Session Replay crash: NSConcreteValue doubleValue in mapRedactRegion during RN navigation transitions

[NicholasJAlexander]

Environment

• @sentry/react-native: 7.11.0
• sentry-cocoa (via Podfile.lock): 8.58.0
• Expo SDK: 55
• React Native: 0.83.x
• iOS: 18.6.2
• Device: iPhone 13 (iPhone13,2)
• Architecture: New Architecture (Fabric)

Description

Fatal crash in SentryUIRedactBuilder.mapRedactRegion during Session Replay screenshot capture. The crash occurs when navigating between screens — specifically during the push transition animation from a search results screen to an event detail screen.

This appears to be the same class of bug as COCOA-1091 and #4558, but triggered by React Navigation transition animations rather than a specific view class like CameraUI or RCTVideo.

Stack Trace

NSInvalidArgumentException: -[NSConcreteValue doubleValue]: unrecognized selector sent to instance 0x12e68f150

SentrySessionReplay.newFrame (SentrySessionReplay.swift:237)
SentrySessionReplay.takeScreenshot (SentrySessionReplay.swift:378)
SentryViewPhotographer.image (SentryViewPhotographer.swift:41)
SentryUIRedactBuilder.redactRegionsFor (SentryUIRedactBuilder.swift:425)
SentryUIRedactBuilder.mapRedactRegion (SentryUIRedactBuilder.swift:588) [x30 recursive]
SentryUIRedactBuilder.mapRedactRegion (SentryUIRedactBuilder.swift:566)
CA::Layer::sublayers
CA::Layer::presentation_layer
-[CABasicAnimation applyForTime:presentationObject:modelObject:]
-[NSNumber(CAAnimatableValue) CA_interpolateValue:byFraction:]
__forwarding_prep_0___
___forwarding___
-[NSObject(NSObject) doesNotRecognizeSelector:]
objc_exception_throw

Root Cause

When mapRedactRegion traverses the view hierarchy via layer.sublayers, CoreAnimation resolves presentation layers. If any layer has an active CABasicAnimation whose fromValue/toValue is a boxed struct (NSConcreteValue wrapping CGRect, CGPoint, CATransform3D) instead of NSNumber, the interpolation code calls doubleValue on that value — which NSConcreteValue doesn't respond to.

This is a race condition: it only triggers when a non-scalar animation is actively running at the exact moment Session Replay captures a screenshot. Navigation push/pop transitions are the most common trigger since they animate position and transform properties (struct values).

Why excludedViewClasses doesn't help here

The excludedViewClasses API added in 8.58.0 (#7063) works for specific view classes like RCTVideo or CameraUI.ChromeSwiftUIView. But for navigation transitions, the offending animations are on RNSScreen / RNSNavigationController layers — excluding those would effectively disable replay for the entire app.

Suggested Fix

Wrap the layer.sublayers access (and/or the presentation layer resolution) in SentryUIRedactBuilder.mapRedactRegion with a @try/@catch for NSInvalidArgumentException. This would gracefully skip layers that crash during traversal without killing the app.

Something like:

@try {
    NSArray *sublayers = layer.sublayers;
    // ... traverse
} @catch (NSException *exception) {
    // Skip this layer — animation value type mismatch
}

Reproduction Context

• User opens app → home feed
• Navigates to search screen (keyboard appears)
• Types a search query (incremental results load)
• Taps a search result → push navigation to event detail screen
• Crash during the push transition animation

Session Replay was active (replaysSessionSampleRate: 0.1, replaysOnErrorSampleRate: 1.0). The crash is handled: no, level: fatal — the app is force-killed by iOS.

Related Issues

• COCOA-1091 — Same stack trace, same RN/Expo version, excludedViewClasses API added but doesn't generically fix it
• #5647 — CameraUI variant, fixed by auto-excluding CameraUI.ChromeSwiftUIView
• #4558 — SentryViewPhotographer crash during React Navigation transitions
• RN-458 — Same NSConcreteValue doubleValue crash from RCTVideo

[linear-code]

COCOA-1406

[philprime]

Thank you @NicholasJAlexander for the detailed bug report and a fix proposal. Do you think you can build me a minimal project which can reproduce this crash reliably? Happy to implement a fix but we need a proper test for it.

[Buodd]

Having almost exact same issue and error, users crashing in our react native app after we implemented Sentry replay.

[mjuarrosImproving]

+1 — same root cause, different trigger (expo-video AVPlayerViewController on iOS 26.4.2)

Adding a repro that confirms this is broader than React Navigation transitions — the same -[NSConcreteValue doubleValue]: unrecognized selector in SentryUIRedactBuilder.mapRedactRegion is reachable via expo-video's fullscreen AVPlayerViewController.

Environment

• @sentry/react-native: 8.10.0 (sentry-cocoa via Pods)
• expo-video: ~55.0.15 (uses AVPlayerViewController under the hood, with auto-fullscreen presentation)
• Expo SDK: 55, RN 0.81.x, New Architecture (Fabric)
• iOS: 26.4.2 (physical device, not beta)

Repro

1. App with Session Replay enabled (replaysSessionSampleRate: 0.1, replaysOnErrorSampleRate: 1.0).
2. Navigate to a screen with <VideoView> from expo-video.
3. Call videoView.presentFullscreenPlayer() (or rely on expo-video's auto-fullscreen behavior).
4. Crash within ~5 seconds, during the next replay segment capture.

Why excludedViewClasses doesn't help here

I tried excludedViewClasses: ['VideoView', 'AVPlayer'] (intending to catch both expo-video.VideoView and the underlying AVPlayerView / AVPlayerViewController internals). The crash still reproduces because:

1. expo-video calls playerViewController.view.removeFromSuperview() and modal-presents the player on the root window, so the AV subtree is no longer a descendant of VideoView — only AVPlayer*-named ancestors apply.
2. Not all the offending intermediate CALayers have a UIView delegate. isViewSubtreeIgnored is only consulted when layer.delegate as? UIView succeeds, so for UIView-less CALayers in the AVFoundation subtree the substring check is bypassed entirely and recursion descends into the layer that triggers the bad doubleValue call.

Workaround we shipped

JS-side disablement of Session Replay (replaysSessionSampleRate: 0 / replaysOnErrorSampleRate: 0 and not pushing mobileReplayIntegration into the integrations array). This is the only thing that stopped the crash for our users.

Vote on the proposed fix

+1 to wrapping the layer.sublayers traversal / presentation-layer access with @try/@catch for NSInvalidArgumentException as suggested in the original report. The current excludedViewClasses API is fundamentally string-matching against UIView class names, which can't catch animation-value crashes on UIView-less CALayers — those need a defensive try/catch at the CALayer traversal site itself.