[Bug] iOS TestFlight crash during rest between sets in Compose accessibility bounds

[9thLevelSoftware]

Reported via: TestFlight feedback zip posted in Discord bug-report thread

Type: Bug

Repo: mobile

Summary:
The iOS TestFlight build crashed while the tester was resting between sets. The crash is a main-thread EXC_BAD_ACCESS (SIGSEGV) in Compose Multiplatform accessibility bounds calculation (androidx.compose.ui.platform.AccessibilityElement.contentOffset / bounds), called from UIAccessibility while resolving accessibilityFrame.

Steps to Reproduce

1. Install TestFlight build 0.9.2 (20260614246) on iOS 26.5.1.
2. Start a workout/session and progress into a rest period between sets.
3. Remain on the rest-between-sets UI.
4. App crashes.

Expected Behavior

The app should remain stable during rest periods between sets, including when iOS accessibility queries UI element frames.

Actual Behavior

The app terminated with EXC_BAD_ACCESS (SIGSEGV) / KERN_INVALID_ADDRESS at 0x0000000000000008 on the main thread.

Environment

• App: VitruvianPhoenix / 0.9.2 (20260614246)
• TestFlight feedback id: ADqtrMMKQpL2Q-rLenw9oSM
• Feedback timestamp: 2026-06-14T15:48:33.820Z[UTC]
• Device model: iPhone18,2
• iOS: 26.5.1
• Architecture: arm64e
• Locale/timezone: en-CA / America/Toronto
• Network: WI_FI
• Battery: 80%
• Screen: 440×956

Tester Comment

Just was on a rest between sets

Crash Signature / Top Stack

Incident Identifier: C0A58473-379E-47C7-B276-06D5D627FF76
Distributor ID:      com.apple.TestFlight
Hardware Model:      iPhone18,2
Process:             VitruvianPhoenix [10655]
Identifier:          com.devil.phoenixproject.projectphoenix
Version:             0.9.2 (20260614246)
Date/Time:           2026-06-14 11:47:44.7406 -0400
Launch Time:         2026-06-14 11:21:56.0881 -0400
OS Version:          iPhone OS 26.5.1 (23F81)
Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000008
Exception Codes: 0x0000000000000001, 0x0000000000000008
Termination Reason: SIGNAL 11 Segmentation fault: 11
Triggered by Thread:  0

Thread 0 Crashed:
0   VitruvianPhoenix              	0x0000000104b2af08 kfun:androidx.compose.ui.platform.AccessibilityElement.contentOffset#internal + 32 (Accessibility.uikit.kt:726)
1   VitruvianPhoenix              	0x0000000104b2af08 kfun:androidx.compose.ui.platform.AccessibilityElement.bounds#internal + 192
2   VitruvianPhoenix              	0x0000000104b2aebc kfun:androidx.compose.ui.platform.AccessibilityElement.bounds#internal + 116 (Accessibility.uikit.kt:725)
3   VitruvianPhoenix              	0x0000000106e26540 _6f72672e6a6574627261696e732e636f6d706f73652e75693a75692f6f70742f6275696c644167656e742f776f726b2f346664313831636635653831343836352f636f6d706f73652f75692f75692f7372632f75696b69744d61696e2f6b6f746c69... + 228
4   UIAccessibility               	0x00000001ac3e8528 -[UIAccessibilityElementSuperCategory accessibilityFrame] + 64 (UIAccessibilityElement.m:379)
5   VitruvianPhoenix              	0x0000000106e6de58 -[CMPAccessibilityElement accessibilityFrame] + 40
6   UIAccessibility               	0x00000001ac3c6560 -[NSObject(AXPrivCategory) _iosAccessibilityAttributeValue:] + 7592 (NSObjectAccessibility.m:6789)
7   UIAccessibility               	0x00000001ac39feec _copyMultipleAttributeValuesCallback + 556 (UIAccessibilityRuntime.m:960)
8   AXRuntime                     	0x00000001c2dddea4 ___AXXMIGCopyMultipleAttributeValues_block_invoke + 64 (AccessibilityPriv.m:1414)
9   AXRuntime                     	0x00000001c2ddd9c0 _handleNonMainThreadCallback + 60 (AccessibilityPriv.m:581)
10  AXRuntime                     	0x00000001c2dddda0 _AXXMIGCopyMultipleAttributeValues + 664 (AccessibilityPriv.m:1413)
11  AXRuntime                     	0x00000001c2e1a0d4 _XCopyMultipleAttributeValues + 360 (AccessibilityClientDefsServer.c:1308)
12  AXRuntime                     	0x00000001c2dd1e88 mshMIGPerform + 284 (MachServerHelper.c:469)
13  CoreFoundation                	0x00000001845a9824 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 60 (CFRunLoop.c:2045)
14  CoreFoundation                	0x00000001845a974c __CFRunLoopDoSource1 + 504 (CFRunLoop.c:2184)
15  CoreFoundation                	0x00000001845746e4 __CFRunLoopRun + 2168 (CFRunLoop.c:3205)
16  CoreFoundation                	0x000000018457354c _CFRunLoopRunSpecificWithOptions + 532 (CFRunLoop.c:3462)
17  GraphicsServices              	0x0000000229cdf498 GSEventRunModal + 120 (GSEvent.c:2049)
18  UIKitCore                     	0x000000018a26c244 -[UIApplication _run] + 796 (UIApplication.m:3904)
19  UIKitCore                     	0x000000018a1d7158 UIApplicationMain + 332 (UIApplication.m:5586)
20  SwiftUI                       	0x000000018d5c2570 closure #1 in KitRendererCommon(_:) + 168 (UIKitApp.swift:65)
21  SwiftUI                       	0x000000018d5bf0f4 runApp<A>(_:) + 112 (UIKitApp.swift:16)
22  SwiftUI                       	0x000000018d5bec48 static App.main() + 172 (App.swift:137)
23  VitruvianPhoenix              	0x00000001045a89d4 static VitruvianPhoenixApp.$main() + 28 (VitruvianPhoenixApp.swift:0)
24  VitruvianPhoenix              	0x00000001045a89d4 main + 40
25  dyld                          	0x0000000181181c1c start + 6928 (dyldMain.cpp:1505)

