iOS - EXC_BAD_ACCESS - Attempted to dereference garbage pointer

[ludovicthomas]

Description

We upgraded recently Skia from 2.2.3 to 2.2.21 to reuse the useColorBuffer fix and had a lot of Skia memory crashes after this update.

We then updates to 2.4.6 last Monday as a lot of memory crash issues where fixed since 2.2.21.
For Android, all issues are gone, and our crash rate is back to normal.

On iOS, sadly it's not the case and the crash rate remain high.

We are using Skia in two places:

• drawing an audio waveform using Atlas with useRectBuffer / useRSXformBuffer / useColorBuffer and reanimated (canvas, group, atlas)
• drawing an animated logo on app bootstrap (canvas, group, circle, text)

React Native Skia Version

2.4.6

React Native Version

0.79.6

Using New Architecture

• Enabled

Steps to Reproduce

Hard to reproduce, it's random.
Not related to a single device, or iOS versions.

We can provide the component code if needed.

Snack, Code Example, Screenshot, or Link to Repository

Stacktrace 1

CrashReporter Key:  7d312decfada0f03efd8f29a781c650f322242fb
Hardware Model:     iPhone12,1
Process:            LANDR
Identifier:         com.landr.mobile.app
Version:            2.8.3
Role:               Foreground
OS Version:         iOS 26.0
Exception Type:     EXC_BAD_ACCESS 
Exception Subtype:  KERN_INVALID_ADDRESS


EXC_BAD_ACCESS: Attempted to dereference garbage pointer 0x86000874656371.

