Fixes an issue where os_unsafe_lock was used directly in Swift.

FirebaseAuth/CHANGELOG.md

@@ -1,3 +1,6 @@
+# Unreleased
+- [fixed] Replaced unsafe uses of `os_unfair_lock` (#14548).
+
 # 11.9.0
 - [changed] Using reCAPTCHA Enterprise and Firebase Auth requires reCAPTCHA
   Enterprise 18.7.0 or later.

FirebaseAuth/Sources/Swift/Auth/AuthComponent.swift

@@ -18,6 +18,7 @@ import FirebaseAppCheckInterop
 import FirebaseAuthInterop
 import FirebaseCore
 import FirebaseCoreExtension
+import FirebaseCoreInternal
 
 @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
 @objc(FIRAuthComponent)
@@ -33,7 +34,7 @@ class AuthComponent: NSObject, Library, ComponentLifecycleMaintainer {
   private var instances: [String: Auth] = [:]
 
   /// Lock to manage access to the instances array to avoid race conditions.
-  private var instancesLock: os_unfair_lock = .init()
+  private let instancesLock: FirebaseCoreInternal.FIRAllocatedUnfairLock<Void> = .init()
 
   // MARK: - Initializers
 
@@ -58,10 +59,10 @@ class AuthComponent: NSObject, Library, ComponentLifecycleMaintainer {
   // MARK: - AuthProvider conformance
 
   @discardableResult func auth() -> Auth {
-    os_unfair_lock_lock(&instancesLock)
+    instancesLock.lock()
 
     // Unlock before the function returns.
-    defer { os_unfair_lock_unlock(&instancesLock) }
+    defer { instancesLock.unlock() }
 
     if let instance = instances[app.name] {
       return instance

FirebaseCore/Internal/Sources/FIRAllocatedUnfairLock.swift

@@ -0,0 +1,62 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import Foundation
+import os.lock
+
+/// A reference wrapper around `os_unfair_lock`. Replace this class with
+/// `OSAllocatedUnfairLock` once we support only iOS 16+. For an explanation
+/// on why this is necessary, see the docs:
+/// https://developer.apple.com/documentation/os/osallocatedunfairlock
+public final class FIRAllocatedUnfairLock<State>: @unchecked Sendable {
+  private var lockPointer: UnsafeMutablePointer<os_unfair_lock>
+  private var state: State
+
+  public init(initialState: sending State) {
+    lockPointer = UnsafeMutablePointer<os_unfair_lock>
+      .allocate(capacity: 1)
+    lockPointer.initialize(to: os_unfair_lock())
+    state = initialState
+  }
+
+  public convenience init() where State == Void {
+    self.init(initialState: ())
+  }
+
+  public func lock() {
+    os_unfair_lock_lock(lockPointer)
+  }
+
+  public func unlock() {
+    os_unfair_lock_unlock(lockPointer)
+  }
+
+  public func withLock<R>(_ body: (inout State) throws -> R) rethrows -> R where R: Sendable {
+    let value: R
+    lock(); defer { unlock() }
+    value = try body(&state)
+    return value
+  }
+
+  public func withLock<R>(_ body: () throws -> R) rethrows -> R where R: Sendable {
+    let value: R
+    lock(); defer { unlock() }
+    value = try body()
+    return value
+  }
+
+  deinit {
+    lockPointer.deallocate()
+  }
+}

FirebaseFunctions/CHANGELOG.md

@@ -1,3 +1,6 @@
+# Unreleased
+- [fixed] Replaced unsafe uses of `os_unfair_lock` (#14548).
+
 # 11.10.0
 - [added] Streaming callable functions are now supported.
 