Original TestFlight feedback.json

{
  "id": "ADqtrMMKQpL2Q-rLenw9oSM",
  "timestamp": "2026-06-14T15:48:33.820Z[UTC]",
  "appAppleId": 6756851289,
  "cfBundleShortVersion": "0.9.2",
  "cfBundleVersion": "20260614246",
  "deviceModel": "iPhone18,2",
  "osVersion": "26.5.1",
  "locale": "en-CA",
  "carrier": null,
  "timezone": "America/Toronto",
  "architecture": "arm64e",
  "connectionStatus": "WI_FI",
  "pairedAppleWatch": "",
  "appUptimeMillis": null,
  "availableDiskBytes": 69907017728,
  "totalDiskBytes": 255360323584,
  "networkType": null,
  "batteryPercentage": 80,
  "screenWidth": 440,
  "screenHeight": 956,
  "emailAddress": null,
  "comment": "Just was on a rest between sets "
}

Full crashlog.crash

Incident Identifier: C0A58473-379E-47C7-B276-06D5D627FF76
Distributor ID:      com.apple.TestFlight
Hardware Model:      iPhone18,2
Process:             VitruvianPhoenix [10655]
Path:                /private/var/containers/Bundle/Application/96678160-935C-46C2-9951-79AA78087B4A/VitruvianPhoenix.app/VitruvianPhoenix
Identifier:          com.devil.phoenixproject.projectphoenix
Version:             0.9.2 (20260614246)
AppStoreTools:       17F41
AppVariant:          1:iPhone18,2:26
Beta:                YES
Code Type:           ARM-64 (Native)
Role:                Foreground
Parent Process:      launchd [1]
Coalition:           com.devil.phoenixproject.projectphoenix [3597]

Date/Time:           2026-06-14 11:47:44.7406 -0400
Launch Time:         2026-06-14 11:21:56.0881 -0400
OS Version:          iPhone OS 26.5.1 (23F81)
Release Type:        User
Baseband Version:    1.60.02
Report Version:      104

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000008
Exception Codes: 0x0000000000000001, 0x0000000000000008
VM Region Info: 0x8 is not in any region.  Bytes before following region: 4367990776
      REGION TYPE                 START - END      [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      UNUSED SPACE AT START
--->  
      __TEXT                   1045a4000-1045a8000 [   16K] r-x/r-x SM=COW  /var/containers/Bundle/Application/96678160-935C-46C2-9951-79AA78087B4A/VitruvianPhoenix.app/VitruvianPhoenix
Termination Reason: SIGNAL 11 Segmentation fault: 11
Terminating Process: exc handler [10655]

Triggered by Thread:  0


Thread 0 name:
Thread 0 Crashed:
0   VitruvianPhoenix              	0x0000000104b2af08 kfun:androidx.compose.ui.platform.AccessibilityElement.contentOffset#internal + 32 (Accessibility.uikit.kt:726)
1   VitruvianPhoenix              	0x0000000104b2af08 kfun:androidx.compose.ui.platform.AccessibilityElement.bounds#internal + 192
2   VitruvianPhoenix              	0x0000000104b2aebc kfun:androidx.compose.ui.platform.AccessibilityElement.bounds#internal + 116 (Accessibility.uikit.kt:725)
3   VitruvianPhoenix              	0x0000000106e26540 _6f72672e6a6574627261696e732e636f6d706f73652e75693a75692f6f70742f6275696c644167656e742f776f726b2f346664313831636635653831343836352f636f6d706f73652f75692f75692f7372632f75696b69744d61696e2f6b6f746c69... + 228
4   UIAccessibility               	0x00000001ac3e8528 -[UIAccessibilityElementSuperCategory accessibilityFrame] + 64 (UIAccessibilityElement.m:379)
5   VitruvianPhoenix              	0x0000000106e6de58 -[CMPAccessibilityElement accessibilityFrame] + 40
6   UIAccessibility               	0x00000001ac3c6560 -[NSObject(AXPrivCategory) _iosAccessibilityAttributeValue:] + 7592 (NSObjectAccessibility.m:6789)
7   UIAccessibility               	0x00000001ac39feec _copyMultipleAttributeValuesCallback + 556 (UIAccessibilityRuntime.m:960)
8   AXRuntime                     	0x00000001c2dddea4 ___AXXMIGCopyMultipleAttributeValues_block_invoke + 64 (AccessibilityPriv.m:1414)
9   AXRuntime                     	0x00000001c2ddd9c0 _handleNonMainThreadCallback + 60 (AccessibilityPriv.m:581)
10  AXRuntime                     	0x00000001c2dddda0 _AXXMIGCopyMultipleAttributeValues + 664 (AccessibilityPriv.m:1413)
11  AXRuntime                     	0x00000001c2e1a0d4 _XCopyMultipleAttributeValues + 360 (AccessibilityClientDefsServer.c:1308)
12  AXRuntime                     	0x00000001c2dd1e88 mshMIGPerform + 284 (MachServerHelper.c:469)
13  CoreFoundation                	0x00000001845a9824 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 60 (CFRunLoop.c:2045)
14  CoreFoundation                	0x00000001845a974c __CFRunLoopDoSource1 + 504 (CFRunLoop.c:2184)
15  CoreFoundation                	0x00000001845746e4 __CFRunLoopRun + 2168 (CFRunLoop.c:3205)
16  CoreFoundation                	0x000000018457354c _CFRunLoopRunSpecificWithOptions + 532 (CFRunLoop.c:3462)
17  GraphicsServices              	0x0000000229cdf498 GSEventRunModal + 120 (GSEvent.c:2049)
18  UIKitCore                     	0x000000018a26c244 -[UIApplication _run] + 796 (UIApplication.m:3904)
19  UIKitCore                     	0x000000018a1d7158 UIApplicationMain + 332 (UIApplication.m:5586)
20  SwiftUI                       	0x000000018d5c2570 closure #1 in KitRendererCommon(_:) + 168 (UIKitApp.swift:65)
21  SwiftUI                       	0x000000018d5bf0f4 runApp<A>(_:) + 112 (UIKitApp.swift:16)
22  SwiftUI                       	0x000000018d5bec48 static App.main() + 172 (App.swift:137)
23  VitruvianPhoenix              	0x00000001045a89d4 static VitruvianPhoenixApp.$main() + 28 (VitruvianPhoenixApp.swift:0)
24  VitruvianPhoenix              	0x00000001045a89d4 main + 40
25  dyld                          	0x0000000181181c1c start + 6928 (dyldMain.cpp:1505)

