High chrome Memory Corruption 📄 Reporter bug report 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactMemory corruption in Tint
DescriptionMemory corruption in Tint
ComponentTint
Bug ClassMemory Corruption
Tracker508638064
Fix commitc17815916040 (dawn) +383/-6
CISA KEVNot listed
Creditedandryskowski.michal
Disclosed2026-08-25

Changed Functions

FunctionChangeNotes
TEST_P
src/dawn/tests/end2end/ComputeFlowControlTests.cpp
modified
switch
src/dawn/tests/end2end/ComputeFlowControlTests.cpp
modified

Files Changed

  • src/dawn/tests/end2end/ComputeFlowControlTests.cpp
  • src/tint/lang/msl/writer/raise/BUILD.bazel
  • src/tint/lang/msl/writer/raise/BUILD.cmake
  • src/tint/lang/msl/writer/raise/BUILD.gn
  • src/tint/lang/msl/writer/raise/raise.cc
  • src/tint/lang/msl/writer/raise/switch_return.cc
From c178159160404ec25f57ab8dd8ba450de75ce140 Mon Sep 17 00:00:00 2001
From: Natalie Chouinard <chouinard@google.com>
Date: Thu, 16 Jul 2026 17:53:11 -0700
Subject: [PATCH] [tint][msl] Add SwitchReturn IR transform

Adds an MSL transform pass that wraps early returns nested inside switch
blocks with a volatile-guarded conditional. This works around a driver
bug in MTLCompilerService on macOS.

Bug: 508638064
Change-Id: I8c8b7cb0a3710f855499fdfa94872117a8d1bd23
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/325075
Reviewed-by: dan sinclair <dsinclair@chromium.org>
Commit-Queue: Natalie Chouinard <chouinard@google.com>
---

diff --git a/src/dawn/tests/end2end/ComputeFlowControlTests.cpp b/src/dawn/tests/end2end/ComputeFlowControlTests.cpp
index d29b228..cf9ebcc 100644
--- a/src/dawn/tests/end2end/ComputeFlowControlTests.cpp
+++ b/src/dawn/tests/end2end/ComputeFlowControlTests.cpp
@@ -513,6 +513,47 @@
     RunTest(shader, inputs, expected);
 }
 
+// This is a regression test for a crash in MTLCompilerService on macOS (crbug.com/508638064).
+TEST_P(ComputeFlowControlTests, SwitchReturnMTLCompilerServiceCrash) {
+    const char* shader = R"(
+@group(0) @binding(0) var<uniform> u: i32;
+@group(0) @binding(1) var<storage, read_write> s: i32;
+
+fn foo(){
+    switch (s) {
+        case 0i: {}
+        case 2i: {
+            return;
+        }
+        case 4i: {}
+        default: {
+            s = s / u;
+        }
+    }
+    switch (s) {
+        case 0i: {
+            s = 0;
+        }
+        case 1i: {}
+        case 4i: {}
+        default: {
+            s = 0;
+        }
+    }
+}
+
+@compute @workgroup_size(1)
+fn main() {
+    foo();
+    foo();
+}
+)";
+
+    wgpu::ComputePipelineDescriptor csDesc;
+    csDesc.compute.module = utils::CreateShaderModule(device, shader);
+    device.CreateComputePipeline(&csDesc);
+}
+
 DAWN_INSTANTIATE_TEST(ComputeFlowControlTests,
                       D3D11Backend(),
                       D3D12Backend(),
diff --git a/src/tint/lang/msl/writer/raise/BUILD.bazel b/src/tint/lang/msl/writer/raise/BUILD.bazel
index ad45376..d8b1bb8 100644
--- a/src/tint/lang/msl/writer/raise/BUILD.bazel
+++ b/src/tint/lang/msl/writer/raise/BUILD.bazel
@@ -54,6 +54,7 @@
     "raise.cc",
     "shader_io.cc",
     "simd_ballot.cc",
+    "switch_return.cc",
     "validate_subgroup_matrix.cc",
   ],
   hdrs = [
@@ -68,6 +69,7 @@
     "raise.h",
     "shader_io.h",
     "simd_ballot.h",
+    "switch_return.h",
     "validate_subgroup_matrix.h",
   ],
   deps = [
@@ -114,6 +116,7 @@
     "module_scope_vars_test.cc",
     "shader_io_test.cc",
     "simd_ballot_test.cc",
+    "switch_return_test.cc",
     "validate_subgroup_matrix_test.cc",
   ],
   deps = [
diff --git a/src/tint/lang/msl/writer/raise/BUILD.cmake b/src/tint/lang/msl/writer/raise/BUILD.cmake
index d3772ca..db2ac9d 100644
--- a/src/tint/lang/msl/writer/raise/BUILD.cmake
+++ b/src/tint/lang/msl/writer/raise/BUILD.cmake
@@ -63,6 +63,8 @@
   lang/msl/writer/raise/shader_io.h
   lang/msl/writer/raise/simd_ballot.cc
   lang/msl/writer/raise/simd_ballot.h
+  lang/msl/writer/raise/switch_return.cc
+  lang/msl/writer/raise/switch_return.h
   lang/msl/writer/raise/validate_subgroup_matrix.cc
   lang/msl/writer/raise/validate_subgroup_matrix.h
 )
@@ -116,6 +118,7 @@
   lang/msl/writer/raise/module_scope_vars_test.cc
   lang/msl/writer/raise/shader_io_test.cc
   lang/msl/writer/raise/simd_ballot_test.cc
+  lang/msl/writer/raise/switch_return_test.cc
   lang/msl/writer/raise/validate_subgroup_matrix_test.cc
 )
 
diff --git a/src/tint/lang/msl/writer/raise/BUILD.gn b/src/tint/lang/msl/writer/raise/BUILD.gn
index bb7d507..85f27b8 100644
--- a/src/tint/lang/msl/writer/raise/BUILD.gn
+++ b/src/tint/lang/msl/writer/raise/BUILD.gn
@@ -67,6 +67,8 @@
       "shader_io.h",
       "simd_ballot.cc",
       "simd_ballot.h",
+      "switch_return.cc",
+      "switch_return.h",
       "validate_subgroup_matrix.cc",
       "validate_subgroup_matrix.h",
     ]
@@ -113,6 +115,7 @@
         "module_scope_vars_test.cc",
         "shader_io_test.cc",
         "simd_ballot_test.cc",
+        "switch_return_test.cc",
         "validate_subgroup_matrix_test.cc",
       ]
       deps = [
diff --git a/src/tint/lang/msl/writer/raise/raise.cc b/src/tint/lang/msl/writer/raise/raise.cc
index e340bcf..71400bc 100644
--- a/src/tint/lang/msl/writer/raise/raise.cc
+++ b/src/tint/lang/msl/writer/raise/raise.cc
@@ -72,6 +72,7 @@
 #include "src/tint/lang/msl/writer/raise/module_scope_vars.h"
 #include "src/tint/lang/msl/writer/raise/shader_io.h"
 #include "src/tint/lang/msl/writer/raise/simd_ballot.h"
+#include "src/tint/lang/msl/writer/raise/switch_return.h"
 #include "src/tint/lang/msl/writer/raise/validate_subgroup_matrix.h"
 
 namespace tint::msl::writer {
@@ -302,6 +303,8 @@
         options.workarounds.disable_module_constant_f16};
     TINT_CHECK_RESULT(raise::ModuleConstant(module, module_const_config));
 
