EXC_BAD_ACCESS crash in photo_manager beginning with 3.5.0

[btietz]

Version

3.5.0

Platforms

iOS

Device Model

iPhone 16 Pro

flutter info

I don't care about chrome dev, so not applicable but here's the flutter doctor -v output as requested:

[✓] Flutter (Channel stable, 3.35.7, on macOS 15.7.2 24G325 darwin-x64, locale en-US) [456ms]
    • Flutter version 3.35.7 on channel stable at /Users/briantietz/development/flutter
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision adc9010625 (3 weeks ago), 2025-10-21 14:16:03 -0400
    • Engine revision 035316565a
    • Dart version 3.9.2
    • DevTools version 2.48.0
    • Feature flags: enable-web, enable-linux-desktop, enable-macos-desktop, enable-windows-desktop, enable-android, enable-ios,
      cli-animations, enable-lldb-debugging

[✓] Android toolchain - develop for Android devices (Android SDK version 36.1.0) [4.1s]
    • Android SDK at /Users/briantietz/Library/Android/sdk
    • Emulator version 36.1.9.0 (build_id 13823996) (CL:N/A)
    • Platform android-36, build-tools 36.1.0
    • Java binary at: /Applications/Android Studio.app/Contents/jbr/Contents/Home/bin/java
      This is the JDK bundled with the latest Android Studio installation on this machine.
      To manually set the JDK path, use: `flutter config --jdk-dir="path/to/jdk"`.
    • Java version OpenJDK Runtime Environment (build 21.0.6+-13368085-b895.109)
    • All Android licenses accepted.

[✓] Xcode - develop for iOS and macOS (Xcode 16.4) [1,465ms]
    • Xcode at /Applications/Xcode.app/Contents/Developer
    • Build 16F6
    • CocoaPods version 1.16.2

[✗] Chrome - develop for the web (Cannot find Chrome executable at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome)
    [22ms]
    ! Cannot find Chrome. Try setting CHROME_EXECUTABLE to a Chrome executable.

[✓] Android Studio (version 2024.3) [21ms]
    • Android Studio at /Applications/Android Studio.app/Contents
    • Flutter plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/9212-flutter
    • Dart plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/6351-dart
    • Java version OpenJDK Runtime Environment (build 21.0.6+-13368085-b895.109)

[✓] VS Code (version 1.105.1) [17ms]
    • VS Code at /Applications/Visual Studio Code.app/Contents
    • Flutter extension version 3.122.0

[✓] Connected device (2 available) [6.7s]
    • iPhone 16 Pro (mobile) • 3C4F76CE-DE4D-47BC-A646-DACFF993F641 • ios        • com.apple.CoreSimulator.SimRuntime.iOS-18-5
      (simulator)
    • macOS (desktop)        • macos                                • darwin-x64 • macOS 15.7.2 24G325 darwin-x64

[✓] Network resources [378ms]
    • All expected network resources are available.

! Doctor found issues in 1 category.

How to reproduce?

I am using the following code for image import selection. It's a widget that I embed in a bottom sheet. Right from the get-go, I was seeing hard crashes. No exception trace in the flutter / Visual Studio Code debugger, just the app stone cold killed. So hard crash in native code. I tracked this as far as I can before reporting.

It was introduced in version 3.5.0. I am not seeing it with 3.4.0 after fairly exhaustive testing.

The Visual Studio Code debugger provides no useful information, it's just a hard stop, but under Xcode I get a better view. The hard crash is in PMManager as far as I can tell. Assembly view has no source, just movq 0x20(%rax), %rcx. I see source code two stack frames above, and it's here:

[self.cachingManager requestImageForAsset:asset targetSize:CGSizeMake(width, height) (etc...)

Logs

Example code (optional)

// Dart SDK imports:
import "dart:typed_data";
import "dart:io";

// Dart package imports:

// Flutter SDK imports:
import "package:flutter/material.dart";

// Flutter package imports:
import "package:photo_manager/photo_manager.dart";

class PhotoGalleryGrid extends StatefulWidget {
  final ValueChanged<String> onImageSelected;

  const PhotoGalleryGrid({super.key, required this.onImageSelected});

  @override
  State<PhotoGalleryGrid> createState() => _PhotoGalleryGridState();
}

class _PhotoGalleryGridState extends State<PhotoGalleryGrid> {
  List<AssetEntity> assets = <AssetEntity>[];
  int currentPage = 0;
  bool isLoading = false;

  @override
  void initState() {
    super.initState();
    _loadMoreAssets();
  }

  Future<void> _loadMoreAssets() async {
    if (isLoading) return;
    setState(() {
      isLoading = true;
    });

    final List<AssetPathEntity> paths = await PhotoManager.getAssetPathList(type: RequestType.image);

    if (paths.isNotEmpty) {
      final AssetPathEntity recentAlbum = paths.first;
      final List<AssetEntity> newAssets = await recentAlbum.getAssetListPaged(page: currentPage, size: 20);

      setState(() {
        assets.addAll(newAssets);
        currentPage++;
        isLoading = false;
      });
    } else {
      setState(() {
        isLoading = false;
      });
    }
  }

  @override
  Widget build(BuildContext context) {
    return GridView.builder(
      gridDelegate: SliverGridDelegateWithFixedCrossAxisCount(
        crossAxisCount: 4,
        crossAxisSpacing: 4.0,
        mainAxisSpacing: 4.0,
      ),
      itemCount: assets.length + (isLoading ? 1 : 0),
      itemBuilder: (BuildContext context, int index) {
        if (index == assets.length) {
          return Center(child: CircularProgressIndicator());
        }

        final AssetEntity asset = assets[index];
        return GestureDetector(
          onTap: () async {
            final File? file = await asset.file;
            if (file != null) {
              widget.onImageSelected(file.path);
            }
          },
          child: FutureBuilder<Uint8List?>(
            key: ValueKey(asset.id),
            future: asset.thumbnailDataWithSize(const ThumbnailSize(200, 200)),
            builder: (BuildContext context, AsyncSnapshot<Uint8List?> snapshot) {
              if (snapshot.connectionState == ConnectionState.done && snapshot.data != null) {
                return Image.memory(snapshot.data!, fit: BoxFit.cover);
              }
              // Placeholder while the thumbnail loads
              return Container(
                color: Colors.grey,
                child: Center(child: Icon(Icons.image, color: Colors.grey)),
              );
            },
          ),
        );
      },
    );
  }
}

Contact

No response

[fluttercandies-dev]

AI Summary: The app crashes with EXC_BAD_ACCESS on iOS, starting with version 3.5.0, during image selection. The crash occurs in PMManager when requesting an image for an asset.

[btietz]

Addendum: the bug persists to the latest version 3.7.1. I originally encountered it there. I backtracked it to 3.5.0 by binary search.

[AlexV525]

Could you paste crash logs from Xcode?

[btietz]

Could you paste crash logs from Xcode?

Is this the log you mean? The log doesn't show anything that seems particularly relevant to this crash, so if you mean for me to pull logs from somewhere more informative, please guide me. In any case, here is the log (at least the one that is readily apparent) with photo_manager 3.5.0:

-- LLDB integration loaded --
FlutterView implements focusItemsInRect: - caching for linear focus movement is limited as long as this view is on screen.
flutter: The Dart VM service is listening on http://127.0.0.1:50662/4B4ONBomp5A=/
[Sentry] [error] [1762969870.4788141] [SentryOptions:251] Could not parse the DSN: Error Domain=SentryErrorDomain Code=100 "URL scheme of DSN is missing" UserInfo={NSLocalizedDescription=URL scheme of DSN is missing}.
[Sentry] [fatal] [1762969870.490151] [SentryFileManager:162] No DSN provided, using base path for envelopes: /Users/briantietz/Library/Developer/CoreSimulator/Devices/3C4F76CE-DE4D-47BC-A646-DACFF993F641/data/Containers/Data/Application/96D0E65F-21E4-4AFA-A5A4-E300E57EFD5E/Library/Caches/io.sentry
[Sentry] [warning] [1762969870.4938688] [SentryTransportFactory:76] Failed to create HTTP transport because the SentryOptions does not contain a parsed DSN.
[Sentry] [fatal] [1762969870.496162] [SentryFileManager:162] No DSN provided, using base path for envelopes: /Users/briantietz/Library/Developer/CoreSimulator/Devices/3C4F76CE-DE4D-47BC-A646-DACFF993F641/data/Containers/Data/Application/96D0E65F-21E4-4AFA-A5A4-E300E57EFD5E/Library/Caches/io.sentry
[Sentry] [warning] [1762969870.5031781] [SentryFileManager:257] Could not get attributes of item at path: /Users/briantietz/Library/Developer/CoreSimulator/Devices/3C4F76CE-DE4D-47BC-A646-DACFF993F641/data/Containers/Data/Application/96D0E65F-21E4-4AFA-A5A4-E300E57EFD5E/Library/Caches/io.sentry/tags.state. Error: Error Domain=NSCocoaErrorDomain Code=260 "The file “tags.state” couldn’t be opened because there is no such file." UserInfo={NSFilePath=/Users/briantietz/Library/Developer/CoreSimulator/Devices/3C4F76CE-DE4D-47BC-A646-DACFF993F641/data/Containers/Data/Application/96D0E65F-21E4-4AFA-A5A4-E300E57EFD5E/Library/Caches/io.sentry/tags.state, NSURL=file:///Users/briantietz/Library/Developer/CoreSimulator/Devices/3C4F76CE-DE4D-47BC-A646-DACFF993F641/data/Containers/Data/Application/96D0E65F-21E4-4AFA-A5A4-E300E57EFD5E/Library/Caches/io.sentry/tags.state, NSUnderlyingError=0x600000c4c7b0 {Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory"}}
[Sentry] [warning] [1762969870.6133962] [SentryAppStartTracker:151] Unknown start type. Not measuring app start.
FlutterSemanticsScrollView implements focusItemsInRect: - caching for linear focus movement is limited as long as this view is on screen.
FlutterSemanticsScrollView implements focusItemsInRect: - caching for linear focus movement is limited as long as this view is on screen.
FlutterSemanticsScrollView implements focusItemsInRect: - caching for linear focus movement is limited as long as this view is on screen.
FlutterSemanticsScrollView implements focusItemsInRect: - caching for linear focus movement is limited as long as this view is on screen.

I believe you can ignore the Sentry errors. Certainly unrelated, but to avoid that being a red herring, I'll explain: with a valid DSN, sentry seems to get into a deadlock trying to parse the license. As a workaround, I found that a dummy DNS works for my purposes when running in debug mode, at least for now.

Meanwhile, at the photo_manager crash, the call stack is as follows:

objc_storeWeak:
0x7ff8019d65d9 <+209>: movq 0x20(%rdx), %rax. Thread 7: EXC_BAD_ACCESS (code=EXC_I386_GPFLT)

[PHImageManager requestImageForAsset:targetSize:contentMode:options:resultHandler:]
0x7ff816e59393 <+143>: callq *0x2ad334ff(%rip) ; (void *)0x00007ff8019afd80: objc_msgSend
0x7ff816e59399 <+149>: movl %eax, %r14d

PMManager (void)fetchThumb:(PHAsset *)asset option:(PMThumbLoadOption *)option resultHandler:(NSObject *)handler progressHanlder...

[self.cachingManager requestImageForAsset:asset
                               targetSize:CGSizeMake(width, height)
                              contentMode:option.contentMode
                                  options:requestOptions
                            resultHandler:^(PMImage *result, NSDictionary *info) {

Looking at that stack frame's variables, perhaps progressHandler being nil causes the crash.

self PMManager * 0x60000026d0e0 0x000060000026d0e0
progressHandler NSObject * nil 0x0000000000000000
option PMThumbLoadOption * 0x600000c72370 0x0000600000c72370
asset PHAsset * 0x10d3a4f20 0x000000010d3a4f20
lastProgress double 0
width int 200
height int 200

[btietz]

By the way, this is the iOS simulator, simulating an iPhone 16 Pro running iOS 18.5. I believe the fact that it's running on an intel based Mac is why it's showing x86_64 instructions.

[AlexV525]

This should be resolved by #1323