Thread 1 name:
Thread 1:
0   libsystem_kernel.dylib        	0x00000002336c15e8 __psynch_cvwait + 8 (:-1)
1   libsystem_pthread.dylib       	0x00000001e373ab48 _pthread_cond_wait + 980 (pthread_cond.c:862)
2   libc++.1.dylib                	0x0000000193c823dc std::__1::condition_variable::__do_timed_wait(std::__1::unique_lock<std::__1::mutex>&, std::__1::chrono::time_point<std::__1::chrono::system_clock, std::__1::chrono::duration<long long, std::__1::r... + 104 (condition_variable.cpp:60)
3   VitruvianPhoenix              	0x0000000106e4df80 void kotlin::RepeatedTimer<kotlin::steady_clock>::Run<kotlin::gcScheduler::internal::GCSchedulerDataAdaptive<kotlin::steady_clock>::GCSchedulerDataAdaptive(kotlin::gcScheduler::GCSchedulerConfig&, ... + 256
4   VitruvianPhoenix              	0x0000000106e4e310 void* std::__1::__thread_proxy[abi:ne200100]<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void (*)(kotlin::ScopedThread::att... + 124
5   libsystem_pthread.dylib       	0x00000001e373c438 _pthread_start + 136 (pthread.c:931)
6   libsystem_pthread.dylib       	0x00000001e37388cc thread_start + 8 (:-1)

Thread 2 name:
Thread 2:
0   VitruvianPhoenix              	0x0000000106e4055c bool kotlin::alloc::FixedBlockPage::Sweep<kotlin::alloc::ObjectSweepTraits>(kotlin::alloc::ObjectSweepTraits::GCSweepScope&, kotlin::alloc::SegregatedFinalizerQueue<kotlin::alloc::AtomicStack<kotli... + 332
1   VitruvianPhoenix              	0x0000000106e4a908 kotlin::gc::internal::MainGCThread<kotlin::gc::internal::PmcsGCTraits>::PerformFullGC(long long) + 6396
2   VitruvianPhoenix              	0x0000000106e48dc8 std::__1::invoke_result<kotlin::gc::internal::MainGCThread<kotlin::gc::internal::PmcsGCTraits>::MainGCThread(GCStateHolder&, kotlin::alloc::Allocator&, kotlin::gcScheduler::GCScheduler&, kotlin::gc... + 268
3   VitruvianPhoenix              	0x0000000106e48ed0 void* std::__1::__thread_proxy[abi:ne200100]<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void (*)(kotlin::ScopedThread::att... + 116
4   libsystem_pthread.dylib       	0x00000001e373c438 _pthread_start + 136 (pthread.c:931)
5   libsystem_pthread.dylib       	0x00000001e37388cc thread_start + 8 (:-1)

Thread 3:
0   libsystem_kernel.dylib        	0x00000002336c15e8 __psynch_cvwait + 8 (:-1)
1   libsystem_pthread.dylib       	0x00000001e373ab48 _pthread_cond_wait + 980 (pthread_cond.c:862)
2   VitruvianPhoenix              	0x0000000106e63630 (anonymous namespace)::waitInNativeState(_opaque_pthread_cond_t*, _opaque_pthread_mutex_t*, unsigned long long, unsigned long long*) + 176
3   VitruvianPhoenix              	0x0000000106e62600 Worker::processQueueElement(bool) + 796
4   VitruvianPhoenix              	0x0000000106e6222c (anonymous namespace)::workerRoutine(void*) + 128
5   libsystem_pthread.dylib       	0x00000001e373c438 _pthread_start + 136 (pthread.c:931)
6   libsystem_pthread.dylib       	0x00000001e37388cc thread_start + 8 (:-1)

