macOS OpenFilePickerAsync crashes after selecting a file in 12.0.0

[McoreD]

Describe the bug

A downstream Avalonia app (XerahS) crashed on macOS after the user opened a file via IStorageProvider.OpenFilePickerAsync. This appears to be the same native lifetime bug fixed by #21104 / #21102, but this crash happened after selecting a file rather than canceling the picker.

I inspected the local Avalonia source and the crash lines up with the 12.0.0 implementation in native/Avalonia.Native/src/OSX/StorageProvider.mm: the async NSOpenPanel completion block captured and later dereferenced the raw IAvnSystemDialogEvents* events pointer. In current master and 12.0.2, the same code wraps that pointer in ComPtr<IAvnSystemDialogEvents> ownedEvents(events) before starting the native picker, and the block calls ownedEvents->OnCompleted(...) instead. That matches the suspected use-after-free / callback lifetime failure.

If #21104 is intended to cover selection as well as cancel, this can be closed as fixed in 12.0.2. I am filing this to provide an additional real-world crash report with the selection path and stack.

To Reproduce

Observed downstream flow:

1. App uses Avalonia 12.0.0 on macOS.
2. User invokes a menu command that calls OpenFilePickerAsync with roughly:

var files = await topLevel.StorageProvider.OpenFilePickerAsync(new FilePickerOpenOptions
{
    Title = "Select File to Upload",
    AllowMultiple = false,
    SuggestedStartLocation = await topLevel.StorageProvider.TryGetWellKnownFolderAsync(WellKnownFolder.Desktop)
});

3. User selects a file in the native macOS file picker.
4. App terminates with EXC_BAD_ACCESS in libAvaloniaNative.dylib.

Expected behavior

Selecting a file should complete the task and return the selected IStorageFile without terminating the process.

Actual behavior

The app crashed in the native picker completion callback before downstream upload code could run.

Top stack frames from the macOS crash report:

Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS
Triggered by Thread: 0, Dispatch Queue: com.apple.main-thread

0 libAvaloniaNative.dylib invocation function for block in StorageProvider::OpenFileDialog(IAvnTopLevel*, IAvnSystemDialogEvents*, bool, char const*, char const*, char const*, IAvnFilePickerFileTypes*) + 91
1 AppKit -[NSSavePanel didEndPanelWithReturnCode:] + 132
2 AppKit -[NSSavePanel didEndSheet:returnCode:contextInfo:] + 62
3 AppKit NSWindowEndWindowModalSession + 642
4 AppKit -[NSSavePanel completeSheet:] + 118
5 AppKit -[NSSavePanel completeWithReturnCode:url:urls:] + 593

The faulting instruction corresponds to the old events->OnCompleted(uriStrings) callback path in StorageProvider::OpenFileDialog.

Avalonia version

12.0.0

OS

macOS 26.5 (25F5068a), Intel x64 process

Additional context

Downstream crash app details:

• App: XerahS 0.22.170
• Runtime package in app bundle: libAvaloniaNative.dylib from Avalonia 12.0.0
• Hardware: Intel iMac20,1

Local source comparison:

• 12.0.0: StorageProvider::OpenFileDialog captures raw IAvnSystemDialogEvents* events in the async block.
• 12.0.2 / master: Fix macOS file pickers native crash #21104 changes the folder, open-file, and save-file picker paths to keep events alive with ComPtr<IAvnSystemDialogEvents> ownedEvents(events).

[timunie]

Let me know if the bug is also reproducible with current stable release.