From f93f5d30e7710c09ac334b84e51c678e207fcd38 Mon Sep 17 00:00:00 2001 From: jslok Date: Wed, 22 Jul 2026 16:52:48 -0700 Subject: [PATCH 1/2] fix(ios): zero-initialize TfLiteCoreMlDelegateOptions TfLiteCoreMlDelegateOptions is a plain C struct with no ...OptionsDefault() helper, and it was declared without any initialization - so enabled_devices, coreml_version, max_delegated_partitions and min_nodes_per_partition were stack garbage. Depending on what values happened to be on the stack, this poisons the delegate's graph partitioning and can crash (EXC_BAD_ACCESS) inside the first TfLiteInterpreterInvoke. Zero values are the documented defaults (ANE-only devices, newest CoreML version, unlimited partitions), so '= {}' is the correct initialization. Same fix as #165, re-rolled against the Nitro codebase per maintainer feedback there. --- cpp/TfliteHelpers.cpp | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/cpp/TfliteHelpers.cpp b/cpp/TfliteHelpers.cpp index 9f931f93..3b16160b 100644 --- a/cpp/TfliteHelpers.cpp +++ b/cpp/TfliteHelpers.cpp @@ -133,7 +133,15 @@ int getTensorTotalLength(const TfLiteTensor* tensor) { TfLiteDelegate* getCoreMLDelegate() { #ifdef __APPLE__ #if FAST_TFLITE_ENABLE_CORE_ML - TfLiteCoreMlDelegateOptions delegateOptions; + // MUST be zero-initialized: TfLiteCoreMlDelegateOptions is a plain C struct + // and there is no ...OptionsDefault() helper. Without `= {}` the fields + // (enabled_devices, coreml_version, max_delegated_partitions, + // min_nodes_per_partition) are stack garbage that poisons the delegate's + // graph partitioning — EXC_BAD_ACCESS inside the first + // TfLiteInterpreterInvoke on device/OS combos whose stack layout produces + // harmful values. Zero values are the documented defaults (ANE-only + // devices, newest CoreML version, unlimited partitions). + TfLiteCoreMlDelegateOptions delegateOptions = {}; TfLiteDelegate* coreMlDelegate = TfLiteCoreMlDelegateCreate(&delegateOptions); return coreMlDelegate; #else // FAST_TFLITE_ENABLE_CORE_ML From c3a6a309b118f4159ef825dc48fd666ab87c1f71 Mon Sep 17 00:00:00 2001 From: jlok <22921326+jslok@users.noreply.github.com> Date: Thu, 23 Jul 2026 18:31:31 -0700 Subject: [PATCH 2/2] remove comments --- cpp/TfliteHelpers.cpp | 8 -------- 1 file changed, 8 deletions(-) diff --git a/cpp/TfliteHelpers.cpp b/cpp/TfliteHelpers.cpp index 3b16160b..b904b056 100644 --- a/cpp/TfliteHelpers.cpp +++ b/cpp/TfliteHelpers.cpp @@ -133,14 +133,6 @@ int getTensorTotalLength(const TfLiteTensor* tensor) { TfLiteDelegate* getCoreMLDelegate() { #ifdef __APPLE__ #if FAST_TFLITE_ENABLE_CORE_ML - // MUST be zero-initialized: TfLiteCoreMlDelegateOptions is a plain C struct - // and there is no ...OptionsDefault() helper. Without `= {}` the fields - // (enabled_devices, coreml_version, max_delegated_partitions, - // min_nodes_per_partition) are stack garbage that poisons the delegate's - // graph partitioning — EXC_BAD_ACCESS inside the first - // TfLiteInterpreterInvoke on device/OS combos whose stack layout produces - // harmful values. Zero values are the documented defaults (ANE-only - // devices, newest CoreML version, unlimited partitions). TfLiteCoreMlDelegateOptions delegateOptions = {}; TfLiteDelegate* coreMlDelegate = TfLiteCoreMlDelegateCreate(&delegateOptions); return coreMlDelegate;