Thread 4:
0   libsystem_kernel.dylib        	0x00000002336c15e8 __psynch_cvwait + 8 (:-1)
1   libsystem_pthread.dylib       	0x00000001e373ab48 _pthread_cond_wait + 980 (pthread_cond.c:862)
2   VitruvianPhoenix              	0x0000000106e63630 (anonymous namespace)::waitInNativeState(_opaque_pthread_cond_t*, _opaque_pthread_mutex_t*, unsigned long long, unsigned long long*) + 176
3   VitruvianPhoenix              	0x00000001046db718 kfun:kotlin.native.concurrent.Worker#park(kotlin.Long;kotlin.Boolean){}kotlin.Boolean + 340 (Builders.kt:70)
4   VitruvianPhoenix              	0x00000001046db718 kfun:kotlinx.coroutines.BlockingCoroutine.joinBlocking#internal + 732
5   VitruvianPhoenix              	0x00000001046db718 kfun:kotlinx.coroutines#runBlocking(kotlin.coroutines.CoroutineContext;kotlin.coroutines.SuspendFunction1<kotlinx.coroutines.CoroutineScope,0:0>){0§<kotlin.Any?>}0:0 + 2080
6   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines#runBlocking$default(kotlin.coroutines.CoroutineContext?;kotlin.coroutines.SuspendFunction1<kotlinx.coroutines.CoroutineScope,0:0>;kotlin.Int){0§<kotlin.Any?>}0:0 + 16 (MultithreadedDispatchers.kt:86)
7   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines.MultiWorkerDispatcher.workerRunLoop#internal + 156
8   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines.MultiWorkerDispatcher.MultiWorkerDispatcher$1.MultiWorkerDispatcher$1$invoke$$inlined$apply$1.invoke#internal + 164
9   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines.MultiWorkerDispatcher.MultiWorkerDispatcher$1.MultiWorkerDispatcher$1$invoke$$inlined$apply$1.$<bridge-DN>invoke(){}#internal + 212
10  VitruvianPhoenix              	0x0000000106e6297c Worker::processQueueElement(bool) + 1688
11  VitruvianPhoenix              	0x0000000106e6222c (anonymous namespace)::workerRoutine(void*) + 128
12  libsystem_pthread.dylib       	0x00000001e373c438 _pthread_start + 136 (pthread.c:931)
13  libsystem_pthread.dylib       	0x00000001e37388cc thread_start + 8 (:-1)

Thread 5 name:
Thread 5:
0   libsystem_kernel.dylib        	0x00000002336bbcd4 mach_msg2_trap + 8 (:-1)
1   libsystem_kernel.dylib        	0x00000002336bf30c mach_msg2_internal + 76 (mach_msg.c:201)
2   libsystem_kernel.dylib        	0x00000002336bf22c mach_msg_overwrite + 424 (mach_msg.c:0)
3   libsystem_kernel.dylib        	0x00000002336bf078 mach_msg + 24 (mach_msg.c:323)
4   CoreFoundation                	0x00000001845aa344 __CFRunLoopServiceMachPort + 160 (CFRunLoop.c:2650)
5   CoreFoundation                	0x0000000184574310 __CFRunLoopRun + 1188 (CFRunLoop.c:3035)
6   CoreFoundation                	0x000000018457354c _CFRunLoopRunSpecificWithOptions + 532 (CFRunLoop.c:3462)
7   Foundation                    	0x00000001817e1cf0 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 212 (NSRunLoop.m:375)
8   Foundation                    	0x00000001817e1bd8 -[NSRunLoop(NSRunLoop) runUntilDate:] + 64 (NSRunLoop.m:422)
9   UIKitCore                     	0x000000018a231a7c -[UIEventFetcher threadMain] + 420 (UIEventFetcher.m:1333)
10  Foundation                    	0x0000000181865824 __NSThread__start__ + 732 (NSThread.m:1004)
11  libsystem_pthread.dylib       	0x00000001e373c438 _pthread_start + 136 (pthread.c:931)
12  libsystem_pthread.dylib       	0x00000001e37388cc thread_start + 8 (:-1)

Thread 6 name:
Thread 6:
0   libsystem_kernel.dylib        	0x00000002336bbcd4 mach_msg2_trap + 8 (:-1)
1   libsystem_kernel.dylib        	0x00000002336bf30c mach_msg2_internal + 76 (mach_msg.c:201)
2   libsystem_kernel.dylib        	0x00000002336bf22c mach_msg_overwrite + 424 (mach_msg.c:0)
3   libsystem_kernel.dylib        	0x00000002336bf078 mach_msg + 24 (mach_msg.c:323)
4   CoreFoundation                	0x00000001845aa344 __CFRunLoopServiceMachPort + 160 (CFRunLoop.c:2650)
5   CoreFoundation                	0x0000000184574310 __CFRunLoopRun + 1188 (CFRunLoop.c:3035)
6   CoreFoundation                	0x000000018457354c _CFRunLoopRunSpecificWithOptions + 532 (CFRunLoop.c:3462)
7   CoreFoundation                	0x0000000184623d64 CFRunLoopRun + 64 (CFRunLoop.c:3479)
8   VitruvianPhoenix              	0x0000000106e4db0c kotlin::alloc::FinalizerProcessor<kotlin::alloc::AtomicStack<kotlin::alloc::ExtraObjectCell>, kotlin::alloc::FinalizerQueueTraits>::ProcessingLoopWithCFImpl::body() + 124
9   VitruvianPhoenix              	0x0000000106e4c824 std::__1::invoke_result<kotlin::alloc::FinalizerProcessor<kotlin::alloc::AtomicStack<kotlin::alloc::ExtraObjectCell>, kotlin::alloc::FinalizerQueueTraits>::StartFinalizerThreadIfNone()::'lambda'()>... + 144
10  VitruvianPhoenix              	0x0000000106e4c8c0 void* std::__1::__thread_proxy[abi:ne200100]<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void (*)(kotlin::ScopedThread::att... + 112
11  libsystem_pthread.dylib       	0x00000001e373c438 _pthread_start + 136 (pthread.c:931)
12  libsystem_pthread.dylib       	0x00000001e37388cc thread_start + 8 (:-1)

