 6724
5  AmplitudeSessionReplay         0x53e84 block_destroy_helper + 1444
6  AmplitudeSessionReplay         0x548b8 block_destroy_helper + 4056
7  AmplitudeSessionReplay         0x548b8 block_destroy_helper + 4056
8  AmplitudeSessionReplay         0x548b8 block_destroy_helper + 4056
9  AmplitudeSessionReplay         0x548b8 block_destroy_helper + 4056
10 AmplitudeSessionReplay         0x548b8 block_destroy_helper + 4056
11 AmplitudeSessionReplay         0x548b8 block_destroy_helper + 4056
12 AmplitudeSessionReplay         0x548b8 block_destroy_helper + 4056
13 AmplitudeSessionReplay         0x548b8 block_destroy_helper + 4056
14 AmplitudeSessionReplay         0x548b8 block_destroy_helper + 4056
15 AmplitudeSessionReplay         0x548b8 block_destroy_helper + 4056
16 AmplitudeSessionReplay         0x517f8 __swift_allocate_boxed_opaque_existential_1 + 10536
17 AmplitudeSessionReplay         0x512e0 __swift_allocate_boxed_opaque_existential_1 + 9232
18 AmplitudeSessionReplay         0x51a78 __swift_allocate_boxed_opaque_existential_1 + 11176
19 QuartzCore                     0x101d0 CA::Display::DisplayLinkItem::dispatch_(CA::SignPost::Interval<(CA::SignPost::CAEventCode)835322056>&) + 48
20 QuartzCore                     0xfdc8 CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 876
21 QuartzCore                     0x10364 CA::Display::DisplayLink::dispatch_deferred_display_links(unsigned int) + 360
22 UIKitCore                      0x9404 _UIUpdateSequenceRun + 84
23 UIKitCore                      0x8ab4 schedulerStepScheduledMainSection + 208
24 UIKitCore                      0x41e4 runloopSourceCallback + 92
25 CoreFoundation                 0xf92c __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 28
26 CoreFoundation                 0xf744 __CFRunLoopDoSource0 + 172
27 CoreFoundation                 0xf5a0 __CFRunLoopDoSources0 + 232
28 CoreFoundation                 0xff20 __CFRunLoopRun + 840
29 CoreFoundation                 0x11adc CFRunLoopRunSpecific + 572
30 GraphicsServices               0x1454 GSEventRunModal + 168
31 UIKitCore                      0x135274 -[UIApplication _run] + 816
32 UIKitCore                      0x100a28 UIApplicationMain + 336
33 UIKitCore                      0x1e2168 __51-[UIStatusBar_Base _setHidden:animationParameters:]_block_invoke_4 + 180

Steps to Reproduce

1. Use the app with session replays enabled however the crash is not reproducible 100% of the time, but it crashes often enough to be a stability issue for the app.

Environment

• SDK Version: 0.5.2
• OS Info: iOS 18.4.1+

[sojingle]

Hi @VladIacobIonut ,
To solve this problem, we need more detailed information. Thank you!

1. Did this start to appear after upgrading the Session Replay SDK from an old version, or did it happen when Session Replay was first integrated?
2. Does it occur only on real devices, or can it be reproduced on simulators as well?
3. Is this a pure UIKit app or mixed with SwiftUI?
4. Does it happen at app startup, or is it a random crash during usage?
5. Is there anything in common about the screen where the crash happens? For example, does it always occur on a specific page, or when a certain element is displayed?
6. Which Xcode version are you using?
7. Could you share the complete stacktrace?

[VladIacobIonut]

Hi @sojingle

sure, details below:

1. It appears that it started to occur right after we integrated AmplitudeSessionReplay SPM at v 0.4.5
2. It occurs on real devices as far as we can see and always on iOS 18+
3. The app is mixed with SwiftUI.
4. It's not happening at startup but rather randomly while using the app. I wouldn't say it's strictly isolated to a certain flow of the app but if I had to ballpark, it's most often around our flow where we display live streams in our app.
5. ☝️
6. We're using XCode 16.4

retrolabs.retroapp.iOS_issue_0bd0f6b3aee436bff40f30757470b49c_crash_session_4b2c46a6ddaf4b7281a2091affa13155_DNE_8_v2_stacktrace.txt

[sojingle]

Hi @VladIacobIonut, we tried but couldn't reproduce the issue at the time. We suspect it might be related to one of the CALayers used by the playback view in the live stream. Could you provide more information about this, such as whether the player you're using is the system AVPlayer or a third-party library? If you could provide a demo that can reproduce this issue, that would be even better. Thank you!

