[Crashlytics] Conforming to Mach IPC security restrictions

[themiswang]

Related issue: #15393

Tested on:

• iOS15 (min version we support)
• arm macOS
• intel macOS

Note: macOS10.5 and 11 does not support identity protection so it fallback to default behavior, addressed in the later pr

Change exception behaviors from default to identity protected
Context: https://developer.apple.com/documentation/xcode/conforming-to-mach-ipc-security-restrictions

[gemini-code-assist]

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

[ncooke3]

/gemini review

[gemini-code-assist]

Code Review

This pull request correctly updates the Mach exception handling to conform to newer security restrictions by using EXCEPTION_IDENTITY_PROTECTED. The changes to use task identity tokens and thread IDs are well-implemented. However, I've found a couple of critical issues in the new FIRCLSCrashedThreadLookup function and its usage. One is a use-after-free bug due to premature deallocation of the crashed thread's port, and another is the use of an uninitialized variable. I've provided detailed comments and suggestions to fix these issues. Once these are addressed, the changes should be solid.

[themiswang]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the Mach exception handling to conform to newer security restrictions by using EXCEPTION_IDENTITY_PROTECTED. This changes the exception message format, and the code has been updated to handle this by getting the task port from a token and looking up the thread port from a thread ID. The changes are well-implemented, but I've identified two resource leaks related to Mach port handling that should be addressed. Otherwise, the changes look good.

[themiswang]

/gemini review

[gemini-code-assist]

Code Review

This pull request correctly updates the Mach exception handling to conform to Apple's new Mach IPC security restrictions by using EXCEPTION_IDENTITY_PROTECTED. The changes properly adapt the exception message handling, including looking up the task port from a token and finding the crashed thread by its ID. The resource management for the acquired Mach ports also appears to be handled correctly. I have a minor suggestion to improve code clarity by renaming a struct field to avoid confusion with a type name.

[ncooke3]

The failures look like flakes in the context manager tests. That class has some async dispatches, so it is likely those not resolving due to background priority.