fix(sdk-crashes): Ignore SentrySwizzleWrapper false positives (#105625) #105705

calm329 · 2026-01-06T00:42:15Z

Summary

The SDK crash detection was incorrectly reporting crashes as SDK crashes when SentrySwizzleWrapper was the only SDK frame in the stacktrace. These are false positives because SentrySwizzleWrapper is an instrumentation frame that intercepts UI events but doesn't cause crashes itself.

This PR adds a new conditional SDK frame detection mechanism that only ignores SentrySwizzleWrapper when there are no other SDK frames above it (closer to the crash origin).

Changes

Added sdk_crash_ignore_when_only_sdk_frame_matchers field to SDKCrashDetectionConfig
Modified is_sdk_crash() in SDKCrashDetector to handle conditional SDK frames
Added SentrySwizzleWrapper pattern to Cocoa SDK configuration
Added CocoaSDKSwizzleWrapperTestMixin with 3 test cases:
- SwizzleWrapper as only SDK frame → NOT reported
- SwizzleWrapper with SDK frames above → IS reported
- SwizzleWrapper with SDK frames below → NOT reported

How it works

When iterating through frames (youngest to oldest):

If a non-conditional SDK frame is found → return True (SDK crash)
If a conditional SDK frame (like SwizzleWrapper) is found → return False (not SDK crash, since any SDK frames above would have triggered step 1)
If a non-system frame is found → return False

Legal Boilerplate

Look, I get it. The entity doing business as "Sentry" was incorporated in the State of Delaware in 2015 as Functional Software, Inc. and is gonna need some rights from me in order to utilize my contributions in this here PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Sentry can use, modify, copy, and redistribute my contributions, under Sentry's choice of terms.

Contribution by Gittensor, see my contribution statistics at https://gittensor.io/miners/details?githubId=148254234

…try#105625)

calm329 · 2026-01-07T12:50:51Z

@philipphofmann I’ve opened this PR and would appreciate a review when you have a chance. Thanks!

philipphofmann

Thanks a lot for tackling this @calm329. I added a few comments.

tests/sentry/utils/sdk_crashes/test_sdk_crash_detection_cocoa.py

src/sentry/utils/sdk_crashes/sdk_crash_detection_config.py

src/sentry/utils/sdk_crashes/sdk_crash_detector.py

philipphofmann · 2026-01-09T10:23:08Z

tests/sentry/utils/sdk_crashes/test_sdk_crash_detection_cocoa.py

+                # This SDK frame is BELOW SentrySwizzleWrapper (further from crash origin)
+                "function": "-[SentryHub captureEvent:]",
+                "package": "/private/var/containers/Bundle/Application/59E988EF-46DB-4C75-8E08-10C27DC3E90E/iOS-Swift.app/Frameworks/Sentry.framework/Sentry",
+                "in_app": False,
+            },
+            {
+                "function": "-[UIApplication sendEvent:]",
+                "package": "/System/Library/PrivateFrameworks/UIKitCore.framework/UIKitCore",
+                "in_app": False,
+            },
+            {
+                "function": "__49-[SentrySwizzleWrapper swizzleSendAction:forKey:]_block_invoke_2",
+                "package": "/private/var/containers/Bundle/Application/59E988EF-46DB-4C75-8E08-10C27DC3E90E/iOS-Swift.app/Frameworks/Sentry.framework/Sentry",
+                "in_app": False,
+            },
+            {
+                "function": "-[NSString substringWithRange:]",
+                "package": "/System/Library/Frameworks/Foundation.framework/Foundation",
+                "in_app": False,
+            },
+            {
+                "function": "__exceptionPreprocess",
+                "package": "/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation",
+                "in_app": False,
+            },
+        ]
+
+        self.execute_test(
+            get_crash_event_with_frames(frames),
+            False,  # Should NOT be reported - SDK frame below doesn't count
+            mock_sdk_crash_reporter,
+        )


Sorry, I could have been more specific in #105625. We should rather overreport than underreport SDK crashes. I think we should still report that crash as an SDK crash. I think the logic should be it's OK to ignore the SDK crash if the specific function is the only SDK frame in the whole stacktrace.

…ndling

calm329 · 2026-01-09T14:07:23Z

@philipphofmann I've fixed according to your feedback, could you review it again?

src/sentry/utils/sdk_crashes/sdk_crash_detector.py

…ndling

philipphofmann

Thanks for including the feedback. We're not far away from an approval, @calm329 💯

philipphofmann · 2026-01-12T13:48:59Z

src/sentry/utils/sdk_crashes/sdk_crash_detection_config.py

-    If there are other SDK frames above these frames, the crash is still reported as an SDK crash.
-    For example, SentrySwizzleWrapper is used for method swizzling and shouldn't be reported as an SDK crash
-    when it's the only SDK frame, since the actual crash originates from system libraries."""
+    These frames are typically SDK instrumentation frames that intercept calls, such as swizzling or monkey patching,


That's better thanks

philipphofmann · 2026-01-12T14:51:09Z

src/sentry/utils/sdk_crashes/sdk_crash_detector.py

+    def _matches_ignore_when_only_sdk_frame(self, frame: Mapping[str, Any]) -> bool:
+        """
+        Returns true if the frame matches the sdk_crash_ignore_when_only_sdk_frame_matchers pattern.
+        """
+        function = frame.get("function")
+        if not function:
+            return False
+
+        module = frame.get("module")
+        for matcher in self.config.sdk_crash_ignore_when_only_sdk_frame_matchers:
+            function_matches = glob_match(function, matcher.function_pattern, ignorecase=True)
+            module_matches = glob_match(module, matcher.module_pattern, ignorecase=True)
+
+            if function_matches and module_matches:
+                return True
+
+        return False
+
+    def _matches_sdk_crash_ignore(self, frame: Mapping[str, Any]) -> bool:
+        function = frame.get("function")
+        if not function:
+            return False
+
+        module = frame.get("module")
+        for matcher in self.config.sdk_crash_ignore_matchers:
+            function_matches = glob_match(function, matcher.function_pattern, ignorecase=True)
+            module_matches = glob_match(module, matcher.module_pattern, ignorecase=True)
+
+            if function_matches and module_matches:
+                return True
+
+        return False


m: These two methods are almost the same. It would be great to get rid of the code duplication, please.

