[iOS] SIGABRT in makeImageSnapshot when canvas size is -1 — MTLTextureDescriptor width (uint64)-1 assertion

[woosanggyu]

Description

We are seeing a production iOS crash (SIGABRT) in RNSkView::makeImageSnapshot. When the Skia view's canvas size is -1 (view not yet laid out, or being detached), the size is passed without validation into the offscreen surface creation, and Metal aborts on texture descriptor validation:

failed assertion `Texture Descriptor Validation
MTLTextureDescriptor has width (18446744073709551615) greater than the maximum allowed size of 32768.
MTLTextureDescriptor has height (18446744073709551615) greater than the maximum allowed size of 32768.'

18446744073709551615 is (uint64)-1, i.e. the unlaid-out canvas size cast to unsigned.

Stack trace (symbolicated, production)

Metal                -[MTLTextureDescriptorInternal validateWithDevice:]  (failed assertion → abort)
AGXMetalG18P         -[AGXTexture initWithDevice:desc:isSuballocDisabled:]
NOVA                 OffscreenRenderContext::OffscreenRenderContext (MetalContext.h:33)
NOVA                 MetalContext::MakeOffscreen (MetalContext.h:51)
NOVA                 RNSkia::RNSkOffscreenCanvasProvider::RNSkOffscreenCanvasProvider (RNSkView.h:77)
NOVA                 RNSkia::RNSkView::makeImageSnapshot (RNSkView.h:207)
NOVA                 lambda in RNSkJsiViewApi.h:241  (makeImageSnapshotAsync main-queue block)
libdispatch          _dispatch_main_queue_drain

Analysis

• JS calls canvasRef.makeImageSnapshotAsync(). RNSkJsiViewApi dispatches the actual snapshot to the main queue (RNSkJsiViewApi.h:241).
• Between the JS call and the main-queue block executing, the view's layout state can change (view detached / not yet laid out) — so JS-side guards (checking onLayout completion / mount state before calling) cannot fully prevent this; it is a native-side TOCTOU.
• RNSkView::makeImageSnapshot (cpp/rnskia/RNSkView.h) constructs RNSkOffscreenCanvasProvider with _canvasProvider->getWidth()/getHeight() without any size validation, so -1 flows straight into makeOffscreenSurface.

No deterministic repro (production crash on app-store build; the window is a race between snapshot dispatch and view teardown/layout). Not found among existing issues.

Suggested fix

Early-return nullptr when the canvas size is not positive. nullptr already flows into the existing "Failed to make snapshot from view." promise rejection, which callers can handle gracefully:

sk_sp<SkImage> makeImageSnapshot(SkRect *bounds) {
  if (_canvasProvider->getWidth() <= 0 || _canvasProvider->getHeight() <= 0) {
    return nullptr;
  }
  ...

We are running exactly this as a local patch on 2.10.1 and it degrades the crash into the already-handled rejection path. Happy to open a PR if useful.

Environment

• @shopify/react-native-skia: 2.10.1
• react-native: 0.86.0 (new arch), Expo SDK 57
• iOS (observed on iPhone / AGXMetalG18P), production build

[wcandillon]

How can we reproduce the issue?

…

On Tue, Aug 25, 2026 at 11:49 AM SangGyu ***@***.***> wrote: Description We are seeing a production iOS crash (SIGABRT) in RNSkView::makeImageSnapshot. When the Skia view's canvas size is -1 (view not yet laid out, or being detached), the size is passed without validation into the offscreen surface creation, and Metal aborts on texture descriptor validation: failed assertion `Texture Descriptor Validation MTLTextureDescriptor has width (18446744073709551615) greater than the maximum allowed size of 32768. MTLTextureDescriptor has height (18446744073709551615) greater than the maximum allowed size of 32768.' 18446744073709551615 is (uint64)-1, i.e. the unlaid-out canvas size cast to unsigned. Stack trace (symbolicated, production) Metal -[MTLTextureDescriptorInternal validateWithDevice:] (failed assertion → abort) AGXMetalG18P -[AGXTexture initWithDevice:desc:isSuballocDisabled:] NOVA OffscreenRenderContext::OffscreenRenderContext (MetalContext.h:33) NOVA MetalContext::MakeOffscreen (MetalContext.h:51) NOVA RNSkia::RNSkOffscreenCanvasProvider::RNSkOffscreenCanvasProvider (RNSkView.h:77) NOVA RNSkia::RNSkView::makeImageSnapshot (RNSkView.h:207) NOVA lambda in RNSkJsiViewApi.h:241 (makeImageSnapshotAsync main-queue block) libdispatch _dispatch_main_queue_drain Analysis JS calls canvasRef.makeImageSnapshotAsync(). RNSkJsiViewApi dispatches the actual snapshot to the main queue (RNSkJsiViewApi.h:241). Between the JS call and the main-queue block executing, the view's layout state can change (view detached / not yet laid out) — so JS-side guards (checking onLayout completion / mount state before calling) cannot fully prevent this; it is a native-side TOCTOU. RNSkView::makeImageSnapshot (cpp/rnskia/RNSkView.h) constructs RNSkOffscreenCanvasProvider with _canvasProvider->getWidth()/getHeight() without any size validation, so -1 flows straight into makeOffscreenSurface. No deterministic repro (production crash on app-store build; the window is a race between snapshot dispatch and view teardown/layout). Not found among existing issues. Suggested fix Early-return nullptr when the canvas size is not positive. nullptr already flows into the existing "Failed to make snapshot from view." promise rejection, which callers can handle gracefully: sk_sp<SkImage> makeImageSnapshot(SkRect *bounds) { if (_canvasProvider->getWidth() <= 0 || _canvasProvider->getHeight() <= 0) { return nullptr; } ... We are running exactly this as a local patch on 2.10.1 and it degrades the crash into the already-handled rejection path. Happy to open a PR if useful. Environment @shopify/react-native-skia: 2.10.1 react-native: 0.86.0 (new arch), Expo SDK 57 iOS (observed on iPhone / AGXMetalG18P), production build — Reply to this email directly, view it on GitHub or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android.