Thread 7:
0   libsystem_kernel.dylib        	0x00000002336c15e8 __psynch_cvwait + 8 (:-1)
1   libsystem_pthread.dylib       	0x00000001e373ab48 _pthread_cond_wait + 980 (pthread_cond.c:862)
2   VitruvianPhoenix              	0x0000000106e63630 (anonymous namespace)::waitInNativeState(_opaque_pthread_cond_t*, _opaque_pthread_mutex_t*, unsigned long long, unsigned long long*) + 176
3   VitruvianPhoenix              	0x00000001046db718 kfun:kotlin.native.concurrent.Worker#park(kotlin.Long;kotlin.Boolean){}kotlin.Boolean + 340 (Builders.kt:70)
4   VitruvianPhoenix              	0x00000001046db718 kfun:kotlinx.coroutines.BlockingCoroutine.joinBlocking#internal + 732
5   VitruvianPhoenix              	0x00000001046db718 kfun:kotlinx.coroutines#runBlocking(kotlin.coroutines.CoroutineContext;kotlin.coroutines.SuspendFunction1<kotlinx.coroutines.CoroutineScope,0:0>){0§<kotlin.Any?>}0:0 + 2080
6   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines#runBlocking$default(kotlin.coroutines.CoroutineContext?;kotlin.coroutines.SuspendFunction1<kotlinx.coroutines.CoroutineScope,0:0>;kotlin.Int){0§<kotlin.Any?>}0:0 + 16 (MultithreadedDispatchers.kt:86)
7   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines.MultiWorkerDispatcher.workerRunLoop#internal + 156
8   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines.MultiWorkerDispatcher.MultiWorkerDispatcher$1.MultiWorkerDispatcher$1$invoke$$inlined$apply$1.invoke#internal + 164
9   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines.MultiWorkerDispatcher.MultiWorkerDispatcher$1.MultiWorkerDispatcher$1$invoke$$inlined$apply$1.$<bridge-DN>invoke(){}#internal + 212
10  VitruvianPhoenix              	0x0000000106e6297c Worker::processQueueElement(bool) + 1688
11  VitruvianPhoenix              	0x0000000106e6222c (anonymous namespace)::workerRoutine(void*) + 128
12  libsystem_pthread.dylib       	0x00000001e373c438 _pthread_start + 136 (pthread.c:931)
13  libsystem_pthread.dylib       	0x00000001e37388cc thread_start + 8 (:-1)

Thread 8:
0   libsystem_kernel.dylib        	0x00000002336c15e8 __psynch_cvwait + 8 (:-1)
1   libsystem_pthread.dylib       	0x00000001e373ab48 _pthread_cond_wait + 980 (pthread_cond.c:862)
2   VitruvianPhoenix              	0x0000000106e63630 (anonymous namespace)::waitInNativeState(_opaque_pthread_cond_t*, _opaque_pthread_mutex_t*, unsigned long long, unsigned long long*) + 176
3   VitruvianPhoenix              	0x00000001046db718 kfun:kotlin.native.concurrent.Worker#park(kotlin.Long;kotlin.Boolean){}kotlin.Boolean + 340 (Builders.kt:70)
4   VitruvianPhoenix              	0x00000001046db718 kfun:kotlinx.coroutines.BlockingCoroutine.joinBlocking#internal + 732
5   VitruvianPhoenix              	0x00000001046db718 kfun:kotlinx.coroutines#runBlocking(kotlin.coroutines.CoroutineContext;kotlin.coroutines.SuspendFunction1<kotlinx.coroutines.CoroutineScope,0:0>){0§<kotlin.Any?>}0:0 + 2080
6   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines#runBlocking$default(kotlin.coroutines.CoroutineContext?;kotlin.coroutines.SuspendFunction1<kotlinx.coroutines.CoroutineScope,0:0>;kotlin.Int){0§<kotlin.Any?>}0:0 + 16 (MultithreadedDispatchers.kt:86)
7   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines.MultiWorkerDispatcher.workerRunLoop#internal + 156
8   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines.MultiWorkerDispatcher.MultiWorkerDispatcher$1.MultiWorkerDispatcher$1$invoke$$inlined$apply$1.invoke#internal + 164
9   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines.MultiWorkerDispatcher.MultiWorkerDispatcher$1.MultiWorkerDispatcher$1$invoke$$inlined$apply$1.$<bridge-DN>invoke(){}#internal + 212
10  VitruvianPhoenix              	0x0000000106e6297c Worker::processQueueElement(bool) + 1688
11  VitruvianPhoenix              	0x0000000106e6222c (anonymous namespace)::workerRoutine(void*) + 128
12  libsystem_pthread.dylib       	0x00000001e373c438 _pthread_start + 136 (pthread.c:931)
13  libsystem_pthread.dylib       	0x00000001e37388cc thread_start + 8 (:-1)

