[engine] potential crash on deref of canvas_image_ in single_frame_codec.cc.

[Tom3652]

Steps to reproduce

I have a live app using flutter 3.27.1 that i have released yesterday with 30k daily active users.
I have received a new crash that i had not in 3.24.x apparently from flutter UI :

Please see the full StackTrace for more information.

Expected results

The app should not crash

Actual results

The app is crashing

Code sample

Code sample

[Paste your code here]

Screenshots or Video

Screenshots / Video demonstration

[Upload media here]

Logs

Logs

Crashed: io.flutter.1.ui
0  Flutter                        0x4db148 flutter::SingleFrameCodec::getNextFrame(_Dart_Handle*) + 303 (SkRefCnt.h:303)
1  App                            0xd53c stub CallNativeThroughSafepoint + 21820
2  App                            0x726c60 _NativeCodec.getNextFrame + 2286 (painting.dart:2286)
3  App                            0x726b3c _NativeCodec.getNextFrame + 24 (exceptions.dart:24)
4  App                            0x726214 MultiImageStreamCompleter._decodeNextFrameAndSchedule + 133 (multi_image_stream_completer.dart:133)
5  App                            0x1b2fb0 ImageStream.addListener + 177 (multi_image_stream_completer.dart:177)
6  App                            0x1bbb40 _ImageState._listenToStream + 1233 (image.dart:1233)
7  App                            0x1bb300 _ImageState.didChangeDependencies + 1090 (image.dart:1090)
8  App                            0xe2d58 StatefulElement.performRebuild + 5794 (framework.dart:5794)
9  App                            0x7152a8 BuildScope._tryRebuild + 2697 (framework.dart:2697)
10 App                            0x714e98 BuildScope._flushDirtyElements + 2792 (framework.dart:2792)
11 App                            0x714d8c BuildOwner.buildScope + 3048 (framework.dart:3048)
12 App                            0xded60 _LayoutBuilderElement._rebuildWithConstraints + 194 (layout_builder.dart:194)
13 App                            0xdec60 _LayoutBuilderElement._rebuildWithConstraints + 194 (layout_builder.dart:194)
14 App                            0x127a98 RenderObject.invokeLayoutCallback.<anonymous closure> + 2738 (object.dart:2738)
15 App                            0x71b618 PipelineOwner._enableMutationsToDirtySubtrees + 1108 (object.dart:1108)
16 App                            0x71b598 RenderObject.invokeLayoutCallback + 2738 (object.dart:2738)
17 App                            0x12a1d8 RenderConstrainedLayoutBuilder.rebuildIfNecessary + 284 (layout_builder.dart:284)
18 App                            0x12a08c _RenderLayoutBuilder.performLayout + 379 (layout_builder.dart:379)
19 App                            0x757ae4 RenderObject._layoutWithoutResize + 2466 (object.dart:2466)
20 App                            0x7579b0 PipelineOwner.flushLayout + 1074 (object.dart:1074)
21 App                            0x757a48 PipelineOwner.flushLayout + 1075 (object.dart:1075)
22 App                            0x2891fc RendererBinding.drawFrame + 610 (binding.dart:610)
23 App                            0x288e70 WidgetsBinding.drawFrame + 1183 (binding.dart:1183)
24 App                            0x2887d4 RendererBinding._handlePersistentFrameCallback + 476 (binding.dart:476)
25 App                            0x288798 RendererBinding._handlePersistentFrameCallback + 474 (binding.dart:474)
26 App                            0x709848 SchedulerBinding._invokeFrameCallback + 1403 (binding.dart:1403)
27 App                            0x70960c SchedulerBinding.handleDrawFrame + 144 (growable_array.dart:144)
28 App                            0x44c08 SchedulerBinding._handleDrawFrame + 1158 (binding.dart:1158)
29 App                            0x44aec SchedulerBinding._handleDrawFrame + 1158 (binding.dart:1158)
30 App                            0x3e280 _invoke + 314 (hooks.dart:314)
31 App                            0x431ac PlatformDispatcher._drawFrame + 426 (platform_dispatcher.dart:426)
32 App                            0x43170 _drawFrame + 281 (hooks.dart:281)
33 App                            0x431dc _drawFrame + 281 (hooks.dart:281)
34 App                            0xfb8c stub InvokeDartCode + 31628
35 Flutter                        0x63c034 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&) + 33 (allocation.h:33)
36 Flutter                        0x7495bc Dart_InvokeClosure + 4664 (dart_api_impl.cc:4664)
37 Flutter                        0x5cb3dc flutter::Shell::OnAnimatorBeginFrame(fml::TimePoint, unsigned long long) + 30 (dart_invoke.cc:30)
38 Flutter                        0x5adc78 std::_fl::__function::__func<flutter::Animator::AwaitVSync()::$_0, std::_fl::allocator<flutter::Animator::AwaitVSync()::$_0>, void (std::_fl::unique_ptr<flutter::FrameTimingsRecorder, std::_fl::default_delete<flutter::FrameTimingsRecorder>>)>::operator()(std::_fl::unique_ptr<flutter::FrameTimingsRecorder, std::_fl::default_delete<flutter::FrameTimingsRecorder>>&&) + 186 (ref_ptr.h:186)
39 Flutter                        0x5de554 std::_fl::__function::__func<flutter::VsyncWaiter::FireCallback(fml::TimePoint, fml::TimePoint, bool)::$_0, std::_fl::allocator<flutter::VsyncWaiter::FireCallback(fml::TimePoint, fml::TimePoint, bool)::$_0>, void ()>::operator()() + 302 (unique_ptr.h:302)
40 Flutter                        0x85c9c fml::MessageLoopImpl::FlushTasks(fml::FlushType) + 128 (message_loop_impl.cc:128)
41 Flutter                        0x89314 fml::MessageLoopDarwin::OnTimerFire(__CFRunLoopTimer*, fml::MessageLoopDarwin*) + 86 (message_loop_darwin.mm:86)
42 CoreFoundation                 0xb63f8 <redacted> + 32
43 CoreFoundation                 0xb609c <redacted> + 1012
44 CoreFoundation                 0xb5bf0 <redacted> + 288
45 CoreFoundation                 0x540fc <redacted> + 1856
46 CoreFoundation                 0x535b8 CFRunLoopRunSpecific + 572
47 Flutter                        0x89400 fml::MessageLoopDarwin::Run() + 52 (message_loop_darwin.mm:52)
48 Flutter                        0x890e0 std::_fl::__function::__func<fml::Thread::Thread(std::_fl::function<void (fml::Thread::ThreadConfig const&)> const&, fml::Thread::ThreadConfig const&)::$_0, std::_fl::allocator<fml::Thread::Thread(std::_fl::function<void (fml::Thread::ThreadConfig const&)> const&, fml::Thread::ThreadConfig const&)::$_0>, void ()>::operator()() + 94 (message_loop_impl.cc:94)
49 Flutter                        0x88df0 fml::ThreadHandle::ThreadHandle(std::_fl::function<void ()>&&)::$_0::__invoke(void*) + 470 (function.h:470)
50 libsystem_pthread.dylib        0x637c _pthread_start + 136
51 libsystem_pthread.dylib        0x1494 thread_start + 8

