[Bug] Crash when opening application by clicking push notifications

[EllieTellie]

Description

The application crashes when tapping a (remote) push notification on iOS & Android when using Firebase Messaging v12.2.0.
We have a splash screen and it briefly shows that before crashing within 1-2 seconds.
This seems to be a regression as our old version 11.7.0 this crash does not occur.

Crash rate is 100% in our scenario.

The crash stack trace references deconstructors and is called from the gargage collector.
We do have incremental garbage collection enabled in our Unity project.

Here's the relevant stack trace
0 libsystem_kernel.dylib 0x00000001eee4342c __pthread_kill + 8 (:-1)
1 libsystem_pthread.dylib 0x0000000202be2c0c pthread_kill + 268 (pthread.c:1721)
2 libsystem_c.dylib 0x00000001adce6c34 __abort + 136 (abort.c:159)
3 libsystem_c.dylib 0x00000001adce6bac abort + 192 (abort.c:126)
4 libsystem_malloc.dylib 0x00000001b5f24588 malloc_vreport + 896 (malloc_printf.c:251)
5 libsystem_malloc.dylib 0x00000001b5f241f8 malloc_report + 64 (malloc_printf.c:290)
6 libsystem_malloc.dylib 0x00000001b5f237b0 find_zone_and_free + 528 (malloc.c:2793)
7 UnityFramework 0x000000010ec30f4c operator delete(void*) + 48 (MemoryManager.cpp:275)
8 UnityFramework 0x000000010fc28d44 firebase::messaging::Notification::~Notification() + 72
9 UnityFramework 0x000000010fc23da4 firebase::messaging::Notification::~Notification() + 28
10 UnityFramework 0x000000010fc29370 firebase::messaging::Message::~Message() + 64
11 UnityFramework 0x000000010fc23dd0 firebase::messaging::Message::~Message() + 28
12 UnityFramework 0x000000010fc2cbe4 Firebase_Messaging_CSharp_delete_FirebaseMessageInternal + 104
13 UnityFramework 0x00000001109c7978 FirebaseMessagingInternalPINVOKE_delete_FirebaseMessageInternal_mD15EF62AC59E1DA718AEDD7AFE2D4AACD824A304 + 8 (Firebase.Messaging.cpp:6042)
14 UnityFramework 0x00000001109c7978 FirebaseMessageInternal_Dispose_m3EC0B7CCD31B6953F328C6C21F86E8E49A6A8D7F + 220 (Firebase.Messaging.cpp:4725)
15 UnityFramework 0x00000001109c7830 VirtualActionInvoker1::Invoke(unsigned short, Il2CppObject*, bool) + 16 (Firebase.Messaging.cpp:21)
16 UnityFramework 0x00000001109c7830 FirebaseMessageInternal_Finalize_m12BEABABC4325D74C2E471C086110DD341457C9E + 44 (Firebase.Messaging.cpp:4620)
17 UnityFramework 0x000000010fdbf334 il2cpp::vm::Runtime::InvokeWithThrow(MethodInfo const*, void*, void**) + 100 (Runtime.cpp:608)
18 UnityFramework 0x000000010fdbf27c il2cpp::vm::Runtime::Invoke(MethodInfo const*, void*, void**, Il2CppException**) + 84 (Runtime.cpp:594)
19 UnityFramework 0x000000010fd5f2dc il2cpp::gc::GarbageCollector::RunFinalizer(void*, void*) + 48 (GarbageCollector.cpp:178)
20 UnityFramework 0x000000010f811070 GC_invoke_finalizers + 168 (finalize.c:1315)
21 UnityFramework 0x000000010fd5f220 il2cpp::gc::GarbageCollector::InvokeFinalizers() + 4 (BoehmGC.cpp:460)
22 UnityFramework 0x000000010fd5f220 il2cpp::gc::FinalizerThread(void*) + 108 (GarbageCollector.cpp:104)
23 UnityFramework 0x000000010fd82c94 il2cpp::os::Thread::RunWrapper(void*) + 84 (Thread.cpp:201)
24 UnityFramework 0x000000010fd866c8 il2cpp::os::ThreadImpl::ThreadStartWrapper(void*) + 40 (ThreadImpl.cpp:123)
25 libsystem_pthread.dylib 0x0000000202be106c _pthread_start + 136 (pthread.c:931)
26 libsystem_pthread.dylib 0x0000000202bdc0d8 thread_start + 8 (:-1)

crash.txt

I'll try and see if I can repro on 12.1.0 to determine if it is a regression.

Reproducing the issue

1. Make sure you have an iOS application that can receive remote push notifications.
2. Close the application on the device.
3. Receive a remote push notifications.
4. Open the application by tapping on the remote push notification.
5. Application launches then crashes.

Firebase Unity SDK Version

12.2.0

Unity editor version

2022.3.41f1

Installation Method

Unity Package Manager

Problematic Firebase Component(s)

Messaging

Other Firebase Component(s) in use

Analytics, Crashlytics, In-App Messaging, Remote Config

Additional SDKs you are using

Unity Mobile Notifications 2.3.0

Targeted Platform(s)

Apple Platforms

Unity editor platform

Mac

Scripting Runtime

IL2CPP

Release Distribution Type

Pre-built SDK from https://firebase.google.com/download/unity

Relevant Log Output

No response

If using CocoaPods for Apple platforms, the project's Podfile.lock

Expand Podfile.lock snippet

👀 Replace this line with the contents of your Podfile.lock!

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[argzdev]

Thanks for reaching out, @EllieTellie. While we investigate this, could you share with us which version of Firebase Messaging were you using prior to encountering this issue?

[EllieTellie]

We were on 11.7.0 before. I'll do some more testing tomorrow.

[EllieTellie]

Regression testing

11.7.0 is not affected.
12.0.0 is not affected.
12.1.0 is not affected.
12.2.0 is affected.

[EllieTellie]

I am not fluent in c++, but I imagine the destructor is deallocating the already deleted android pointer. https://github.com/firebase/firebase-cpp-sdk/blob/main/messaging/src/include/firebase/messaging.h#L108

Which is invoked from the Unity C# code in the Firebase.Messaging.FirebaseMessageInternal class looking at the decompiled source code.

In the Dispose(bool disposing) method it is calling this and then crashing:
FirebaseMessagingInternalPINVOKE.delete_FirebaseMessageInternal(this.swigCPtr);