[ougyosen]

@sojingle 您好，我也遇到了同样的问题，在使用系统的AVPlayer播放视频完毕将页面关闭时会随机出现。
最开始是使用的sessionreplay 0.4.0版本于iOS 26百分白再现，于iOS 18.x随机再现，
之前通过贵公司日本代理联系贵社处理时应对方提议升至最新的0.8.0版本后，iOS26的问题解决，但iOS 18.x的随机再现依旧存在。
以下附上闪退log。

# Crashlytics - Stack trace
# Date: Sat Oct 11 2025 17:35:36 GMT+0900 (日本標準時)

Crashed: com.apple.main-thread
0  MediaToolbox                   0x4488f8 -[FigFCRCALayerOutputNodeLayer setBounds:] + 108
1  QuartzCore                     0xad374 -[CALayer setValue:forKeyPath:] + 416
2  QuartzCore                     0xd8040 -[CABasicAnimation applyForTime:presentationObject:modelObject:] + 588
3  QuartzCore                     0x9f088 CA::Layer::presentation_layer(CA::Transaction*) + 488
4  AmplitudeSessionReplay         0x5a1cc __swift_allocate_boxed_opaque_existential_1 + 13700
5  AmplitudeSessionReplay         0x9db4 __swift_instantiateConcreteTypeFromMangledName + 15792
6  AmplitudeSessionReplay         0x4034 AMPObjCTryCatch + 52
7  AmplitudeSessionReplay         0x5c154 block_destroy_helper + 1840
8  AmplitudeSessionReplay         0x5ca08 block_destroy_helper + 4068
9  AmplitudeSessionReplay         0x5ca08 block_destroy_helper + 4068
10 AmplitudeSessionReplay         0x5ca08 block_destroy_helper + 4068
11 AmplitudeSessionReplay         0x5ca08 block_destroy_helper + 4068
12 AmplitudeSessionReplay         0x5ca08 block_destroy_helper + 4068
13 AmplitudeSessionReplay         0x5ca08 block_destroy_helper + 4068
14 AmplitudeSessionReplay         0x5ca08 block_destroy_helper + 4068
15 AmplitudeSessionReplay         0x5ca08 block_destroy_helper + 4068
16 AmplitudeSessionReplay         0x5ca08 block_destroy_helper + 4068
17 AmplitudeSessionReplay         0x5ca08 block_destroy_helper + 4068
18 AmplitudeSessionReplay         0x59810 __swift_allocate_boxed_opaque_existential_1 + 11208
19 AmplitudeSessionReplay         0x592e0 __swift_allocate_boxed_opaque_existential_1 + 9880
20 AmplitudeSessionReplay         0x59a3c __swift_allocate_boxed_opaque_existential_1 + 11764
21 QuartzCore                     0x101d0 CA::Display::DisplayLinkItem::dispatch_(CA::SignPost::Interval<(CA::SignPost::CAEventCode)835322056>&) + 48
22 QuartzCore                     0xfdc8 CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 876
23 QuartzCore                     0x10364 CA::Display::DisplayLink::dispatch_deferred_display_links(unsigned int) + 360
24 UIKitCore                      0x9404 _UIUpdateSequenceRun + 84
25 UIKitCore                      0x8ab4 schedulerStepScheduledMainSection + 208
26 UIKitCore                      0x41e4 runloopSourceCallback + 92
27 CoreFoundation                 0xf92c __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 28
28 CoreFoundation                 0xf744 __CFRunLoopDoSource0 + 172
29 CoreFoundation                 0xf5a0 __CFRunLoopDoSources0 + 232
30 CoreFoundation                 0xff20 __CFRunLoopRun + 840
31 CoreFoundation                 0x11adc CFRunLoopRunSpecific + 572
32 GraphicsServices               0x1454 GSEventRunModal + 168
33 UIKitCore                      0x135274 -[UIApplication _run] + 816
34 UIKitCore                      0x100a28 UIApplicationMain + 336
35 hodai                          0x2a8cc main + 13 (AppDelegate.swift:13)
36 ???                            0x1abe7df08 (シンボルが不足しています)

com.apple.uikit.eventfetch-thread
0  libsystem_kernel.dylib         0xce4 mach_msg2_trap + 8
1  libsystem_kernel.dylib         0x439c mach_msg2_internal + 76
2  libsystem_kernel.dylib         0x42b8 mach_msg_overwrite + 428
3  libsystem_kernel.dylib         0x4100 mach_msg + 24
4  CoreFoundation                 0x117a0 __CFRunLoopServiceMachPort + 160
5  CoreFoundation                 0x10090 __CFRunLoopRun + 1208
6  CoreFoundation                 0x11adc CFRunLoopRunSpecific + 572
7  Foundation                     0xf79c -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 212
8  Foundation                     0x15020 -[NSRunLoop(NSRunLoop) runUntilDate:] + 64
9  UIKitCore                      0x11f56c -[UIEventFetcher threadMain] + 424
10 Foundation                     0x75804 __NSThread__start__ + 732
11 libsystem_pthread.dylib        0x3344 _pthread_start + 136
12 libsystem_pthread.dylib        0xab8 thread_start + 8