Flutter Doctor output

Doctor output

[✓] Flutter (Channel stable, 3.27.1, on macOS 15.2 24C101 darwin-x64, locale fr-FR)
    • Flutter version 3.27.1 on channel stable at /Users/foxtom/Desktop/flutter
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision 17025dd882 (2 weeks ago), 2024-12-17 03:23:09 +0900
    • Engine revision cb4b5fff73
    • Dart version 3.6.0
    • DevTools version 2.40.2

[✓] Android toolchain - develop for Android devices (Android SDK version 35.0.0)
    • Android SDK at /Users/foxtom/Library/Android/sdk
    • Platform android-35, build-tools 35.0.0
    • Java binary at: /Applications/Android Studio.app/Contents/jbr/Contents/Home/bin/java
    • Java version OpenJDK Runtime Environment (build 21.0.3+-79915915-b509.11)
    • All Android licenses accepted.

[✓] Xcode - develop for iOS and macOS (Xcode 16.2)
    • Xcode at /Applications/Xcode.app/Contents/Developer
    • Build 16C5032a
    • CocoaPods version 1.16.2

[✓] Chrome - develop for the web
    • Chrome at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

[✓] Android Studio (version 2024.2)
    • Android Studio at /Applications/Android Studio.app/Contents
    • Flutter plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/9212-flutter
    • Dart plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/6351-dart
    • Java version OpenJDK Runtime Environment (build 21.0.3+-79915915-b509.11)

[✓] VS Code (version 1.96.2)
    • VS Code at /Applications/Visual Studio Code.app/Contents
    • Flutter extension can be installed from:
      🔨 https://marketplace.visualstudio.com/items?itemName=Dart-Code.flutter

[✓] Connected device (4 available)
    • Now You See Me (mobile) • 00008020-001204401E78002E • ios            • iOS 18.2 22C152
    • macOS (desktop)         • macos                     • darwin-x64     • macOS 15.2 24C101 darwin-x64
    • Chrome (web)            • chrome                    • web-javascript • Google Chrome 131.0.6778.205

[✓] Network resources
    • All expected network resources are available.

• No issues found!

[huycozy]

Hi @Tom3652,

4 App 0x726214 MultiImageStreamCompleter._decodeNextFrameAndSchedule + 133 (multi_image_stream_completer.dart:133)
5 App 0x1b2fb0 ImageStream.addListener + 177 (multi_image_stream_completer.dart:177)

Are you using cached_network_image package?If yes, did you also upgrade package when building new app version?

Can you try checking if the crash occurs when running the project in release mode (-- release)? Then you can narrow this by retrying with old version of cached_network_image package.

[Tom3652]

Hi @huycozy !

Yes indeed i am using cached_network_image with its current latest version but the package didn't get upgrade for few month and it's the first time i see this crash.
I won't go back with a previous version for only 1 crash in all these months and without knowing if it's actually the package code that was causing the crash
-> In my humble opinion it's rather a flutter issue than cached_network_image since they are using flutter APIs MultiImageStreamCompleter ?

[huycozy]

Thanks for the update. Can you try using https://api.flutter.dev/flutter/widgets/Image/Image.network.html instead and see if the crash still happens?

[Tom3652]

I won't be able to use the Image.network in my real app unfortunately since i need the caching logic of cached_network_image and i can't release a live version with my active users without caching just to test that unfortunately
-> I also never encountered it in debug mode and unable to reproduce, it also happened only once for few millions of app sessions so...

You can close this issue if you think it's not worth investigating, i simply wanted to raise it so the flutter team is aware of that but this has no impact on my app.

[huycozy]

I just wanted to narrow down the scope to see which was most likely related (package or Flutter SDK code), please check Provide reduced test cases.

Can you please provide the list of impacted device info(OS, model) and the percentage occurrence of the crash? Thanks!

[Tom3652]

Only one phone, on iPhone 12 under android 18 so far so it's a very rare crash :

[huycozy]

Thanks for the update. Keeping the issue for further tracking and team's input.