Thread 9:
0   libsystem_kernel.dylib        	0x00000002336c15e8 __psynch_cvwait + 8 (:-1)
1   libsystem_pthread.dylib       	0x00000001e373ab48 _pthread_cond_wait + 980 (pthread_cond.c:862)
2   VitruvianPhoenix              	0x0000000106e63630 (anonymous namespace)::waitInNativeState(_opaque_pthread_cond_t*, _opaque_pthread_mutex_t*, unsigned long long, unsigned long long*) + 176
3   VitruvianPhoenix              	0x00000001046db718 kfun:kotlin.native.concurrent.Worker#park(kotlin.Long;kotlin.Boolean){}kotlin.Boolean + 340 (Builders.kt:70)
4   VitruvianPhoenix              	0x00000001046db718 kfun:kotlinx.coroutines.BlockingCoroutine.joinBlocking#internal + 732
5   VitruvianPhoenix              	0x00000001046db718 kfun:kotlinx.coroutines#runBlocking(kotlin.coroutines.CoroutineContext;kotlin.coroutines.SuspendFunction1<kotlinx.coroutines.CoroutineScope,0:0>){0§<kotlin.Any?>}0:0 + 2080
6   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines#runBlocking$default(kotlin.coroutines.CoroutineContext?;kotlin.coroutines.SuspendFunction1<kotlinx.coroutines.CoroutineScope,0:0>;kotlin.Int){0§<kotlin.Any?>}0:0 + 16 (MultithreadedDispatchers.kt:86)
7   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines.MultiWorkerDispatcher.workerRunLoop#internal + 156
8   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines.MultiWorkerDispatcher.MultiWorkerDispatcher$1.MultiWorkerDispatcher$1$invoke$$inlined$apply$1.invoke#internal + 164
9   VitruvianPhoenix              	0x00000001046e09ac kfun:kotlinx.coroutines.MultiWorkerDispatcher.MultiWorkerDispatcher$1.MultiWorkerDispatcher$1$invoke$$inlined$apply$1.$<bridge-DN>invoke(){}#internal + 212
10  VitruvianPhoenix              	0x0000000106e6297c Worker::processQueueElement(bool) + 1688
11  VitruvianPhoenix              	0x0000000106e6222c (anonymous namespace)::workerRoutine(void*) + 128
12  libsystem_pthread.dylib       	0x00000001e373c438 _pthread_start + 136 (pthread.c:931)
13  libsystem_pthread.dylib       	0x00000001e37388cc thread_start + 8 (:-1)

Thread 10 name:
Thread 10:
0   libsystem_kernel.dylib        	0x00000002336bbc50 semaphore_wait_trap + 8 (:-1)
1   caulk                         	0x000000029e27ac6c caulk::semaphore::timed_wait(double) + 224 (semaphore.cpp:98)
2   caulk                         	0x000000029e27acb8 caulk::concurrent::details::worker_thread::run() + 32 (messenger.cpp:237)
3   caulk                         	0x000000029e27ef54 void* caulk::thread_proxy<std::__1::tuple<caulk::thread::attributes, void (caulk::concurrent::details::worker_thread::*)(), std::__1::tuple<caulk::concurrent::details::worker_thread*>>>(void*) + 96 (thread.h:196)
4   libsystem_pthread.dylib       	0x00000001e373c438 _pthread_start + 136 (pthread.c:931)
5   libsystem_pthread.dylib       	0x00000001e37388cc thread_start + 8 (:-1)

Thread 11 name:
Thread 11:
0   libsystem_kernel.dylib        	0x00000002336bbc50 semaphore_wait_trap + 8 (:-1)
1   caulk                         	0x000000029e27ac6c caulk::semaphore::timed_wait(double) + 224 (semaphore.cpp:98)
2   caulk                         	0x000000029e27acb8 caulk::concurrent::details::worker_thread::run() + 32 (messenger.cpp:237)
3   caulk                         	0x000000029e27ef54 void* caulk::thread_proxy<std::__1::tuple<caulk::thread::attributes, void (caulk::concurrent::details::worker_thread::*)(), std::__1::tuple<caulk::concurrent::details::worker_thread*>>>(void*) + 96 (thread.h:196)
4   libsystem_pthread.dylib       	0x00000001e373c438 _pthread_start + 136 (pthread.c:931)
5   libsystem_pthread.dylib       	0x00000001e37388cc thread_start + 8 (:-1)

Thread 12:

Thread 13:

Thread 14:

Thread 15:

Thread 16:


Thread 0 crashed with ARM Thread State (64-bit):
    x0: 0x000000010926f8b8   x1: 0x000000016b857cb8   x2: 0x000000016b857cb0   x3: 0x0000000000000103
    x4: 0x0000000125bb1a10   x5: 0x0000000000000010   x6: 0xffffffffbfc007ff   x7: 0xfffff0003ffff800
    x8: 0x00000001074b1000   x9: 0x000000016b857be0  x10: 0x0000000107bd320e  x11: 0x01ff00010dcbc000
   x12: 0x00000000000000ec  x13: 0x000000010dcbceb0  x14: 0x010000010dc90307  x15: 0x000000010dc90300
   x16: 0x00000000000000b8  x17: 0x000000010926f800  x18: 0x0000000000000000  x19: 0x000000010926f8b8
   x20: 0x0000000112450e80  x21: 0x000000016b857b28  x22: 0x0000000000000000  x23: 0x0000000112450e80
   x24: 0x0000000000000036  x25: 0x0000000125bb1a10  x26: 0x0000000000000000  x27: 0x000000010dc880a8
   x28: 0x00000000000007d3   fp: 0x000000016b857c70   lr: 0x0000000104b2aebc
    sp: 0x000000016b857b20   pc: 0x0000000104b2af08 cpsr: 0x60000000
   esr: 0x92000006 (Data Abort) byte read Translation fault