com.google.firebase.crashlytics.MachExceptionServer
0  hodai                          0x5f6ac0 FIRCLSProcessRecordAllThreads + 393 (FIRCLSProcess.c:393)
1  hodai                          0x5f6ea4 FIRCLSProcessRecordAllThreads + 424 (FIRCLSProcess.c:424)
2  hodai                          0x605120 FIRCLSHandler + 34 (FIRCLSHandler.m:34)
3  hodai                          0x605924 FIRCLSMachExceptionServer + 521 (FIRCLSMachException.c:521)
4  libsystem_pthread.dylib        0x3344 _pthread_start + 136
5  libsystem_pthread.dylib        0xab8 thread_start + 8

com.apple.NSURLConnectionLoader
0  libsystem_kernel.dylib         0xce4 mach_msg2_trap + 8
1  libsystem_kernel.dylib         0x439c mach_msg2_internal + 76
2  libsystem_kernel.dylib         0x42b8 mach_msg_overwrite + 428
3  libsystem_kernel.dylib         0x4100 mach_msg + 24
4  CoreFoundation                 0x117a0 __CFRunLoopServiceMachPort + 160
5  CoreFoundation                 0x10090 __CFRunLoopRun + 1208
6  CoreFoundation                 0x11adc CFRunLoopRunSpecific + 572
7  CFNetwork                      0x9fdb8 +[__CFN_CoreSchedulingSetRunnable _run:] + 416
8  Foundation                     0x75804 __NSThread__start__ + 732
9  libsystem_pthread.dylib        0x3344 _pthread_start + 136
10 libsystem_pthread.dylib        0xab8 thread_start + 8

Thread
0  libsystem_kernel.dylib         0xc60 semaphore_wait_trap + 8
1  libdispatch.dylib              0x38e0 _dispatch_sema4_wait + 28
2  libdispatch.dylib              0x3e90 _dispatch_semaphore_wait_slow + 132
3  UIKitCore                      0x5b0050 CGSizeFromString + 9984
4  UIKitCore                      0x207d0 _UIHostedFocusSystemsForHostEnvironment + 244
5  Foundation                     0x75804 __NSThread__start__ + 732
6  libsystem_pthread.dylib        0x3344 _pthread_start + 136
7  libsystem_pthread.dylib        0xab8 thread_start + 8

Thread
0  libsystem_kernel.dylib         0xa90 __workq_kernreturn + 8
1  libsystem_pthread.dylib        0xa58 _pthread_wqthread + 368
2  libsystem_pthread.dylib        0xaac start_wqthread + 8

com.apple.coremedia.sharedRootQueue.47
0  libsystem_kernel.dylib         0xc78 semaphore_timedwait_trap + 8
1  libdispatch.dylib              0x361c0 _dispatch_sema4_timedwait + 64
2  libdispatch.dylib              0x3e58 _dispatch_semaphore_wait_slow + 76
3  libdispatch.dylib              0x13ba8 _dispatch_worker_thread + 324
4  libsystem_pthread.dylib        0x3344 _pthread_start + 136
5  libsystem_pthread.dylib        0xab8 thread_start + 8

Thread
0  libsystem_kernel.dylib         0xa90 __workq_kernreturn + 8
1  libsystem_pthread.dylib        0xa58 _pthread_wqthread + 368
2  libsystem_pthread.dylib        0xaac start_wqthread + 8

com.apple.coremedia.sharedRootQueue.47
0  libsystem_kernel.dylib         0xc78 semaphore_timedwait_trap + 8
1  libdispatch.dylib              0x361c0 _dispatch_sema4_timedwait + 64
2  libdispatch.dylib              0x3e58 _dispatch_semaphore_wait_slow + 76
3  libdispatch.dylib              0x13ba8 _dispatch_worker_thread + 324
4  libsystem_pthread.dylib        0x3344 _pthread_start + 136
5  libsystem_pthread.dylib        0xab8 thread_start + 8

Thread
0  libsystem_pthread.dylib        0xaa4 start_wqthread + 442

Thread
0  libsystem_kernel.dylib         0xa90 __workq_kernreturn + 8
1  libsystem_pthread.dylib        0xa58 _pthread_wqthread + 368
2  libsystem_pthread.dylib        0xaac start_wqthread + 8

com.apple.coremedia.rootQueue.fP-45.mP-47
0  libsystem_kernel.dylib         0xc78 semaphore_timedwait_trap + 8
1  libdispatch.dylib              0x361c0 _dispatch_sema4_timedwait + 64
2  libdispatch.dylib              0x3e58 _dispatch_semaphore_wait_slow + 76
3  libdispatch.dylib              0x13ba8 _dispatch_worker_thread + 324
4  libsystem_pthread.dylib        0x3344 _pthread_start + 136
5  libsystem_pthread.dylib        0xab8 thread_start + 8

[sojingle]

Hi @ougyosen @VladIacobIonut , thanks for the information you provided. We have just released v0.8.2 to address this issue. Due to the randomness of the issue, we cannot confirm if it has been completely fixed. Please update to this version and let us know whether the problem has been resolved. Thank you!

[VladIacobIonut]

thank you @sojingle! will try this