Auth integration tests crash with SIGSEGV in default fetch closure (swift_task_dealloc)

[grdsdev]

Summary

Running the AuthClientIntegrationTests suite via swift test --filter IntegrationTests --no-parallel (with INTEGRATION_TESTS=1 and a local supabase start stack) crashes deterministically with SIGSEGV on the very first test (multipleAuthInstances()), before any assertions run. 100% reproducible across multiple runs.

This is not specific to swift test's sandboxing (reproduces identically with the sandbox disabled) and is not a general toolchain/URLSession issue — PostgrestBasicTests (also real network calls against the same local stack, same toolchain) pass cleanly. It also predates #1176/#1178 — reproduces identically on c396684 (the commit right before #1176 merged).

Environment

• Xcode 26.6 (Build 17F113)
• macOS 26.6 (25G72), Apple Silicon
• Local Supabase stack via supabase CLI 2.111.0

Reproduction

cd Tests/IntegrationTests
supabase start
supabase db reset
cd ../..
INTEGRATION_TESTS=1 swift test --filter IntegrationTests --no-parallel

Crash

error: Process '.../swiftpm-testing-helper ... --testing-library swift-testing' exited with unexpected signal code 11

Symbolicated crash report (~/Library/Logs/DiagnosticReports/swiftpm-testing-helper-*.ips):

Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000014

Faulting thread backtrace:
swift_task_dealloc
closure #1 in default argument 7 of AuthClient.Configuration.init(...) — AuthClientConfiguration.swift:133
  (the default `fetch: @escaping FetchHandler = { try await URLSession.shared.data(for: $0) }`)
closure #1 in HTTPClient.send(_:) — HTTPClient.swift:33
partial apply for closure #1 in HTTPClient.send(_:)
RetryRequestInterceptor.retry(_:retryCount:next:) — RetryRequestInterceptor.swift:138
RetryRequestInterceptor.intercept(_:next:) — RetryRequestInterceptor.swift:113
protocol witness for HTTPClientInterceptor.intercept(_:next:) in conformance RetryRequestInterceptor
closure #2 in HTTPClient.send(_:) — HTTPClient.swift:43
partial apply for closure #2 in HTTPClient.send(_:)
HTTPClient.send(_:) — HTTPClient.swift:47
protocol witness for HTTPClientType.send(_:) in conformance HTTPClient
APIClient.execute(_:) — APIClient.swift:58
AuthClient._signIn(request:) — AuthClient.swift:569
AuthClient.signIn(email:password:captchaToken:) — AuthClient.swift:460
AuthClientIntegrationTests.signUpIfNeededOrSignIn(email:password:) — AuthClientIntegrationTests.swift:482
AuthClientIntegrationTests.multipleAuthInstances() — AuthClientIntegrationTests.swift:45

The fault address (0x14) is consistent with a use-after-free rather than a normal error path — the crash happens inside swift_task_dealloc while tearing down the async task backing the default URLSession.shared.data(for:) fetch closure, reached through the retry interceptor chain during the very first real signIn network call.

Notes

• Reproduces identically with Bash's sandbox disabled, ruling out a sandbox/network-permission artifact (curl to the local stack works fine from the same shell).
• PostgrestBasicTests integration tests pass fully in the same environment/run, so this looks specific to Auth's HTTP client/retry-interceptor assembly (or its interaction with AuthClient), not a blanket toolchain issue.
• Confirmed present on c396684 (pre-fix(auth): remove AuthClient from Dependencies registry on deinit #1176), so not a regression from the Dependencies registry deinit fix or from test(auth): keep adminClient alive across awaited signOut in integration test #1178.
• Not yet tried on other Xcode/macOS versions — worth checking whether this is specific to the 26.6 toolchain.

Impact

Blocks running the full IntegrationTests target locally/in CI on affected toolchains — every test in AuthClientIntegrationTests after the first is never reached.