Binary Images:
        0x1045a4000 -         0x107db3fff VitruvianPhoenix arm64  <3f0b4f60a0d9335aa0abdcbdeb290db1> /private/var/containers/Bundle/Application/96678160-935C-46C2-9951-79AA78087B4A/VitruvianPhoenix.app/VitruvianPhoenix
        0x10f400000 -         0x10f40bfff libobjc-trampolines.dylib arm64e  <3702c305c51e37d59a2255cef15e974a> /private/preboot/Cryptexes/OS/usr/lib/libobjc-trampolines.dylib
        0x18117d000 -         0x18122217f dyld arm64e  <41de795b928337fd917ed674bb73f541> /usr/lib/dyld
        0x1817d7000 -         0x18265f6df Foundation arm64e  <2f9c66e87a0e379e8608f42ef19f0c33> /System/Library/Frameworks/Foundation.framework/Foundation
        0x184545000 -         0x184ae179f CoreFoundation arm64e  <fe9658b29de63fa5907b0b3a3bcbb0b7> /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation
        0x18a14b000 -         0x18c68bd7f UIKitCore arm64e  <9ee8c19aa3703599823b34b84131aad7> /System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore
        0x18d592000 -         0x18e81d8df SwiftUI arm64e  <a5cd9c54e40a373683664ce5dab770d5> /System/Library/Frameworks/SwiftUI.framework/SwiftUI
        0x193c71000 -         0x193d01a7b libc++.1.dylib arm64e  <1021bb438e783e4da7a4876bcdd5b9f2> /usr/lib/libc++.1.dylib
        0x1ac393000 -         0x1ac43f31f UIAccessibility arm64e  <0bed5da80b9e3191ae7fff9a037a3065> /System/Library/PrivateFrameworks/UIAccessibility.framework/UIAccessibility
        0x1c2dd0000 -         0x1c2e3abbf AXRuntime arm64e  <f1b0328b37aa357e9fdf307d8274e286> /System/Library/PrivateFrameworks/AXRuntime.framework/AXRuntime
        0x1e3738000 -         0x1e37444ef libsystem_pthread.dylib arm64e  <9e89e20fcf2d31a9a23f158eb5a0affe> /usr/lib/system/libsystem_pthread.dylib
        0x229cde000 -         0x229ce67bf GraphicsServices arm64e  <d0a89589718a3d3a96dad2c99bb19040> /System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices
        0x2336bb000 -         0x2336f6ae7 libsystem_kernel.dylib arm64e  <eb06421e7aa8303faaabb7501b063f9d> /usr/lib/system/libsystem_kernel.dylib
        0x29e277000 -         0x29e29ffff caulk arm64e  <a0726d62be8f309e8587b69dbbad8b99> /System/Library/PrivateFrameworks/caulk.framework/caulk

EOF

[9thLevelSoftware]

RCA — iOS TestFlight crash during rest between sets (EXC_BAD_ACCESS in Compose accessibility bounds)

RCA owner: GPT-5.5 xhigh | Recreation status: REPRODUCED (code-level) / BLOCKED (live iOS — no simulator/device in CI)
Upstream match: JetBrains/compose-multiplatform#5543 — confirmed identical crash signature and root cause

---

Evidence used

• Original report: TestFlight feedback id ADqtrMMKQpL2Q-rLenw9oSM, tester comment "Just was on a rest between sets", app 0.9.2 (20260614246), iPhone18,2 / iOS 26.5.1.
• Crashlog: EXC_BAD_ACCESS (SIGSEGV), KERN_INVALID_ADDRESS at 0x0000000000000008, main thread. ESR 0x92000006 (Data Abort) byte read Translation fault.
• Stack (frames 0–5): AccessibilityElement.contentOffset#internal (Accessibility.uikit.kt:726) → AccessibilityElement.bounds#internal (725) → UIAccessibilityElementSuperCategory accessibilityFrame → CMPAccessibilityElement accessibilityFrame → AXRuntime CopyMultipleAttributeValues.
• Bug recreation artifact: ~/.hermes/phoenix-bug-recreations/565/bug-recreation.md — code-level REPRODUCED; the throw site and the rest-screen AX-traffic trigger were both identified.
• RCA research gate: No reporter clarification needed; the crash stack + rest screen context are sufficient.

Root cause

Use-after-free in Compose Multiplatform 1.10.3's iOS accessibility bridge — AccessibilityElement.contentOffset() dereferences a disposed node without an isAlive guard.

The crash path, independently traced in the upstream CMP source (compose-multiplatform-core, Accessibility.ios.kt):

1. iOS AXRuntime sends a Mach IPC CopyMultipleAttributeValues callback (from the AXServer process) to query accessibility frames on the main run loop.
2. This calls CMPAccessibilityElement.accessibilityFrame → AccessibilityElement.bounds() (line 779).
3. bounds() calls contentOffset() (line 780), which returns node.scrollContentOffset (line 834) with no isAlive/disposed check.
4. scrollContentOffset is a computed property (line 389–395) that dereferences node.semanticsNode.layoutNode.density — a chain of pointer dereferences through the Compose semantics/layout node.
5. If the AccessibilityElement was disposed during a recomposition (the dispose() function at line 604–609 sets disposed = true but does not null out node), and iOS UIAccessibility still holds a reference to the ObjC CMPAccessibilityElement wrapper, the node.semanticsNode... dereference hits freed/invalidated memory → EXC_BAD_ACCESS at offset 0x8 (the field offset of semanticsNode inside the dead AccessibilityNode object).

