fix: Potential MPURLRequestBuilder crash

[jamesnrokt]

Background

Crash observed in -[MPURLRequestBuilder build] on com.mparticle.messageQueue, could potentially be related to unsafe concurrent access to apiKey/secret on MPStateMachine.

Crashed: com.mparticle.messageQueue
0  libsystem_malloc.dylib         0x30a0 _xzm_xzone_malloc_freelist_outlined + 864
1  CoreFoundation                 0x8084 __CFStringAppendFormatCore + 6952
2  CoreFoundation                 0x122e4 _CFStringCreateWithFormatAndArgumentsReturningMetadata + 184
3  CoreFoundation                 0x12398 _CFStringCreateWithFormatAndArgumentsAux2 + 44
4  Foundation                     0x9b2bb0 +[NSString stringWithFormat:] + 68
5  mParticle_Apple_SDK            0x6340 -[MPURLRequestBuilder build] + 3800
6  mParticle_Apple_SDK            0x45130 -[MPConnector responseFromGetRequestToURL:] + 120
7  mParticle_Apple_SDK            0x575d8 -[MPNetworkCommunication_PRIVATE requestConfig:withCompletionHandler:] + 952
8  mParticle_Apple_SDK            0x6d34c -[MPBackendController_PRIVATE requestConfig:] + 128
9  mParticle_Apple_SDK            0x7450c -[MPBackendController_PRIVATE checkForKitsAndUploadWithCompletionHandler:] + 96
10 mParticle_Apple_SDK            0x743a0 -[MPBackendController_PRIVATE waitForKitsAndUploadWithCompletionHandler:] + 96
11 mParticle_Apple_SDK            0x77a80 __59-[MPBackendController_PRIVATE beginBackgroundTimeCheckLoop]_block_invoke.194 + 72
12 libdispatch.dylib              0x1adc _dispatch_call_block_and_release + 32
13 libdispatch.dylib              0x1b7fc _dispatch_client_callout + 16
14 libdispatch.dylib              0xa468 _dispatch_lane_serial_drain + 740
15 libdispatch.dylib              0xaf44 _dispatch_lane_invoke + 388
16 libdispatch.dylib              0x153ec _dispatch_root_queue_drain_deferred_wlh + 292
17 libdispatch.dylib              0x14ce4 _dispatch_workloop_worker_thread + 692
18 libsystem_pthread.dylib        0x13b8 _pthread_wqthread + 292
19 libsystem_pthread.dylib        0x8c0 start_wqthread + 8

What Has Changed

• MPStateMachine.h: apiKey and secret changed from nonatomic to atomic; removed __attribute__((const)) which could interfere with atomicity guarantees.
• MPURLRequestBuilder.m: Capture apiKey and secret into local variables once at the top of build; bail early if either is nil.
• MPURL.h: Made url and defaultURL properties readonly.
• Added a thread-safety stress test for concurrent apiKey/secret access.

Checklist

• I have performed a self-review of my own code.
• I have made corresponding changes to the documentation.
• I have added tests that prove my fix is effective or that my feature works.
• I have tested this locally.

Additional Notes

• N/A

Reference Issue (For employees only. Ignore if you are an outside contributor)

• Closes https://go/j/SDKE-900

[github-actions]

📦 SDK Size Impact Report

Measures how much the SDK adds to an app's size (with-SDK minus without-SDK).

Metric	Target Branch	This PR	Change
App Bundle Impact	1.82 MB	1.82 MB	+N/A
Executable Impact	896 bytes	896 bytes	+N/A
XCFramework Size	9.48 MB	9.48 MB	+N/A

➡️ SDK size impact change is minimal.

Raw measurements

Target branch (main):

{"baseline_app_size_kb":84,"baseline_executable_size_bytes":75464,"with_sdk_app_size_kb":1944,"with_sdk_executable_size_bytes":76360,"sdk_impact_kb":1860,"sdk_executable_impact_bytes":896,"xcframework_size_kb":9704}

This PR:

{"baseline_app_size_kb":84,"baseline_executable_size_bytes":75464,"with_sdk_app_size_kb":1944,"with_sdk_executable_size_bytes":76360,"sdk_impact_kb":1860,"sdk_executable_impact_bytes":896,"xcframework_size_kb":9704}