0  hermes +0x24dc0                 hermes::vm::DictPropertyMap::lookupEntryFor(hermes::vm::DictPropertyMap*, hermes::vm::SymbolID)
1  hermes +0x2ad38                 hermes::vm::HiddenClass::findProperty(hermes::vm::PseudoHandle<hermes::vm::HiddenClass>, hermes::vm::Runtime&, hermes::vm::SymbolID, hermes::vm::PropertyFlags, hermes::vm::NamedPropertyDescriptor&)
2  hermes +0x42450                 hermes::vm::JSObject::getNamedDescriptorUnsafe(hermes::vm::Handle<hermes::vm::JSObject>, hermes::vm::Runtime&, hermes::vm::SymbolID, hermes::vm::PropertyFlags, hermes::vm::NamedPropertyDescriptor&)
3  hermes +0x42b90                 hermes::vm::JSObject::getNamedWithReceiver_RJS(hermes::vm::Handle<hermes::vm::JSObject>, hermes::vm::Runtime&, hermes::vm::SymbolID, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::PropOpFlags, hermes::vm::PropertyCacheEntry*)
4  hermes +0xc0f0                  facebook::hermes::HermesRuntimeImpl::throwPendingError()::$_3::operator()(hermes::vm::SymbolID, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >&) const
5  hermes +0xbf58                  facebook::hermes::HermesRuntimeImpl::throwPendingError()
6  hermes +0xa0c0                  facebook::hermes::HermesRuntimeImpl::getProperty(facebook::jsi::Object const&, facebook::jsi::String const&)
7  LANDR +0xe60c68                 facebook::jsi::Object::getProperty(facebook::jsi::Runtime&, facebook::jsi::String const&) const (jsi-inl.h:96:18)
8  LANDR +0xe60c68                 facebook::jsi::Object::getProperty(facebook::jsi::Runtime&, char const*) const (jsi-inl.h:92:10)
9  LANDR +0xe60c68                 void RNSkia::convertPropertyImpl<std::__1::vector<SkRect, std::__1::allocator<SkRect>>, std::__1::vector<SkRect, std::__1::allocator<SkRect>>>(facebook::jsi::Runtime&, facebook::jsi::Object const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::vector<SkRect, std::__1::allocator<SkRect>>&, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>>>>&)::'lambda'(facebook::jsi::Runtime&, facebook::jsi::Object const&)::operator()(facebook::jsi::Runtime&, facebook::jsi::Object const&) const (Convertor.h:89:24)
10 LANDR +0xe60abc                 void RNSkia::convertPropertyImpl<std::__1::vector<SkRect, std::__1::allocator<SkRect>>, std::__1::vector<SkRect, std::__1::allocator<SkRect>>>(facebook::jsi::Runtime&, facebook::jsi::Object const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::vector<SkRect, std::__1::allocator<SkRect>>&, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>>>>&) (Convertor.h:93:5)
11 LANDR +0xe5ff10                 void RNSkia::convertProperty<std::__1::vector<SkRect, std::__1::allocator<SkRect>>>(facebook::jsi::Runtime&, facebook::jsi::Object const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::vector<SkRect, std::__1::allocator<SkRect>>&, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>>>>&) (Convertor.h:104:3)
12 LANDR +0xe5ff10                 RNSkia::AtlasCmd::AtlasCmd(std::__1::shared_ptr<RNSkia::RNSkPlatformContext>, facebook::jsi::Runtime&, facebook::jsi::Object const&, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>>>>&) (Drawings.h:935:5)
13 LANDR +0xe5fd4c                 RNSkia::AtlasCmd::AtlasCmd(std::__1::shared_ptr<RNSkia::RNSkPlatformContext>, facebook::jsi::Runtime&, facebook::jsi::Object const&, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>>>>&) (Drawings.h:933:60)
14 LANDR +0xe5fd4c                 std::__1::__unique_if<RNSkia::AtlasCmd>::__unique_single std::__1::make_unique[abi:ne190102]<RNSkia::AtlasCmd, std::__1::shared_ptr<RNSkia::RNSkPlatformContext>&, facebook::jsi::Runtime&, facebook::jsi::Object const&, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>>>>&>(std::__1::shared_ptr<RNSkia::RNSkPlatformContext>&, facebook::jsi::Runtime&, facebook::jsi::Object const&, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::vector<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>, std::__1::allocator<std::__1::function<void (facebook::jsi::Runtime&, facebook::jsi::Object const&)>>>>>>&) (unique_ptr.h:635:30)
15 LANDR +0xe5fd4c                 RNSkia::Recorder::drawAtlas(facebook::jsi::Runtime&, facebook::jsi::Object const&) (RNRecorder.h:360:9)
16 LANDR +0xe3e2c0                 RNSkia::JsiRecorder::drawAtlas(facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long) (JsiRecorder.h:289:18)
17 LANDR +0x86e604                 std::__1::__function::__value_func<facebook::jsi::Value (facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)>::operator()[abi:ne190102](facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*&&, unsigned long&&) const (function.h:430:12)
18 LANDR +0x86e604                 std::__1::function<facebook::jsi::Value (facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)>::operator()(facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long) const (function.h:989:10)
19 hermes +0x13788                 std::__1::function<facebook::jsi::Value (facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)>::operator()(facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long) const
20 hermes +0x13450                 facebook::hermes::HermesRuntimeImpl::HFContext::func(void*, hermes::vm::Runtime&, hermes::vm::NativeArgs)
21 hermes +0x230f0                 hermes::vm::NativeFunction::_nativeCall(hermes::vm::NativeFunction*, hermes::vm::Runtime&)
22 hermes +0x2f6f8                 hermes::vm::Interpreter::handleCallSlowPath(hermes::vm::Runtime&, hermes::vm::PinnedHermesValue*)
23 hermes +0x31104                 hermes::vm::CallResult<hermes::vm::HermesValue, (hermes::vm::detail::CallResultSpecialize)2> hermes::vm::Interpreter::interpretFunction<false, false>(hermes::vm::Runtime&, hermes::vm::InterpreterState&)
