Crash: objc_retain in TextToSpeech framework (macOS 27)

[kpmmmurphy]

Crash report

File: M1K3-2026-09-16-202458.ips
Date: 2026-09-16 20:24:58 +0100
OS: macOS 27.0 (26A428)
Exception: EXC_BAD_ACCESS / SIGSEGV (KERN_INVALID_ADDRESS at 0x000010aec0c84ad8)

Stack trace (crashed thread)

 0 [libobjc.A.dylib] objc_retain
 1 [TextToSpeech] <unsymbolicated +2358056>
 2 [TextToSpeech] <unsymbolicated +724224>
 3 [libdispatch.dylib] _dispatch_call_block_and_release
 4 [libdispatch.dylib] _dispatch_client_callout
 5-6 [libdispatch.dylib] _dispatch_main_queue_drain
 7 [libdispatch.dylib] _dispatch_main_queue_callback_4CF
 8-14 [CoreFoundation/HIToolbox/AppKit] main run loop

Analysis

A dangling pointer in Apple's TextToSpeech private framework — objc_retain on the main dispatch queue tried to retain an already-deallocated object. The crash is entirely within Apple's framework code (frames 0–2), dispatched on the main queue.

Likely cause: an AVSpeechSynthesizer delegate callback or completion block referencing a deallocated synthesizer or utterance. M1K3 uses system AVSpeechSynthesizer as a fallback voice (the primary is Kokoro/MLX). This could happen if:

• The synthesizer was deallocated while speech was in progress
• A delegate callback arrived after the owning view/controller was torn down

Mitigation: ensure the AVSpeechSynthesizer instance outlives any in-flight utterance, or stop speech before deallocation. Since the crash is inside Apple's framework, it may also be an Apple bug on macOS 27.0.

Notes

• Single occurrence (1 report)
• The address 0x000010aec0c84ad8 has a high bit set — likely a stale tagged pointer or use-after-free
• No M1K3 frames in the stack — this is a framework-internal crash

[kpmmmurphy]

Triage: Apple framework bug, single occurrence, no M1K3 frames in the crash thread.

The full stack is:

objc_retain → TextToSpeech +2358056 → TextToSpeech +724224
→ _dispatch_call_block_and_release → ... → NSApplicationMain

No M1K3 code in the crashing thread — the objc_retain is on a deallocated object inside Apple's private TextToSpeech framework, dispatched on the main queue.

Our AVSpeechSynthesizer is a let constant on the app-lifetime AVSpeechProvider singleton (Sources/M1K3Voice/AVSpeechProvider.swift:26). It is never deallocated. The delegate is set once in init() and locked per PR #10. stop() runs on @MainActor.

Verdict: monitor, don't fix. Single occurrence on macOS 27.0 (27A266a). If it recurs, the defensive option is a stopSpeaking(at: .immediate) with a completion guard before any new speak(), but that's speculative code against no evidence. Leaving open to track recurrence.