The isAlive guard exists at line 570 (private val isAlive get() = !disposed && node.semanticsNode.isValid) but is not used in bounds(), contentOffset(), visibleSize(), or contentSize(). This is the same class of bug as the earlier PR #2616 fix (included in 1.10.0), but on a separate code path that remained unguarded — confirmed by upstream issue #5543.

Why the rest screen triggers it

The rest-between-sets screen is a stress surface for this CMP race:

• WorkoutTab.kt:670–729 — is WorkoutState.Resting -> mounts RestTimerCard(restSecondsRemaining = workoutState.restSecondsRemaining, ...). The rest timer ticks at 1 Hz, driving WorkoutState.Resting recompositions every second, which rebuild/replace accessibility elements.
• RestTimerCard.kt:207–214 — a zero-size accessibility node:

  Box(
      modifier = Modifier
          .size(0.dp)
          .semantics {
              liveRegion = LiveRegionMode.Polite
              contentDescription = lastAnnouncedText
          },
  )

  This 0.dp liveRegion = Polite Box stays in the AX tree at zero size. Its contentDescription changes at 5s/10s/0s/paused boundaries (LaunchedEffect at line 164–174), causing semantics-tree mutations that dispose and recreate AX elements. iOS UIAccessibility polls the tree on its own AX cycle, so it can race a 1 Hz recomposition that disposes an element while AX is mid-accessibilityFrame query.

Upstream issue #5543 confirms ~83% of crashes occur on iOS 26.x (our crash is iOS 26.5.1) and that VoiceOver/accessibility features being enabled increases crash frequency — consistent with the AX-polling race.

Fix direction (binding for downstream bugfix agent)

Primary fix — Phoenix-side mitigation (in-scope, bounded to RestTimerCard.kt):

Remove the standalone 0.dp liveRegion Box (lines 207–214) and relocate the liveRegion = LiveRegionMode.Polite + contentDescription = lastAnnouncedText semantics onto the visible timer Text element (lines 279–288, the formatRestTime(restSecondsRemaining) display). This:

• Eliminates the zero-size AX node that increases element-disposal churn during recomposition.
• Preserves VoiceOver/TalkBack countdown announcements (the liveRegion semantics remain, just on a stable visible element that is not created/destroyed every tick).
• Does not depend on a CMP library upgrade.

Secondary fix — CMP upgrade (recommended follow-up, separate PR/scope):

Upgrade compose-multiplatform from 1.10.3 to 1.11.1 (released Jun 2, 2026; gradle/libs.versions.toml line 5). Upstream issue #5543 was closed with a fix in PR #2760 ("Fix hit test for Accessibility Elements") targeting 1.11.0-alpha03+. This should add the missing isAlive/validity guard to the bounds/contentOffset path. The upgrade should be verified separately — the upstream closure was somewhat dismissive ("check the latest release and report to YouTrack if still there") and PR #2760's title ("hit test") may not fully cover the contentOffset dereference path. The Phoenix-side mitigation above is the safer immediate fix regardless.

Acceptance criteria

1. RestTimerCard.kt no longer declares a standalone Box(Modifier.size(0.dp).semantics { liveRegion = ...; contentDescription = ... }). The liveRegion = LiveRegionMode.Polite and contentDescription = lastAnnouncedText semantics are attached to the visible timer Text (or an equivalent stable, non-zero-size composable that persists across ticks).
2. VoiceOver/TalkBack countdown announcements still fire at 5s/10s/0s/paused intervals — the LaunchedEffect/lastAnnouncedText logic (lines 151–174) is unchanged; only the semantics attachment point moves.
3. No new compiler warnings or test failures (:shared:testAndroidHostTest passes).
4. No other files are modified (fix is bounded to RestTimerCard.kt).

Regression-test target

Add or extend a unit test verifying that the rest timer's liveRegion semantics are attached to the timer display element, not a separate 0.dp Box. If a Compose UI test framework is available for the shared module, a test that renders RestTimerCard and asserts the liveRegion node has non-zero size would directly guard against re-introducing the zero-size AX node.

Non-goals

• Do not modify the upstream CMP Accessibility.ios.kt / Accessibility.uikit.kt source — it is a library dependency, not Phoenix source.
• Do not remove accessibility/announcement support from the rest screen — the fix preserves VoiceOver/TalkBack functionality.
• Do not bundle the CMP 1.11.1 upgrade into the same PR as the RestTimerCard.kt mitigation — the upgrade is a separate scope that needs its own verification (Kotlin version compatibility, API changes, iOS build validation).
• Do not change the rest timer logic, pause/extend/skip controls, or the LaunchedEffect announcement throttling — only the semantics attachment point changes.

Affected code

File	Lines	Role
shared/.../presentation/screen/RestTimerCard.kt	207–214	Fix target — zero-size liveRegion Box to remove/relocate
shared/.../presentation/screen/RestTimerCard.kt	279–288	Relocation target — visible timer Text
shared/.../presentation/screen/RestTimerCard.kt	151–174	Announcement logic (unchanged)
shared/.../presentation/screen/WorkoutTab.kt	670–729	Rest state mount (context, unchanged)
gradle/libs.versions.toml	5	CMP version 1.10.3 (secondary upgrade target)
CMP Accessibility.ios.kt	570, 779–787, 834, 389–395, 604–609	Upstream throw site (out of scope)