[woosanggyu]

I was able to reproduce this deterministically on main (commit ccae9b0) with the example app, on an iPhone 16 Pro simulator (iOS 26.5).

Root cause

RNSkMetalCanvasProvider::getWidth()/getHeight() return -1 while _ctx == nullptr. _ctx is only created by setSize(), which is only called from SkiaUIView layoutSubviews. The view is registered (setSkiaView) in willMoveToSuperview, i.e. before the first layoutSubviews. So any snapshot whose main-queue block runs in that window (or after the context was released) reaches RNSkView::makeImageSnapshot with size -1, which is passed unvalidated to makeOffscreenSurface:

ReactTestApp: (Metal) -[MTLTextureDescriptorInternal validateWithDevice:], line 1405:
MTLTextureDescriptor has width (18446744073709551615) greater than the maximum allowed size of 8192.
MTLTextureDescriptor has height (18446744073709551615) greater than the maximum allowed size of 8192.

Metal                       -[MTLTextureDescriptorInternal validateWithDevice:]
MTLSimDriver                -[MTLSimDevice newTextureWithDescriptor:]
ReactTestApp.debug.dylib    OffscreenRenderContext::OffscreenRenderContext        MetalContext.h:33
ReactTestApp.debug.dylib    MetalContext::MakeOffscreen                            MetalContext.h:51
ReactTestApp.debug.dylib    RNSkApplePlatformContext::makeOffscreenSurface        RNSkApplePlatformContext.mm:321
ReactTestApp.debug.dylib    RNSkOffscreenCanvasProvider::RNSkOffscreenCanvasProvider RNSkView.h:77
ReactTestApp.debug.dylib    RNSkView::makeImageSnapshot                            RNSkView.h:207
ReactTestApp.debug.dylib    RNSkJsiViewApi::makeImageSnapshotAsync (main-queue lambda) RNSkJsiViewApi.h:241

Frame-for-frame the same stack as our production crash.

Repro

Mount a Canvas and call makeImageSnapshotAsync() on the next tick, in a loop (remount every ~40 ms). It usually aborts within a few seconds:

const FreshCanvas = () => {
  const ref = useCanvasRef();
  useEffect(() => {
    // registered in willMoveToSuperview, but layoutSubviews may not have run yet -> size == -1
    const t = setTimeout(() => {
      ref.current?.makeImageSnapshotAsync().then(
        (img) => console.log("resolved", img.width(), img.height()),
        (e) => console.log("rejected", e)
      );
    }, 0);
    return () => clearTimeout(t);
  }, []);
  return (
    <Canvas ref={ref} style={{ width: 200, height: 200 }}>
      <Circle cx={100} cy={100} r={80} color="purple" />
    </Canvas>
  );
};

export const Repro = () => {
  const [key, setKey] = useState(0);
  useEffect(() => {
    const iv = setInterval(() => setKey((k) => k + 1), 40);
    return () => clearInterval(iv);
  }, []);
  return <FreshCanvas key={key} />;
};

A second, adjacent crash on the same path

While setting this up I hit a different abort first: when the native view does not exist at all (e.g. the Canvas is under a display: "none" parent, or the snapshot is requested right after commit before Fabric has mounted the view, or after unmount), ViewRegistry::getView() returns nullptr and makeImageSnapshotAsync dereferences it on the main queue (view->makeImageSnapshot(...), RNSkJsiViewApi.h:241) → EXC_BAD_ACCESS at 0x18. The synchronous makeImageSnapshot already checks view != nullptr; the async variant does not.

I'll open a PR that (1) null-checks the view in the async path and (2) returns nullptr from RNSkView::makeImageSnapshot when the canvas size is not positive, so both cases degrade to the existing "Failed to make snapshot from view." rejection. I'll include the repro screen in the example app so it can be used to verify.

[woosanggyu]

Fix in #4030 — includes an example screen that reproduces both crashes on main.