Fix residual EXC_BREAKPOINT crashes in FBObjectiveCObject.allRetainedObjects

Summary:
After D103430527 reduced the EXC_BREAKPOINT crashes by ~95% in alpha/beta builds on Instagram and Threads/Barcelona, two residual crash modes still appear in alpha/beta at low rates (no production exposure yet):

1. swift_unknownObjectRetain crash inside the objc bridge of SwiftIntrospector.getPropertyValue. The Mirror API can return stale pointers for unowned references whose target was deallocated between the property assignment and the RCD traversal. The previous fix filtered out value types, but stale class instance pointers still passed through.

2. _class_lookUpIvar / object_getIvar crash when the parent object is released by another thread mid-traversal. The detector previously used objectPtr (a raw void*) which doesn't keep the object alive across the method.

Fixes:

- SwiftIntrospector.swift: Add isLikelyLiveObject() validation using malloc_size to filter out dangling pointers. Tagged pointers (high bit on arm64, low bit on x86_64) are handled separately since they aren't heap-allocated. Class instances and Foundation-bridgeable values are now liveness-checked before bridging to ObjC id.

- FBObjectiveCObject.m: Pin the object alive for the entire allRetainedObjects method via a strong local. For ObjC objects, reading self.object via the weak property gives us a brief strong reference. For pure Swift objects, the FBSwiftStrongRef wrapper held by the candidates array continues to keep the object alive.

Both crash signatures observed in alpha/beta builds:
- Instagram T268028126 (instagram_ios_crashes:69bd7a32c0a579e93bee27efe143c89a)
- Threads T268462327 (barcelona_ios_crashes:0132b4a00a546d59009ed4420a32303b)

Sample stack 1 (swift_unknownObjectRetain):
  swift_unknownObjectRetain
  objc static SwiftIntrospector.getPropertyValue(object:name:)
  -[FBObjectiveCObject allRetainedObjects]
  -[FBNodeEnumerator nextObject]
  -[FBRetainCycleDetector _findRetainCyclesInObject:stackDepth:]

Sample stack 2 (object_getIvar):
  _class_lookUpIvar
  object_getIvar
  -[FBObjectiveCObject allRetainedObjects]
  -[FBNodeEnumerator nextObject]
  -[FBRetainCycleDetector _findRetainCyclesInObject:stackDepth:]

This is a preventive fix to ensure the residual crashes do not leak into production.

Reviewed By: thegreatwallfb

Differential Revision: D104141469

fbshipit-source-id: 66fd98e5e360a7fca10fe8e9f89fba7834f9b510

Author: Gasan Akniev

FBRetainCycleDetector/Graph/FBObjectiveCObject.m

@@ -19,9 +19,22 @@ @implementation FBObjectiveCObject
 
 - (NSSet *)allRetainedObjects
 {
-  void *ptr = [self objectPtr];
-  if (!ptr) {
-    return nil;
+  // Pin the object alive for the entire method. For ObjC objects, reading
+  // self.object via the weak property gives us a brief strong reference
+  // that lives for the scope of strongObj. For pure Swift objects, the
+  // FBSwiftStrongRef wrapper held by the candidates array keeps the
+  // object alive across this method's invocation. Without pinning,
+  // another thread can release the object mid-traversal, causing
+  // crashes in object_getIvar / class_lookUpIvar.
+  __strong id strongObj = self.object;
+  void *ptr;
+  if (strongObj) {
+    ptr = (__bridge void *)strongObj;
+  } else {
+    ptr = [self objectPtr];
+    if (!ptr) {
+      return nil;
+    }
   }
   __unsafe_unretained id obj = (__bridge id)ptr;
 

FBRetainCycleDetector/Layout/Classes/SwiftIntrospector.swift

@@ -7,6 +7,7 @@
  * LICENSE file in the root directory of this source tree.
  */
 
+import Darwin
 import Foundation
 
 @objc public class SwiftIntrospector: NSObject {
@@ -43,9 +44,14 @@ import Foundation
      }
 
     private class func asRetainableObject(_ value: Any) -> AnyObject? {
-        // Class instances are always safe to bridge to id.
+        // Class instances are safe to bridge to id, but we must verify the
+        // pointer is still live. Mirror can return stale pointers for
+        // unowned references whose target was deallocated. Bridging a
+        // dangling pointer back to ObjC id triggers swift_unknownObjectRetain
+        // crashes during the @objc return-value retain.
         if Swift.type(of: value) is AnyClass {
-            return value as AnyObject
+            let obj = value as AnyObject
+            return isLikelyLiveObject(obj) ? obj : nil
         }
         // Optional wrapping a class instance — unwrap and check.
         let valueMirror = Mirror(reflecting: value)
@@ -57,15 +63,30 @@ import Foundation
         }
         // Foundation-bridgeable value types (String→NSString, Array→NSArray, etc.)
         // are safe. Non-bridgeable Swift structs/enums will crash on `as AnyObject`.
-        // Check _ObjectiveCBridgeable conformance via the bridged result's identity:
-        // if bridging produces an object whose type is a class, it's safe.
-        // We use a two-step check to avoid crashing on non-bridgeable types.
         if value is NSObject {
-            return value as AnyObject
+            let obj = value as AnyObject
+            return isLikelyLiveObject(obj) ? obj : nil
         }
         return nil
     }
 
+    /// Verify the object's pointer is still in a live heap allocation.
+    /// Tagged pointers (small NSNumber, short NSString) are not heap-allocated
+    /// and pass through unchanged.
+    private class func isLikelyLiveObject(_ obj: AnyObject) -> Bool {
+        let raw = Unmanaged.passUnretained(obj).toOpaque()
+        let intPtr = Int(bitPattern: raw)
+        // Tagged pointers: high bit set on arm64, low bit on x86_64.
+        // These are not heap allocations — accept them.
+        #if arch(arm64) || arch(arm64_32)
+        if intPtr < 0 { return true }
+        #else
+        if (intPtr & 1) != 0 { return true }
+        #endif
+        // Heap-allocated pointers must have a non-zero malloc size.
+        return malloc_size(raw) > 0
+    }
+
     private class func getChild(mirror: Mirror, name: String) -> (Any?, Bool) {
         guard let array = AnyBidirectionalCollection(mirror.children) else {
             return (nil, false)