philipphofmann · 2026-01-12T14:53:23Z

tests/sentry/utils/sdk_crashes/test_sdk_crash_detection_cocoa.py

        )


+@patch("sentry.utils.sdk_crashes.sdk_crash_detection.sdk_crash_detection.sdk_crash_reporter")


Thanks for the tests.

philipphofmann · 2026-01-12T14:57:59Z

src/sentry/utils/sdk_crashes/sdk_crash_detector.py

+        has_non_conditional_sdk_frame = False
+        for frame in iter_frames:
+            if (
+                self.is_sdk_frame(frame)
+                and not self._matches_ignore_when_only_sdk_frame(frame)
+                and not self._matches_sdk_crash_ignore(frame)
+            ):
+                has_non_conditional_sdk_frame = True
+                break


m: I find this a bit confusing now. We have a method called _matches_sdk_crash_ignore, but we don't use it below. We still have code that calls for matcher in self.config.sdk_crash_ignore_matchers below. This code for matcher in self.config.sdk_crash_ignore_matchers below should also use the _matches_sdk_crash_ignore method please.

philipphofmann · 2026-01-12T15:02:52Z

src/sentry/utils/sdk_crashes/sdk_crash_detector.py

        # are SDK frames or from system libraries.
        iter_frames = [f for f in reversed(frames) if f is not None]
+
+        has_non_conditional_sdk_frame = False


m: I think this code could more clearly communicate what it does. We can iterate over all frames 3 times, so it's still O(n), where n is the number of frames.
First, I would iterate over all frames to check if we should ignore the crash altogether, because a frame matches the _matches_sdk_crash_ignore. If it does, we ignore the SDK crash.

Second, I would iterate over all frames to check if a grame matches the _matches_ignore_when_only_sdk_frame. This loop keeps track if it's the only SDK frame that matches this condidition. If it does then we exit and say, no SDK crash.

The third loop performs the remaining checks to determine whether it's an SDK crash. Then we have the logic seperated into three different for loops and they don't overlap with each other in one for loop, which makes it now harder to understand.

…ndling

src/sentry/utils/sdk_crashes/sdk_crash_detector.py

+        has_non_conditional_sdk_frame = False
+        for frame in iter_frames:
+            if self.is_sdk_frame(frame) and not self._matches_ignore_when_only_sdk_frame(frame):
+                has_non_conditional_sdk_frame = True
+                break


…check

src/sentry/utils/sdk_crashes/sdk_crash_detector.py

+            if self._matches_sdk_crash_ignore(frame):
+                return False


fix(sdk-crashes): Ignore SentrySwizzleWrapper false positives (getsen…

56e1d05

…try#105625)

github-actions bot added the Scope: Backend Automatically applied to PRs that change backend components label Jan 6, 2026

philipphofmann reviewed Jan 9, 2026

View reviewed changes

fix(sdk-crashes): Address review feedback for SentrySwizzleWrapper ha…

e8f03b7

…ndling

cursor bot reviewed Jan 9, 2026

View reviewed changes

src/sentry/utils/sdk_crashes/sdk_crash_detector.py Show resolved Hide resolved

fix(sdk-crashes): Address review feedback for SentrySwizzleWrapper ha…

a203ae8

…ndling

philipphofmann reviewed Jan 12, 2026

View reviewed changes

fix(sdk-crashes): Address review feedback for SentrySwizzleWrapper ha…

f1ac028

…ndling

cursor bot reviewed Jan 12, 2026

View reviewed changes

src/sentry/utils/sdk_crashes/sdk_crash_detector.py Outdated Show resolved Hide resolved

fix(sdk-crashes): Refactor pattern matching to reduce code duplication

4050e6b

sentry bot reviewed Jan 12, 2026

View reviewed changes

fix(sdk-crashes): Exclude always-ignored frames from non-conditional …

0c13941

…check

sentry bot reviewed Jan 12, 2026

View reviewed changes

src/sentry/utils/sdk_crashes/sdk_crash_detector.py Outdated

Comment on lines 107 to 108

if self._matches_sdk_crash_ignore(frame):

return False

This comment was marked as outdated.

Sign in to view

fix(sdk-crashes): Skip always-ignored frames instead of early return

4178ff3

		)


		@patch("sentry.utils.sdk_crashes.sdk_crash_detection.sdk_crash_detection.sdk_crash_reporter")

Uh oh!

fix(sdk-crashes): Ignore SentrySwizzleWrapper false positives (#105625) #105705

Are you sure you want to change the base?

fix(sdk-crashes): Ignore SentrySwizzleWrapper false positives (#105625) #105705

Conversation

calm329 commented Jan 6, 2026

Summary

Changes

How it works

Legal Boilerplate

Uh oh!

calm329 commented Jan 7, 2026

Uh oh!

philipphofmann left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

philipphofmann Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

calm329 commented Jan 9, 2026

Uh oh!

Uh oh!

philipphofmann left a comment

Choose a reason for hiding this comment

Uh oh!

philipphofmann Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

philipphofmann Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

philipphofmann Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

philipphofmann Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

philipphofmann Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants