macOS/Windows/iOS Crash: Texture allocation size exceeds the maximum allowed size of 16384

[BlockRen]

Description

Our macOS application experiences a crash involving CVPixelBufferCreate, CVMetalTextureCacheCreateTextureFromImage, and an invalid MTLTextureDescriptor. The crash log indicates texture descriptor dimensions (width: 4294966496) vastly exceed Metal's maximum allowed size (16384) .

While the crash log doesn't explicitly name Rive Native, the occurrence is strongly correlated with parts of our application using Rive, suggesting a potential issue within the Rive Native library, possibly during texture allocation or management for animation rendering.

​Error Log​

2025-10-12 20:42:19.537 app[71118:58991793] CVPixelBufferCreate error -6662
2025-10-12 20:42:19.537 app[71118:58991793] CVMetalTextureCacheCreateTextureFromImage error -6661
2025-10-12 20:42:19.538 app[71118:58991793] CVPixelBufferCreate error -6662
2025-10-12 20:42:19.538 app[71118:58991793] CVMetalTextureCacheCreateTextureFromImage error -6661
2025-10-12 20:42:19.538 app[71118:58991793] CVPixelBufferCreate error -6662
2025-10-12 20:42:19.538 app[71118:58991793] CVMetalTextureCacheCreateTextureFromImage error -6661
-[MTLTextureDescriptorInternal validateWithDevice:]:1357: failed assertion `Texture Descriptor Validation
MTLTextureDescriptor has width (4294966496) greater than the maximum allowed size of 16384.

Device & Versions (please complete the following information)

∙​​Device:​​ Macbook Pro
∙OS Version:​​ Sonoma 14.6.1, 23G93, darwin-arm64
∙Rive Native Version:​​ rive 0.14.0-dev.9
∙Flutter 3.35.6

[BlockRen]

On macOS platforms. A key observation is the creation of a texture with an invalid width of 4294966496, which significantly exceeds the maximum allowed size of 16384. This suggests a potential integer overflow or parameter miscalculation during texture creation.

Crucially, we do not perform direct texture operations in our application code. This strongly indicates that the issue likely occurs within Rive's native internals. Because the crash occurs immediately and there are no Dart-related exceptions, this is a phenomenon that occurs in native code.

The same crash has been reproduced on Windows, confirming this is not an isolated platform-specific issue. It is currently unknown if the problem also affects Android, iOS.

[BlockRen]

We have found more explicit information, which allows us to confirm that the "crash" issue is indeed related to "rive native". We found that the same crash occurred on both macOS, Windows and iOS. Then on the Mac, by examining the crash log, we finally obtained the stack trace.

-------------------------------------
Translated Report (Full Report Below)
-------------------------------------

CrashReporter Key:   D148BFF8-9AE5-DBB3-391D-D049BE856B81
Hardware Model:      Mac14,12
Process:             Runner [35968]
Code Type:           ARM-64 (Native)
Role:                Foreground
Parent Process:      launchd_sim [1087]
Coalition:           com.apple.CoreSimulator.SimDevice.3DC4FF8C-5B34-4AD3-A928-1AFA284D3D76 [862]
Responsible Process: SimulatorTrampoline [992]

Date/Time:           2025-10-16 11:17:23.3580 +0800
Launch Time:         2025-10-16 11:14:15.6393 +0800
OS Version:          macOS 15.5 (24F74)
Release Type:        User
Report Version:      104

Exception Type:  EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Termination Reason: SIGNAL 6 Abort trap: 6
Terminating Process: Runner [35968]

Triggered by Thread:  0

Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib        	       0x105900874 __pthread_kill + 8
1   libsystem_pthread.dylib       	       0x104bc62ec pthread_kill + 264
2   libsystem_c.dylib             	       0x18016c568 __abort + 112
3   libsystem_c.dylib             	       0x18016c4f8 abort + 116
4   rive_native                   	       0x105ce6cd4 rive::gpu::IntersectionBoard::resizeAndReset(unsigned int, unsigned int) + 704
5   rive_native                   	       0x105cebe60 rive::gpu::RenderContext::LogicalFlush::writeResources() + 1728
6   rive_native                   	       0x105ceadb0 rive::gpu::RenderContext::flush(rive::gpu::RenderContext::FlushResources const&) + 1672
7   rive_native                   	       0x105bed4e4 flush + 80
8   ???                           	       0x108a08008 ???
9   ???                           	       0x15d47caf0 ???
10  ???                           	       0x15f0d659c ???
11  ???                           	       0x15d476ef8 ???
12  ???                           	       0x15cc0157c ???
13  ???                           	       0x1550910f0 ???
14  ???                           	       0x15b14e990 ???
15  ???                           	       0x15c96b6c8 ???
16  ???                           	       0x1587ff170 ???
17  ???                           	       0x108a0d2d0 ???
18  ???                           	       0x1550c38f4 ???
19  ???                           	       0x15cc0157c ???
20  ???                           	       0x1550910f0 ???
21  ???                           	       0x15b14e990 ???
22  ???                           	       0x15c96b6c8 ???
23  ???                           	       0x1587ff170 ???
24  ???                           	       0x108a0d2d0 ???
25  ???                           	       0x1550c38f4 ???
26  ???                           	       0x15cc0157c ???
27  ???                           	       0x1550910f0 ???
28  ???                           	       0x15b14e990 ???
29  ???                           	       0x15c96b6c8 ???
30  ???                           	       0x153bc9b50 ???
31  ???                           	       0x15f0c7724 ???
32  ???                           	       0x153bbb61c ???
33  ???                           	       0x153bbb4f8 ???
34  ???                           	       0x108a03aa4 ???
35  Flutter                       	       0x10900065c dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&) + 244
36  Flutter                       	       0x109000b0c dart::DartEntry::InvokeCallable(dart::Thread*, dart::Function const&, dart::Array const&, dart::Array const&) + 300
37  Flutter                       	       0x10931ef70 Dart_InvokeClosure + 916
38  Flutter                       	       0x108f17f64 tonic::DartMicrotaskQueue::RunMicrotasks() + 128
39  Flutter                       	       0x108b1111c fml::MessageLoopImpl::FlushTasks(fml::FlushType) + 200
40  Flutter                       	       0x108b17ec4 fml::MessageLoopDarwin::OnTimerFire(__CFRunLoopTimer*, fml::MessageLoopDarwin*) + 32
41  CoreFoundation                	       0x18041becc __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 28
42  CoreFoundation                	       0x18041bb88 __CFRunLoopDoTimer + 956
43  CoreFoundation                	       0x18041b21c __CFRunLoopDoTimers + 284
44  CoreFoundation                	       0x1804157ac __CFRunLoopRun + 1804
45  CoreFoundation                	       0x180414c24 CFRunLoopRunSpecific + 552
46  GraphicsServices              	       0x19020ab10 GSEventRunModal + 160
47  UIKitCore                     	       0x185ad82fc -[UIApplication _run] + 796
48  UIKitCore                     	       0x185adc4f4 UIApplicationMain + 124
49  UIKitCore                     	       0x184ec36a8 0x184ca0000 + 2242216
50  Runner.debug.dylib            	       0x104c6bbcc static UIApplicationDelegate.main() + 128
51  Runner.debug.dylib            	       0x104c6bb3c static AppDelegate.$main() + 44
52  Runner.debug.dylib            	       0x104c6bd4c __debug_main_executable_dylib_entry_point + 28
53  ???                           	       0x1044e9410 ???
54  dyld                          	       0x104222b98 start + 6076

[BlockRen]

@HayesGordon I've traced the crash to negative scale values (-1) being passed to texture creation. Could you please help investigate this issue

Crash Cause Identified:
After debugging the crash logs and reviewing the rive_native code, I've traced the root cause to invalid texture dimensions. The desiredTransformWidthScaleor, desiredTransformHeightScale parameters are occasionally receiving negative values (-1), resulting in negative width/height values being passed to the Metal texture allocation. This triggers the crash when the native layer attempts to create a texture with invalid dimensions. Then after I added the abs() function, the problem was temporarily resolved.

Where It Fails:
The negative scale values originate from the Dart FFI layer (rive_native_ffi.dart), but I haven't yet identified why these negative values are being generated. The native Metal texture creation correctly validates and rejects these invalid dimensions, causing the observed EXC_CRASH (SIGABRT). This crash occurred not only on macOS, but also on Windows and iOS.

[HayesGordon]

@BlockRen interesting! Thanks for the investigation. Sorry I was out of office, and playing catch up with requests. I will investigate this soon. When you say "the problem was temporarily resolved", are you suggesting there is something else wrong, besides this negative size?

[BlockRen]

Yes, adding .abs() resolved the crash, and from my end, it seems to have resolved the issue for now. However, I’m not sure if there might be underlying issues that could surface later. It might be helpful if you could look into this further. If there are no deeper problems, then the .abs() fix should be sufficient.