FirebaseFunctions/Sources/Callable+Codable.swift

@@ -282,7 +282,7 @@ public extension Callable where Request: Sendable, Response: Sendable {
               // `StreamResponseProtocol`, we know the `Response` generic argument
               // is `StreamResponse<_, _>`.
               let responseJSON = switch response {
-              case .message(let json), .result(let json): json
+              case let .message(json), let .result(json): json
               }
               let response = try decoder.decode(Response.self, from: responseJSON)
               if response is StreamResponseProtocol {

FirebaseFunctions/Sources/Functions.swift

@@ -56,7 +56,7 @@
   private static var instances: [String: [Functions]] = [:]
 
   /// Lock to manage access to the instances array to avoid race conditions.
-  private static var instancesLock: os_unfair_lock = .init()
+  private static let instancesLock = FirebaseCoreInternal.FIRAllocatedUnfairLock<Void>()
 
   /// The custom domain to use for all functions references (optional).
   let customDomain: String?
@@ -304,10 +304,10 @@
     guard let app else {
       fatalError("`FirebaseApp.configure()` needs to be called before using Functions.")
     }
-    os_unfair_lock_lock(&instancesLock)
+    instancesLock.lock()
 
     // Unlock before the function returns.
-    defer { os_unfair_lock_unlock(&instancesLock) }
+    defer { instancesLock.unlock() }
 
     if let associatedInstances = instances[app.name] {
       for instance in associatedInstances {

FirebaseStorage/CHANGELOG.md

@@ -1,3 +1,6 @@
+# Unreleased
+- [fixed] Replaced unsafe uses of `os_unfair_lock` (#14548).
+
 # 11.1.0
 - [fixed] Fix a potential data race in Storage initialization. (#13369)
 

FirebaseStorage/Sources/Storage.swift

@@ -249,13 +249,13 @@
     private var instances: [String: Storage] = [:]
 
     /// Lock to manage access to the instances array to avoid race conditions.
-    private var instancesLock: os_unfair_lock = .init()
+    private let instancesLock = FirebaseCoreInternal.FIRAllocatedUnfairLock<Void>()
 
     private init() {}
 
     func storage(app: FirebaseApp, bucket: String) -> Storage {
-      os_unfair_lock_lock(&instancesLock)
-      defer { os_unfair_lock_unlock(&instancesLock) }
+      instancesLock.lock()
+      defer { instancesLock.unlock() }
 
       if let instance = instances[bucket] {
         return instance

FirebaseVertexAI/CHANGELOG.md

@@ -1,3 +1,6 @@
+# Unreleased
+- [fixed] Replaced unsafe uses of `os_unfair_lock` (#14548).
+
 # 11.10.0
 - [feature] The Vertex AI SDK no longer requires `@preconcurrency` when imported in Swift 6.
 - [feature] The Vertex AI Sample App now includes an image generation example.

FirebaseVertexAI/Sources/VertexAI.swift

@@ -123,20 +123,17 @@
 
   let apiConfig: APIConfig
 
+  /// Lock to manage access to the `instances` array to avoid race conditions.
+  private static let instancesLock = FirebaseCoreInternal.FIRAllocatedUnfairLock<Void>()
+
   #if compiler(>=6)
     /// A map of active  `VertexAI` instances keyed by the `FirebaseApp` name and the `location`, in
     /// the format `appName:location`.
     private nonisolated(unsafe) static var instances: [InstanceKey: VertexAI] = [:]
-
-    /// Lock to manage access to the `instances` array to avoid race conditions.
-    private nonisolated(unsafe) static var instancesLock: os_unfair_lock = .init()
   #else
     /// A map of active  `VertexAI` instances keyed by the `FirebaseApp` name and the `location`, in
     /// the format `appName:location`.
     private static var instances: [InstanceKey: VertexAI] = [:]
-
-    /// Lock to manage access to the `instances` array to avoid race conditions.
-    private static var instancesLock: os_unfair_lock = .init()
   #endif
 
   let location: String?
@@ -148,10 +145,10 @@
       fatalError("No instance of the default Firebase app was found.")
     }
 
-    os_unfair_lock_lock(&instancesLock)
+    instancesLock.lock()
 
     // Unlock before the function returns.
-    defer { os_unfair_lock_unlock(&instancesLock) }
+    defer { instancesLock.unlock() }
 
     let instanceKey = InstanceKey(appName: app.name, location: location, apiConfig: apiConfig)
     if let instance = instances[instanceKey] {