+    TINT_CHECK_RESULT(raise::SwitchReturn(module));
+
     // These transforms need to be run last as various transforms introduce terminator arguments,
     // naming conflicts, and expressions that need to be explicitly not inlined.
     TINT_CHECK_RESULT(core::ir::transform::RemoveTerminatorArgs(module));
diff --git a/src/tint/lang/msl/writer/raise/switch_return.cc b/src/tint/lang/msl/writer/raise/switch_return.cc
new file mode 100644
index 0000000..ca90580
--- /dev/null
+++ b/src/tint/lang/msl/writer/raise/switch_return.cc
@@ -0,0 +1,97 @@
+// Copyright 2026 The Dawn & Tint Authors
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its
+//    contributors may be used to endorse or promote products derived from
+//    this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "src/tint/lang/msl/writer/raise/switch_return.h"
+
+#include "src/tint/lang/core/ir/builder.h"
+#include "src/tint/lang/core/ir/module.h"
+#include "src/tint/lang/core/ir/validator.h"
+#include "src/tint/lang/core/type/u32.h"
+#include "src/tint/lang/msl/ir/builtin_call.h"
+
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/src/dawn/tests/end2end/ComputeFlowControlTests.cpp b/src/dawn/tests/end2end/ComputeFlowControlTests.cpp
index d29b228..cf9ebcc 100644
--- a/src/dawn/tests/end2end/ComputeFlowControlTests.cpp
+++ b/src/dawn/tests/end2end/ComputeFlowControlTests.cpp
@@ -513,6 +513,47 @@
     RunTest(shader, inputs, expected);
 }
 
+// This is a regression test for a crash in MTLCompilerService on macOS (crbug.com/508638064).
+TEST_P(ComputeFlowControlTests, SwitchReturnMTLCompilerServiceCrash) {
+    const char* shader = R"(
+@group(0) @binding(0) var<uniform> u: i32;
+@group(0) @binding(1) var<storage, read_write> s: i32;
+
+fn foo(){
+    switch (s) {
+        case 0i: {}
+        case 2i: {
+            return;
+        }
+        case 4i: {}
+        default: {
+            s = s / u;
+        }
+    }
+    switch (s) {
+        case 0i: {
+            s = 0;
+        }
+        case 1i: {}
+        case 4i: {}
+        default: {
+            s = 0;
+        }
+    }
+}
+
+@compute @workgroup_size(1)
+fn main() {
+    foo();
+    foo();
+}
+)";
+
+    wgpu::ComputePipelineDescriptor csDesc;
+    csDesc.compute.module = utils::CreateShaderModule(device, shader);
+    device.CreateComputePipeline(&csDesc);
+}
+
 DAWN_INSTANTIATE_TEST(ComputeFlowControlTests,
                       D3D11Backend(),
                       D3D12Backend(),
diff --git a/src/tint/lang/msl/writer/raise/switch_return_test.cc b/src/tint/lang/msl/writer/raise/switch_return_test.cc
new file mode 100644
index 0000000..ca6f943
--- /dev/null
+++ b/src/tint/lang/msl/writer/raise/switch_return_test.cc
@@ -0,0 +1,152 @@
+// Copyright 2026 The Dawn & Tint Authors
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its
+//    contributors may be used to endorse or promote products derived from
+//    this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "src/tint/lang/msl/writer/raise/switch_return.h"
+
+#include <utility>
+
+#include "src/tint/lang/core/fluent_types.h"
+#include "src/tint/lang/core/ir/transform/helper_test.h"
+
+using namespace tint::core::fluent_types;     // NOLINT
+using namespace tint::core::number_suffixes;  // NOLINT
+
+namespace tint::msl::writer::raise {
+namespace {
+
+using MslWriter_SwitchReturnTest = core::ir::transform::TransformTest;
+
+TEST_F(MslWriter_SwitchReturnTest, ReturnInsideSwitch) {
+    auto* func = b.Function("foo", ty.void_());
+    b.Append(func->Block(), [&] {
+        auto* sw = b.Switch(1_i);
+        b.Append(b.Case(sw, {b.Constant(0_i)}), [&] { b.Return(func); });
+        b.Append(b.DefaultCase(sw), [&] { b.ExitSwitch(sw); });
+        b.Return(func);
+    });
+
+    auto* src = R"(
+%foo = func():void {
+  $B1: {
+    switch 1i [c: (0i, $B2), c: (default, $B3)] {  # switch_1
+      $B2: {  # case
+        ret
+      }
+      $B3: {  # case
+        exit_switch  # switch_1
+      }
+    }
+    ret
+  }
+}
+)";
+    EXPECT_EQ(src, str());
+
+    auto* expect = R"(
+%foo = func():void {
+  $B1: {
+    switch 1i [c: (0i, $B2), c: (default, $B3)] {  # switch_1
+      $B2: {  # case
+        %2:u32 = msl.volatile_zero
+        %3:bool = eq %2, 0u
+        if %3 [t: $B4] {  # if_1
+          $B4: {  # true
+            ret
+          }
+        }
+        exit_switch  # switch_1
+      }
+      $B3: {  # case
+        exit_switch  # switch_1
+      }
+    }
+    ret
+  }
+}
+)";
+
+    Run(SwitchReturn);
+
+    EXPECT_EQ(expect, str());
+}
+
+TEST_F(MslWriter_SwitchReturnTest, ReturnValueInsideSwitch) {
+    auto* func = b.Function("foo", ty.i32());
+    b.Append(func->Block(), [&] {
+        auto* sw = b.Switch(1_i);
+        b.Append(b.Case(sw, {b.Constant(0_i)}), [&] { b.Return(func, 42_i); });
+        b.Append(b.DefaultCase(sw), [&] { b.ExitSwitch(sw); });
+        b.Return(func, 0_i);
+    });
+
+    auto* src = R"(
+%foo = func():i32 {
+  $B1: {
+    switch 1i [c: (0i, $B2), c: (default, $B3)] {  # switch_1
+      $B2: {  # case
+        ret 42i
+      }
+      $B3: {  # case
+        exit_switch  # switch_1
+      }
+    }
+    ret 0i
+  }
+}
+)";
+    EXPECT_EQ(src, str());
+
+    auto* expect = R"(
+%foo = func():i32 {
+  $B1: {
+    switch 1i [c: (0i, $B2), c: (default, $B3)] {  # switch_1
+      $B2: {  # case
+        %2:u32 = msl.volatile_zero
+        %3:bool = eq %2, 0u
+        if %3 [t: $B4] {  # if_1
+          $B4: {  # true
+            ret 42i
+          }
+        }
+        exit_switch  # switch_1
+      }
+      $B3: {  # case
+        exit_switch  # switch_1
+      }
+    }
+    ret 0i
+  }
+}
+)";
+
+    Run(SwitchReturn);
+
+    EXPECT_EQ(expect, str());
+}
+
+}  // namespace
+}  // namespace tint::msl::writer::raise
Loading diff…

Original Bug Report

reported by an...@gmail.com

[macOS] Memory corruption in MSLCompilerService during WGSL compilation

Vulnerability details

On macOS Chrome, compiling the WGSL shader included in this bug report crashes MTLCompilerService with a SIGSEGV at a high address.

The GPU process does not crash (dev console just shows XPC_ERROR_CONNECTION_INTERRUPTED). However, it crashes MTLCompilerService that the GPU process communicates with via XPC. Here is an issue that found something similar: https://issues.chromium.org/issues/40074630

Version

Device: Mac Mini 2024 (Apple M4) 16GB MU9D3LL/A

Chrome version: 147.0.7727.138 (Official Build) (arm64)

OS: macOS Tahoe 26.4.1 (Build 25E253)

Reproduction case

After opening poc.html in Chrome, open Console.App to see the trace. Alternatively, run sudo lldb -n MTLCompilerService --wait-for before opening poc.html.

The WGSL shader from poc.html is

@group(0) @binding(0)
var<uniform> u: i32;

@group(0) @binding(1)
var<storage, read_write> s: i32;

fn foo(){
    switch (s) {
        case 0i: {}
        case 2i: {
            return;
        }
        case 4i: {}
        default: {
            s = s / u;
        }
    }
    switch (s) {
        case 0i: {
            s = 0;
        }
        case 1i: {}
        case 4i: {}
        default: {
            s = 0;
        }
    }
}

@compute @workgroup_size(1u)
fn main() {
    foo();
    foo();
}

The MSL dump from Chrome is attached as poc.msl

Crash details

The stack trace from MTLCompilerService is:

% sudo lldb -n MTLCompilerService --wait-for  
(lldb) bt
* thread #3, queue = 'com.apple.root.default-qos.overcommit', stop reason = EXC_BAD_ACCESS (code=1, address=0x346fabb90)
  * frame #0: 0x000000024d2ee330 libLLVM.dylib`llvm::FlowAnalyzer::evaluateSkipTargets(llvm::BasePtr<unsigned int, llvm::NodePtrToken>, llvm::BasePtr<unsigned int, llvm::NodePtrToken>, llvm::BitVector&, llvm::ControlGraph<llvm::MachineCFGTraits> const&, llvm::CFGUnloopifier<llvm::MachineCFGTraits> const&) + 324
    frame #1: 0x000000024d2ebc44 libLLVM.dylib`llvm::FlowAnalyzer::analyze(llvm::ControlGraph<llvm::MachineCFGTraits> const&, llvm::CFGUnloopifier<llvm::MachineCFGTraits> const&, llvm::MachineLoopInfo const&, llvm::GPUFlowEmitter const*, llvm::TargetInstrInfo const*) + 1908
    frame #2: 0x000000024d2eb49c libLLVM.dylib`llvm::FlowAnalyzer::FlowAnalyzer(llvm::ControlGraph<llvm::MachineCFGTraits> const&, llvm::CFGUnloopifier<llvm::MachineCFGTraits> const&, llvm::MachineLoopInfo const&, llvm::GPUFlowEmitter const*, llvm::TargetInstrInfo const*) + 128
    frame #3: 0x000000024c8b28cc libLLVM.dylib`___lldb_unnamed_symbol_2432ea684 + 584
    frame #4: 0x000000024cf496bc libLLVM.dylib`llvm::MachineFunctionPass::runOnFunction(llvm::Function&) + 368
    frame #5: 0x000000024d1bf78c libLLVM.dylib`llvm::FPPassManager::runOnFunction(llvm::Function&) + 676
    frame #6: 0x000000024cbf1724 libLLVM.dylib`___lldb_unnamed_symbol_2436293a4 + 896
    frame #7: 0x000000024d1c0070 libLLVM.dylib`llvm::legacy::PassManagerImpl::run(llvm::Module&) + 788
    frame #8: 0x000000024cb95b28 libLLVM.dylib`___lldb_unnamed_symbol_2435cd53c + 1516
    frame #9: 0x000000024cb8fd14 libLLVM.dylib`___lldb_unnamed_symbol_2435c7940 + 980
    frame #10: 0x000000024cb967e8 libLLVM.dylib`llvm::AGX::AGXCompilePlan::execute(llvm::AGX::CompileRequest&) + 176
    frame #11: 0x00000001b5e7eac4 AGXCompilerCore`AGCLLVMCtx::compile(AGCLLVMObject*, llvm::Module&, AGCFastMathFlags, llvm::AGX::PipelineType, llvm::AGX::CodeGenOptions&, bool) + 1324
    frame #12: 0x00000001b5ded3f4 AGXCompilerCore`AGCLLVMUserObject::compile() + 236
    frame #13: 0x00000001b5efef90 AGXCompilerCore`AGCModule<AGX::Impl::ComputeProgramKey>::compileLLVMObject(AGCTargetContext*, char**, unsigned long*, char**, char**, unsigned long*) + 1040
    frame #14: 0x00000001b5efd8c0 AGXCompilerCore`AIRNTEmitPipelineImageInternal(void*, void*, unsigned int, std::__1::unique_ptr<AGCModuleAccessor, std::__1::default_delete<AGCModuleAccessor>>, unsigned int, unsigned int, AIRFunctionScript const*, char const*, char**, unsigned long*, char**, unsigned long*, char**) + 4180
    frame #15: 0x00000001b5f038a0 AGXCompilerCore`AIRNTEmitPipelineImageWithModuleRef + 164
    frame #16: 0x0000000260639758 MTLCompiler`MTLCompilerPluginInterface::airntEmitPipelineImage(void*, llvm::Module*, unsigned int, unsigned int, unsigned int, unsigned int, AIRFunctionScript const*, char**, unsigned long*, char**, unsigned long*, char**) + 132
    frame #17: 0x0000000260633e5c MTLCompiler`MTLCompilerObject::backendCompileModule(BinaryRequestData&, BackendCompilationOutput&, unsigned long long, std::__1::vector<CompileTimeData, std::__1::allocator<CompileTimeData>>&) + 780
    frame #18: 0x0000000260639ec8 MTLCompiler`MTLCompilerObject::backendCompileExecutableRequest(BinaryRequestData&) + 556
    frame #19: 0x000000026063de18 MTLCompiler`MTLCompilerObject::buildRequest(unsigned int, unsigned int, void const*, unsigned long, void (unsigned int, void const*, unsigned long, char const*) block_pointer) + 816
    frame #20: 0x00000002606471cc MTLCompiler`split_stack_call + 24
    frame #21: 0x000000026063a360 MTLCompiler`MTLCodeGenServiceBuildRequest + 324
    frame #22: 0x00000001024d504c MTLCompilerService`compileRequestMain + 140
    frame #23: 0x00000001024d61dc MTLCompilerService`MTLCompilerService::messageHandler(NSObject<OS_xpc_object>*) + 932
    frame #24: 0x0000000189794444 libxpc.dylib`_xpc_connection_call_event_handler + 112
    frame #25: 0x0000000189792cdc libxpc.dylib`_xpc_connection_mach_event + 1488
    frame #26: 0x00000001899164f8 libdispatch.dylib`_dispatch_client_callout4 + 16
    frame #27: 0x0000000189918e94 libdispatch.dylib`_dispatch_mach_msg_invoke + 480
    frame #28: 0x0000000189904e98 libdispatch.dylib`_dispatch_lane_serial_drain + 332
    frame #29: 0x0000000189919bec libdispatch.dylib`_dispatch_mach_invoke + 472
    frame #30: 0x000000018990fe34 libdispatch.dylib`_dispatch_root_queue_drain_deferred_wlh + 284
    frame #31: 0x000000018990f734 libdispatch.dylib`_dispatch_workloop_worker_thread + 720
    frame #32: 0x0000000189ab3ec0 libsystem_pthread.dylib`_pthread_wqthread + 292
(lldb) register read
General Purpose Registers:
        x0 = 0x0000000108f803f8  
        x1 = 0x0000000000000015
        x2 = 0x0000000000000017
        x3 = 0x0000000108f801c8  
        x4 = 0x0000000108f80b70  
        x5 = 0x0000000000000000
        x6 = 0x0000000100000004
        x7 = 0xfffff0003ffff800
        x8 = 0x0000000346fabb80
        x9 = 0x0000000108f80a58  
       x10 = 0x0000000108f80b80  
       x11 = 0x0000000000000000
       x12 = 0x0000000000000000
       x13 = 0x0000000000000015
       x14 = 0x0000000000000001
       x15 = 0x000000000000000a
       x16 = 0x5d16800189ac1090 (0x0000000189ac1090) libsystem_platform.dylib`__bzero
       x17 = 0x00000002a34179c8
       x18 = 0x0000000000000000
       x19 = 0x0000000108f801c8  
       x20 = 0x0000000108f80058  
       x21 = 0x0000000108f80b70  
       x22 = 0x0000000000000017
       x23 = 0x0000000000000015
       x24 = 0x0000000108f803f8  
       x25 = 0x0000000000000015
       x26 = 0x0000000008f80ac0
       x27 = 0x0000000108f80838  
       x28 = 0x0000000008f80ac0
        fp = 0x0000000108f800f0  
        lr = 0xf02c80024d2ebc44 (0x000000024d2ebc44) libLLVM.dylib`llvm::FlowAnalyzer::analyze(llvm::ControlGraph<llvm::MachineCFGTraits> const&, llvm::CFGUnloopifier<llvm::MachineCFGTraits> const&, llvm::MachineLoopInfo const&, llvm::GPUFlowEmitter const*, llvm::TargetInstrInfo const*) + 1908
        sp = 0x0000000108f80040  
        pc = 0x000000024d2ee330  libLLVM.dylib`llvm::FlowAnalyzer::evaluateSkipTargets(llvm::BasePtr<unsigned int, llvm::NodePtrToken>, llvm::BasePtr<unsigned int, llvm::NodePtrToken>, llvm::BitVector&, llvm::ControlGraph<llvm::MachineCFGTraits> const&, llvm::CFGUnloopifier<llvm::MachineCFGTraits> const&) + 324
      cpsr = 0x20000000

I also reported this to Apple Security Research (OE1106044528210).

View on issue tracker