24 hermes +0x306f0                 hermes::vm::Runtime::interpretFunctionImpl(hermes::vm::CodeBlock*)
25 hermes +0x231d8                 hermes::vm::JSFunction::_callImpl(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime&)
26 hermes +0x21c40                 hermes::vm::Callable::executeCall3(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime&, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::HermesValue, hermes::vm::HermesValue, hermes::vm::HermesValue, bool)
27 hermes +0x7a4a4                 hermes::vm::arrayPrototypeForEach(void*, hermes::vm::Runtime&, hermes::vm::NativeArgs)
28 hermes +0x230f0                 hermes::vm::NativeFunction::_nativeCall(hermes::vm::NativeFunction*, hermes::vm::Runtime&)
29 hermes +0x2f6f8                 hermes::vm::Interpreter::handleCallSlowPath(hermes::vm::Runtime&, hermes::vm::PinnedHermesValue*)
30 hermes +0x31104                 hermes::vm::CallResult<hermes::vm::HermesValue, (hermes::vm::detail::CallResultSpecialize)2> hermes::vm::Interpreter::interpretFunction<false, false>(hermes::vm::Runtime&, hermes::vm::InterpreterState&)
31 hermes +0x306f0                 hermes::vm::Runtime::interpretFunctionImpl(hermes::vm::CodeBlock*)
32 hermes +0x231d8                 hermes::vm::JSFunction::_callImpl(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime&)
33 hermes +0x21c40                 hermes::vm::Callable::executeCall3(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime&, hermes::vm::Handle<hermes::vm::HermesValue>, hermes::vm::HermesValue, hermes::vm::HermesValue, hermes::vm::HermesValue, bool)
34 hermes +0x7a4a4                 hermes::vm::arrayPrototypeForEach(void*, hermes::vm::Runtime&, hermes::vm::NativeArgs)
35 hermes +0x230f0                 hermes::vm::NativeFunction::_nativeCall(hermes::vm::NativeFunction*, hermes::vm::Runtime&)
36 hermes +0x2f6f8                 hermes::vm::Interpreter::handleCallSlowPath(hermes::vm::Runtime&, hermes::vm::PinnedHermesValue*)
37 hermes +0x31104                 hermes::vm::CallResult<hermes::vm::HermesValue, (hermes::vm::detail::CallResultSpecialize)2> hermes::vm::Interpreter::interpretFunction<false, false>(hermes::vm::Runtime&, hermes::vm::InterpreterState&)
38 hermes +0x306f0                 hermes::vm::Runtime::interpretFunctionImpl(hermes::vm::CodeBlock*)
39 hermes +0x231d8                 hermes::vm::JSFunction::_callImpl(hermes::vm::Handle<hermes::vm::Callable>, hermes::vm::Runtime&)
40 hermes +0x22de4                 hermes::vm::BoundFunction::_boundCall(hermes::vm::BoundFunction*, hermes::inst::Inst const*, hermes::vm::Runtime&)
41 hermes +0xb878                  facebook::hermes::HermesRuntimeImpl::call(facebook::jsi::Function const&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)
42 LANDR +0xc59fcc                 facebook::jsi::Function::call(facebook::jsi::Runtime&, facebook::jsi::Value const*, unsigned long) const (jsi-inl.h:268:18)
43 LANDR +0xc59fcc                 facebook::jsi::Function::call(facebook::jsi::Runtime&, std::initializer_list<facebook::jsi::Value>) const (jsi-inl.h:273:10)
44 LANDR +0xc59fcc                 facebook::react::Task::execute(facebook::jsi::Runtime&, bool) (Task.cpp:45:19)
45 LANDR +0xc539d0                 facebook::react::RuntimeScheduler_Legacy::executeTask(facebook::jsi::Runtime&, std::__1::shared_ptr<facebook::react::Task> const&, bool) (RuntimeScheduler_Legacy.cpp:265:25)
46 LANDR +0xc53ce8                 facebook::react::RuntimeScheduler_Legacy::startWorkLoop(facebook::jsi::Runtime&) (RuntimeScheduler_Legacy.cpp:235:7)
47 LANDR +0xba02c0                 std::__1::__function::__value_func<void (facebook::jsi::Runtime&)>::operator()[abi:ne190102](facebook::jsi::Runtime&) const (function.h:430:12)
48 LANDR +0xba02c0                 std::__1::function<void (facebook::jsi::Runtime&)>::operator()(facebook::jsi::Runtime&) const (function.h:989:10)
49 LANDR +0xba02c0                 RCTRuntimeExecutorFromBridge(RCTBridge*)::$_0::operator()(std::__1::function<void (facebook::jsi::Runtime&)>&&) const::'lambda'()::operator()() const (RCTSurfacePresenterBridgeAdapter.mm:75:7)
50 LANDR +0xba02c0                 decltype(std::declval<RCTRuntimeExecutorFromBridge(RCTBridge*)::$_0::operator()(std::__1::function<void (facebook::jsi::Runtime&)>&&) const::'lambda'()&>()()) std::__1::__invoke[abi:ne190102]<RCTRuntimeExecutorFromBridge(RCTBridge*)::$_0::operator()(std::__1::function<void (facebook::jsi::Runtime&)>&&) const::'lambda'()&>(RCTRuntimeExecutorFromBridge(RCTBridge*)::$_0::operator()(std::__1::function<void (facebook::jsi::Runtime&)>&&) const::'lambda'()&) (invoke.h:149:25)
51 LANDR +0xba02c0                 void std::__1::__invoke_void_return_wrapper<void, true>::__call[abi:ne190102]<RCTRuntimeExecutorFromBridge(RCTBridge*)::$_0::operator()(std::__1::function<void (facebook::jsi::Runtime&)>&&) const::'lambda'()&>(RCTRuntimeExecutorFromBridge(RCTBridge*)::$_0::operator()(std::__1::function<void (facebook::jsi::Runtime&)>&&) const::'lambda'()&) (invoke.h:224:5)
52 LANDR +0xba02c0                 std::__1::__function::__alloc_func<RCTRuntimeExecutorFromBridge(RCTBridge*)::$_0::operator()(std::__1::function<void (facebook::jsi::Runtime&)>&&) const::'lambda'(), std::__1::allocator<RCTRuntimeExecutorFromBridge(RCTBridge*)::$_0::operator()(std::__1::function<void (facebook::jsi::Runtime&)>&&) const::'lambda'()>, void ()>::operator()[abi:ne190102]() (function.h:171:12)
53 LANDR +0xba02c0                 std::__1::__function::__func<RCTRuntimeExecutorFromBridge(RCTBridge*)::$_0::operator()(std::__1::function<void (facebook::jsi::Runtime&)>&&) const::'lambda'(), std::__1::allocator<RCTRuntimeExecutorFromBridge(RCTBridge*)::$_0::operator()(std::__1::function<void (facebook::jsi::Runtime&)>&&) const::'lambda'()>, void ()>::operator()() (function.h:313:10)
54 LANDR +0xc01f04                 std::__1::__function::__value_func<void (facebook::jsi::Runtime&)>::operator()[abi:ne190102](facebook::jsi::Runtime&) const (function.h:430:12)
55 LANDR +0xc01f04                 std::__1::function<void (facebook::jsi::Runtime&)>::operator()(facebook::jsi::Runtime&) const (function.h:989:10)
56 LANDR +0xc01f04                 facebook::react::Instance::JSCallInvoker::scheduleAsync(std::__1::function<void (facebook::jsi::Runtime&)>&&)::$_0::operator()(facebook::react::JSExecutor*) const (Instance.cpp:358:11)
57 LANDR +0xc01f04                 decltype(std::declval<facebook::react::Instance::JSCallInvoker::scheduleAsync(std::__1::function<void (facebook::jsi::Runtime&)>&&)::$_0&>()(std::declval<facebook::react::JSExecutor*>())) std::__1::__invoke[abi:ne190102]<facebook::react::Instance::JSCallInvoker::scheduleAsync(std::__1::function<void (facebook::jsi::Runtime&)>&&)::$_0&, facebook::react::JSExecutor*>(facebook::react::Instance::JSCallInvoker::scheduleAsync(std::__1::function<void (facebook::jsi::Runtime&)>&&)::$_0&, facebook::react::JSExecutor*&&) (invoke.h:149:25)
58 LANDR +0xc01f04                 void std::__1::__invoke_void_return_wrapper<void, true>::__call[abi:ne190102]<facebook::react::Instance::JSCallInvoker::scheduleAsync(std::__1::function<void (facebook::jsi::Runtime&)>&&)::$_0&, facebook::react::JSExecutor*>(facebook::react::Instance::JSCallInvoker::scheduleAsync(std::__1::function<void (facebook::jsi::Runtime&)>&&)::$_0&, facebook::react::JSExecutor*&&) (invoke.h:224:5)
59 LANDR +0xc01f04                 std::__1::__function::__alloc_func<facebook::react::Instance::JSCallInvoker::scheduleAsync(std::__1::function<void (facebook::jsi::Runtime&)>&&)::$_0, std::__1::allocator<facebook::react::Instance::JSCallInvoker::scheduleAsync(std::__1::function<void (facebook::jsi::Runtime&)>&&)::$_0>, void (facebook::react::JSExecutor*)>::operator()[abi:ne190102](facebook::react::JSExecutor*&&) (function.h:171:12)
60 LANDR +0xc01f04                 std::__1::__function::__func<facebook::react::Instance::JSCallInvoker::scheduleAsync(std::__1::function<void (facebook::jsi::Runtime&)>&&)::$_0, std::__1::allocator<facebook::react::Instance::JSCallInvoker::scheduleAsync(std::__1::function<void (facebook::jsi::Runtime&)>&&)::$_0>, void (facebook::react::JSExecutor*)>::operator()(facebook::react::JSExecutor*&&) (function.h:313:10)
61 LANDR +0xc0a030                 std::__1::__function::__value_func<void (facebook::react::JSExecutor*)>::operator()[abi:ne190102](facebook::react::JSExecutor*&&) const (function.h:430:12)
62 LANDR +0xc0a030                 std::__1::function<void (facebook::react::JSExecutor*)>::operator()(facebook::react::JSExecutor*) const (function.h:989:10)
63 LANDR +0xc0a030                 facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>&&)::$_0::operator()() const (NativeToJsBridge.cpp:308:9)
64 LANDR +0xc0a030                 decltype(std::declval<facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>&&)::$_0&>()()) std::__1::__invoke[abi:ne190102]<facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>&&)::$_0&>(facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>&&)::$_0&) (invoke.h:149:25)
65 LANDR +0xc0a030                 void std::__1::__invoke_void_return_wrapper<void, true>::__call[abi:ne190102]<facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>&&)::$_0&>(facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>&&)::$_0&) (invoke.h:224:5)
66 LANDR +0xc0a030                 std::__1::__function::__alloc_func<facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>&&)::$_0, std::__1::allocator<facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>&&)::$_0>, void ()>::operator()[abi:ne190102]() (function.h:171:12)
67 LANDR +0xc0a030                 std::__1::__function::__func<facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>&&)::$_0, std::__1::allocator<facebook::react::NativeToJsBridge::runOnExecutorQueue(std::__1::function<void (facebook::react::JSExecutor*)>&&)::$_0>, void ()>::operator()() (function.h:313:10)
68 LANDR +0xa1e4cc                 std::__1::__function::__value_func<void ()>::operator()[abi:ne190102]() const (function.h:430:12)
69 LANDR +0xa1e4cc                 std::__1::function<void ()>::operator()() const (function.h:989:10)
70 LANDR +0xa1e4cc                 facebook::react::tryAndReturnError(std::__1::function<void ()> const&) (RCTCxxUtils.mm:73:7)
71 LANDR +0xa2cc9c                 facebook::react::RCTMessageThread::tryFunc(std::__1::function<void ()> const&) (RCTMessageThread.mm:68:20)
72 LANDR +0xa2caa8                 std::__1::__function::__value_func<void ()>::operator()[abi:ne190102]() const (function.h:430:12)
73 LANDR +0xa2caa8                 std::__1::function<void ()>::operator()() const (function.h:989:10)
74 LANDR +0xa2caa8                 invocation function for block in facebook::react::RCTMessageThread::runAsync(std::__1::function<void ()>) (RCTMessageThread.mm:44:7)
75 CoreFoundation +0x1c4f4         ___CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__
76 CoreFoundation +0x1c1c0         ___CFRunLoopDoBlocks
77 CoreFoundation +0x1d89c         ___CFRunLoopRun
78 CoreFoundation +0x1cc40         __CFRunLoopRunSpecificWithOptions
79 LANDR +0xa147d0                 +[RCTCxxBridge runRunLoop] (RCTCxxBridge.mm:347:12)
80 Foundation +0x61d38             ___NSThread__start__
81 libsystem_pthread.dylib +0x4448 __pthread_start

Stacktrace 2:

CrashReporter Key:  8beeb9642ba4ae8ea595693339106ed7a2cf024c
Hardware Model:     iPhone14,3
Process:            LANDR
Identifier:         com.landr.mobile.app
Version:            2.8.3
Role:               Foreground
OS Version:         iOS 26.1
Exception Type:     EXC_BAD_ACCESS 
Exception Subtype:  KERN_INVALID_ADDRESS


EXC_BAD_ACCESS: Attempted to dereference garbage pointer 0x3bea82b8a6492040.

0  LANDR +0x10554c8           GrFragmentProcessors::Make(SkShader const*, GrFPArgs const&, SkShaders::MatrixRec const&)
1  LANDR +0x10559dc           GrFragmentProcessors::Make(SkShader const*, GrFPArgs const&, SkShaders::MatrixRec const&)
2  LANDR +0x1057a78           GrFragmentProcessors::Make(SkShader const*, GrFPArgs const&, SkMatrix const&)
3  LANDR +0x107cc54           skpaint_to_grpaint_impl(skgpu::ganesh::SurfaceDrawContext*, SkPaint const&, SkMatrix const&, std::__1::optional<std::__1::unique_ptr<GrFragmentProcessor, std::__1::default_delete<GrFragmentProcessor>>>, SkBlender*, GrPaint*)
4  LANDR +0x107cb3c           SkPaintToGrPaint(skgpu::ganesh::SurfaceDrawContext*, SkPaint const&, SkMatrix const&, GrPaint*)
5  LANDR +0x103058c           skgpu::ganesh::Device::drawRect(SkRect const&, SkPaint const&)
6  LANDR +0xf65464            SkCanvas::onDrawRect(SkRect const&, SkPaint const&)
7  LANDR +0xf64674            SkCanvas::drawRect(SkRect const&, SkPaint const&)
8  LANDR +0xfe9ed4            SkRecordDraw(SkRecord const&, SkCanvas*, SkPicture const* const*, SkDrawable* const*, int, SkBBoxHierarchy const*, SkPicture::AbortCallback*)
9  LANDR +0xf68168            SkCanvas::drawPicture(SkPicture const*, SkMatrix const*, SkPaint const*)
10 LANDR +0xe70900            SkCanvas::drawPicture(SkPicture const*) (SkCanvas.h:2041:15)
11 LANDR +0xe70900            SkCanvas::drawPicture(sk_sp<SkPicture> const&) (SkCanvas.h:2053:15)
12 LANDR +0xe70900            RNSkia::RNSkPictureRenderer::performDraw(std::__1::shared_ptr<RNSkia::RNSkCanvasProvider>)::'lambda'(SkCanvas*)::operator()(SkCanvas*) const (RNSkPictureView.h:70:17)
13 LANDR +0xe70900            decltype(std::declval<RNSkia::RNSkPictureRenderer::performDraw(std::__1::shared_ptr<RNSkia::RNSkCanvasProvider>)::'lambda'(SkCanvas*)&>()(std::declval<SkCanvas*>())) std::__1::__invoke[abi:ne190102]<RNSkia::RNSkPictureRenderer::performDraw(std::__1::shared_ptr<RNSkia::RNSkCanvasProvider>)::'lambda'(SkCanvas*)&, SkCanvas*>(RNSkia::RNSkPictureRenderer::performDraw(std::__1::shared_ptr<RNSkia::RNSkCanvasProvider>)::'lambda'(SkCanvas*)&, SkCanvas*&&) (invoke.h:149:25)
14 LANDR +0xe70900            void std::__1::__invoke_void_return_wrapper<void, true>::__call[abi:ne190102]<RNSkia::RNSkPictureRenderer::performDraw(std::__1::shared_ptr<RNSkia::RNSkCanvasProvider>)::'lambda'(SkCanvas*)&, SkCanvas*>(RNSkia::RNSkPictureRenderer::performDraw(std::__1::shared_ptr<RNSkia::RNSkCanvasProvider>)::'lambda'(SkCanvas*)&, SkCanvas*&&) (invoke.h:224:5)
15 LANDR +0xe6c01c            std::__1::__function::__value_func<void (SkCanvas*)>::operator()[abi:ne190102](SkCanvas*&&) const (function.h:430:12)
16 LANDR +0xe6c01c            std::__1::function<void (SkCanvas*)>::operator()(SkCanvas*) const (function.h:989:10)
17 LANDR +0xe6c01c            RNSkMetalCanvasProvider::renderToCanvas(std::__1::function<void (SkCanvas*)> const&) (RNSkMetalCanvasProvider.mm:86:5)
18 LANDR +0xe70754            RNSkia::RNSkPictureRenderer::performDraw(std::__1::shared_ptr<RNSkia::RNSkCanvasProvider>) (RNSkPictureView.h:63:28)
19 LANDR +0xe70690            RNSkia::RNSkPictureRenderer::renderImmediate(std::__1::shared_ptr<RNSkia::RNSkCanvasProvider>) (RNSkPictureView.h:51:5)
20 LANDR +0xddcc08            RNSkia::RNSkView::requestRedraw()::'lambda'()::operator()() const (RNSkView.h:162:36)
21 libdispatch.dylib +0x1ad8  __dispatch_call_block_and_release
22 libdispatch.dylib +0x1b7e8 __dispatch_client_callout
23 libdispatch.dylib +0x38b20 __dispatch_main_queue_drain.cold.5
24 libdispatch.dylib +0x10ec4 __dispatch_main_queue_drain
25 libdispatch.dylib +0x10e00 __dispatch_main_queue_callback_4CF
26 CoreFoundation +0x6a2c4    ___CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__
27 CoreFoundation +0x1db38    ___CFRunLoopRun
28 CoreFoundation +0x1ca68    __CFRunLoopRunSpecificWithOptions
29 GraphicsServices +0x1494   _GSEventRunModal
30 UIKitCore +0x9dba0         -[UIApplication _run]
31 UIKitCore +0x46a74         _UIApplicationMain
32 LANDR +0x590c              main (AppDelegate.swift:13:14)
33 dyld +0x4e24               start

[wcandillon]

This is very concerning. Thank you for providing me with the nice stack traces and info. Is there any way you could help me reproduce the bug? We have an example with drawAtlas in our example app but it doesn't crash. maybe something about what the Atlas texture contains or how it is updated. I'm a looking into it on my side as well.

[wcandillon]

I tried to build a reproduction example but couldn't get it to crash yet, let me know if you can help me with that.

[ludovicthomas]

This is very concerning. Thank you for providing me with the nice stack traces and info. Is there any way you could help me reproduce the bug? We have an example with drawAtlas in our example app but it doesn't crash. maybe something about what the Atlas texture contains or how it is updated. I'm a looking into it on my side as well.

Thanks for the feedback.
Sadly, if we were able to reproduce the crash that would be amazing, but we have tried a lot of different ways and can't make it crash on our side.

If that could help, here are the code of our components.
Thanks a lot for your time.

For Stacktrace 1, the component looks like this:

/**
 * Creates a reusable 1x1 black pixel image for use with Skia Atlas.
 *
 * This single-pixel image is created once at module level and reused across all Atlas
 * renderings. The Atlas component colors and transforms this pixel to efficiently draw
 * multiple shapes (like waveform bars).
 *
 * This approach avoids:
 * - Creating SkImage objects on every render (prevents memory/garbage collection issues)
 * - Memory leaks from unreleased image references
 * - Using async drawAsImage operations (better performance)
 */

// A sample black base64-encoded pixel
const data = Skia.Data.fromBase64(
    'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAAD0lEQVR4AQEEAPv/AAAAAAAEAAFlScNgAAAAAElFTkSuQmCC',
);
// eslint-disable-next-line new-cap
export const blackPixelSkiaImage = Skia.Image.MakeImageFromEncoded(data);


const WaveformWithAtlas = ({
    waveformData,
    waveformMax,
    height,
    drawingConfig,
    waveformStartIndex,
    waveformStartOffset,
    lengthOfArrayToDraw,
    barColor,
    progress,
}: WaveformProps & {
    drawingConfig: DrawingConfig;
    waveformMax: number;
    lengthOfArrayToDraw: number;
    waveformStartIndex: DerivedValue<number>;
    waveformStartOffset: DerivedValue<number>;
}) => {
    const drawingData = useDrawingData(
        waveformData,
        waveformMax,
        height,
        drawingConfig,
        lengthOfArrayToDraw,
        waveformStartIndex,
        barColor,
        progress,
    );

    // Get the fractional offset for smooth scrolling
    // It's a bit hacky, but we scroll the waveform by moving the canvas left so the scroll is smooth pixel per pixel
    // and the rendering is optimal not recreating the whole waveform on each frame
    const transform = useDerivedValue(() => {
        return [{ translateX: -waveformStartOffset.value }];
    });

    return (
        <Canvas style={{ flex: 1, height }}>
            <Group transform={transform}>
                <Atlas
                    image={blackPixelSkiaImage}
                    sprites={drawingData.sprites}
                    transforms={drawingData.transforms}
                    colors={drawingData.colors}
                />
            </Group>
        </Canvas>
    );
};

const useDrawingData = (
    waveformData: number[],
    waveformMax: number,
    height: number,
    drawingConfig: DrawingConfig,
    lengthOfArrayToDraw: number,
    waveformStartIndex: DerivedValue<number>,
    barColor?: DerivedValue<string>,
    progress?: {
        value: DerivedValue<number>;
        barColor?: DerivedValue<string>;
    },
) => {
    // Pre-compute bar heights to avoid duplicate calculations in worklets
    const barHeights = useMemo(
        () => waveformData.map((val) => Math.max(Math.round((val / waveformMax) * height), MIN_BAR_HEIGHT)),
        [waveformData, waveformMax, height],
    );

    // Creates a buffer of rectangles that define the shape of each waveform bar.
    const sprites = useRectBuffer(lengthOfArrayToDraw, (rect, i) => {
        'worklet';
        const barHeight = barHeights[i + waveformStartIndex.value];
        rect.setXYWH(0, 0, drawingConfig.barWidth, barHeight);
    });

    // Creates a buffer of transformations that position each waveform bar on the canvas.
    const transforms = useRSXformBuffer(lengthOfArrayToDraw, (val, i) => {
        'worklet';
        const barHeight = barHeights[i + waveformStartIndex.value];
        val.set(1, 0, i * (drawingConfig.barWidth + drawingConfig.barGap), Math.round((height - barHeight) / 2));
    });

    // Determine primary and secondary colors with defaults
    const primaryColorValue = useDerivedValue(() => {
        return skiaColor(progress?.barColor?.value ?? palette.primary[500]);
    }, [progress?.barColor]);

    const secondaryColorValue = useDerivedValue(() => {
        return skiaColor(barColor?.value ?? palette.neutral[500]);
    }, [barColor]);

    // Color buffer for rendering - compute colors in the worklet
    const colors = useColorBuffer(lengthOfArrayToDraw, (color: SkColor, i: number) => {
        'worklet';
        // Determine if this bar is before or after the progress value
        const isBeforePlayback = progress?.value && i / waveformData.length < progress.value.value;

        // Set color based on value
        if (isBeforePlayback) {
            color.set(primaryColorValue.value);
        } else {
            color.set(secondaryColorValue.value);
        }
    });

    return {
        sprites,
        transforms,
        colors,
    };
};

For the Stacktrace 2 the component is simple and looks like this:

import { FC, memo, useEffect, useMemo } from 'react';
import { Canvas, Circle, Group, vec, Text, matchFont, useFonts, Skia } from '@shopify/react-native-skia';
import { Easing, useDerivedValue, useSharedValue, withSequence, withTiming } from 'react-native-reanimated';
import { palette } from '@/maestro/palette';

const skiaColor = Skia.Color;

// Drawing constants. Based on existing LANDR png
// to ease computing the position of the elements
const ORIGINAL_LOGO_SIZE = { width: 320, height: 256 }; // the one used in the png (source of truth to build the animation)
const CIRCLE_STROKE_WIDTH = 8;
const CIRCLE_RADIUS = (ORIGINAL_LOGO_SIZE.height - CIRCLE_STROKE_WIDTH) / 2;
const CIRCLE_FINAL_OFFSET = 32;
const LETTERS = [
    { letter: 'L', x: 26, group1: true },
    { letter: 'A', x: 88, group1: false },
    { letter: 'N', x: 146, group1: false },
    { letter: 'D', x: 202, group1: false },
    { letter: 'R', x: 268, group1: true },
];

const FONT_STYLE = {
    fontFamily: 'InterMedium',
    fontSize: 46,
};
const FONT_VERTICAL_ALIGN_OFFSET = 18;

const LANDR_LOGO_ASPECT_RATIO = ORIGINAL_LOGO_SIZE.height / ORIGINAL_LOGO_SIZE.width;
const DRAW_COLOR = palette.neutral[50];

export interface LandrLogoProps {
    width: number;
}

const LandrLogo: FC<LandrLogoProps> = ({ width }) => {
    const size = { width: width, height: width * LANDR_LOGO_ASPECT_RATIO };
    const ratio = size.height / ORIGINAL_LOGO_SIZE.height;

    // We do truncate values to ensure we don't end up drawing off the canvas
    const circleStrokeWidth = Math.trunc(CIRCLE_STROKE_WIDTH * ratio);
    const circleRadius = Math.trunc(CIRCLE_RADIUS * ratio);
    const circleFinalOffset = Math.trunc(CIRCLE_FINAL_OFFSET * ratio);

    const letters = LETTERS.map(({ letter, x, group1 }) => ({ letter, x: Math.round(x * ratio), group1 }));

    const fontSize = Math.trunc(FONT_STYLE.fontSize * ratio);
    const fontOffset = Math.trunc(FONT_VERTICAL_ALIGN_OFFSET * ratio);

    const { font, scaleTransform, centerXC1, centerXC2, opacityG1, opacityG2 } = useLogoAnimation({
        fontSize,
        size,
        circleFinalOffset,
    });

    return (
        <Canvas
            style={{
                width: size.width,
                height: size.height,
            }}
        >
            <Group transform={scaleTransform} origin={vec(size.width / 2, size.height / 2)}>
                <Circle
                    cx={centerXC1}
                    cy={size.height / 2}
                    r={circleRadius}
                    color={DRAW_COLOR}
                    style="stroke"
                    strokeWidth={circleStrokeWidth}
                />
                <Circle
                    cx={centerXC2}
                    cy={size.height / 2}
                    r={circleRadius}
                    color={DRAW_COLOR}
                    style="stroke"
                    strokeWidth={circleStrokeWidth}
                />
                <Group>
                    {letters.map(({ letter, x, group1 }) => (
                        <Text
                            key={`${letter}-${x}`}
                            opacity={group1 ? opacityG1 : opacityG2}
                            text={letter}
                            x={x}
                            y={size.height / 2 + fontOffset}
                            font={font}
                            color={skiaColor(DRAW_COLOR)}
                        />
                    ))}
                </Group>
            </Group>
        </Canvas>
    );
};

const Memoized = memo(LandrLogo, (prevProps, nextProps) => prevProps.width === nextProps.width);
export { Memoized as LandrLogo };

const useLogoAnimation = ({
    fontSize,
    size,
    circleFinalOffset,
}: {
    fontSize: number;
    size: { width: number; height: number };
    circleFinalOffset: number;
}) => {
    // Load LANDR font
    const fontMgr = useFonts({
        // eslint-disable-next-line @typescript-eslint/no-require-imports
        InterMedium: [require('@/assets/fonts/InterMedium.ttf')],
    });
    const font = useMemo(() => {
        if (!fontMgr) {
            return null;
        }
        return matchFont(
            {
                ...FONT_STYLE,
                fontSize,
            },
            fontMgr,
        );
    }, [fontMgr, fontSize]);

    // Animated values
    const scale = useSharedValue(0.4);
    const scaleTransform = useDerivedValue(() => {
        return [{ scale: scale.value }];
    });
    const centerXC1 = useSharedValue(size.width / 2);
    const centerXC2 = useSharedValue(size.width / 2);
    const opacityG1 = useSharedValue(0);
    const opacityG2 = useSharedValue(0);

    useEffect(() => {
        // Scale the whole logo
        scale.value = withSequence(withTiming(1, { duration: 3400, easing: Easing.out(Easing.cubic) }));

        // Moves circles
        centerXC1.value = withSequence(
            withTiming(size.width / 2, { duration: 350 }),
            withTiming(size.width / 2 - circleFinalOffset, {
                duration: 1000,
            }),
        );
        centerXC2.value = withSequence(
            withTiming(size.width / 2, { duration: 350 }),
            withTiming(size.width / 2 + circleFinalOffset, {
                duration: 1000,
            }),
        );

        // Display letters
        opacityG1.value = withSequence(withTiming(0, { duration: 1000 }), withTiming(1, { duration: 1000 }));
        opacityG2.value = withSequence(withTiming(0, { duration: 1300 }), withTiming(1, { duration: 1000 }));
    }, [centerXC1, centerXC2, opacityG1, opacityG2, scale, size.width, circleFinalOffset]);

    return {
        font,
        scaleTransform,
        centerXC1,
        centerXC2,
        opacityG1,
        opacityG2,
    };
};

[wcandillon]

@ludovicthomas Thank you for this. I have appetite to solve this crash. However, I am wondering if we can fix this issue by not using the Atlas API. Maybe using a shader? When we released the Atlas API, we were eager to provide an API where users could build a complex scene without the cost of FFI. But now things look very different on our side (new reconciler, GC of Skia objects) and often the scene can be rebuilt without the Atlas API. In this particular case, it looks like this should be a shader; what do you think? It might also be much faster (less data to transmit to the GPU?).

I should also mention that the Atlas API has not been implemented in Skia Graphite, so it might even disappear. That being said, it could also be easily polyfilled in WebGPU.

Now, of course, if we have more information about the issue or a reproduction, I would love to take a look. I would also love to help achieve your use case without the Atlas API if possible.

[ludovicthomas]

@ludovicthomas Thank you for this. I have appetite to solve this crash. However, I am wondering if we can fix this issue by not using the Atlas API. Maybe using a shader? When we released the Atlas API, we were eager to provide an API where users could build a complex scene without the cost of FFI. But now things look very different on our side (new reconciler, GC of Skia objects) and often the scene can be rebuilt without the Atlas API. In this particular case, it looks like this should be a shader; what do you think? It might also be much faster (less data to transmit to the GPU?).

I should also mention that the Atlas API has not been implemented in Skia Graphite, so it might even disappear. That being said, it could also be easily polyfilled in WebGPU.

Now, of course, if we have more information about the issue or a reproduction, I would love to take a look. I would also love to help achieve your use case without the Atlas API if possible.

Thanks for the feedback, sadly, we still have no reproduction, we will probably ended up rollback to Skia 2.2.21 that was much more stable for us (99.9% of our app, versus 95% with 2.4.6). What we can see from logs is that most of our users experience the issue once or twice maximum, after that no more crashes. But having a crash for 5% of our users is not acceptable.

Please note that the issue is only on Atlas, as the Stacktrace 2 is caused by the component LandrLogo (code above) that is not using Atlas.

I forgot to mention that we are using react native web too, and that Atlas is giving us good performance there.

[wcandillon]

Oups I had missed that, will look at the Logo component that seems to be nice standalone example