[crash] CHIP: chipAbort

[aajain-com]

Problem

Found the following crash during stability testing with SDK SHA 5d8599d195a93dfe5473f64e4f888c322e5df1d2.

3   CHIP                          	       0x1c61f8884 chipAbort + 20 (CHIPFramework/connectedhomeip/src/lib/support/CodeUtils.h:489)
4   CHIP                          	       0x1c61b3408 chip::app::InteractionModelEngine::RemoveReadClient(chip::app::ReadClient*) + 160 (CHIPFramework/connectedhomeip/src/app/InteractionModelEngine.cpp:807)
5   CHIP                          	       0x1c61c52e4 chip::app::ReadClient::~ReadClient() + 124 (CHIPFramework/connectedhomeip/src/app/ReadClient.cpp:125)
6   CHIP                          	       0x1c61c538c chip::app::ReadClient::~ReadClient() + 32 (CHIPFramework/connectedhomeip/src/app/ReadClient.cpp:112)
7   CHIP                          	       0x1c61c53bc chip::app::ReadClient::~ReadClient() + 32 (CHIPFramework/connectedhomeip/src/app/ReadClient.cpp:112)
8   CHIP                          	       0x1c5c2e518 -[CHIPDevice subscribeWithQueue:minInterval:maxInterval:params:cacheContainer:attributeReportHandler:eventReportHandler:errorHandler:subscriptionEstablished:] + 1652 

[bzbarsky-apple]

This is the

        VerifyOrDie(pCurListItem != nullptr);

in InteractionModelEngine::RemoveReadClient.

I wonder whether this ReadClient outlived shutdown, similar to #20085

That said, InteractionModelEngine::Shutdown nulls out the backpointers, so I would not expect this that to be an issue here....

[turon]

What are the replication steps?

[woody-apple]

@turon This is coming from aggregated crashes, sadly no steps.

[woody-apple]

This is no longer showing up in crashes.