Crash When Cancelling Facebook Login After Clearing Safari Data (UIKit Layout Teardown – EXC_BAD_ACCESS)

### Checklist before submitting a bug report

- [x] I've updated to the latest released version of the SDK
- [x] I've searched for existing [GitHub issues](https://github.com/facebook/facebook-ios-sdk/issues)
- [x] I've looked for existing answers on [Stack Overflow](https://facebook.stackoverflow.com), the [Facebook Developer Community Forum](https://developers.facebook.com/community/) and the [Facebook Developers Group](https://www.facebook.com/groups/fbdevelopers)
- [x] I've read the [Code of Conduct](https://github.com/facebook/facebook-ios-sdk/blob/main/CODE_OF_CONDUCT.md)
- [x] This issue is not security related and can safely be disclosed publicly on GitHub

### Xcode version

16.2

### Facebook iOS SDK version

17.0.0

### Dependency Manager

Prebuilt Binaries

### SDK Framework

Login

### Goals

We want to allow users to log in with Facebook using FBSDKLoginManager. If they cancel the login, we expect the UI to dismiss cleanly without crashing. This should work even if Safari website data has been cleared (iOS Settings → Safari → Clear History and Website Data).

### Expected results

When the user cancels Facebook login, the Facebook login UI should be dismissed safely, and the app should receive a cancellation result in the completion block. The app should not crash, and no UIKit or layout errors should occur.

### Actual results

When the user cancels the login flow after clearing Safari data, the app crashes as the Facebook login UI is dismissed. The crash appears to be inside UIKit’s transition or layout engine teardown. This happens consistently even when no app code is executed in the login completion block.

**Crash Stack (symbolicated):**

```
rashed: Isis Main Thread
EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x0000000d8f62aaa0
Crashed: Isis Main Thread
0 libobjc.A.dylib 0x2c1c objc_release_x8 + 16
1 libsystem_blocks.dylib 0x2b74 bool HelperBase::disposeCapture<(HelperBase::BlockCaptureKind)3>(unsigned int, unsigned char*) + 68
2 libsystem_blocks.dylib 0x26dc HelperBase::destroyBlock(Block_layout*, bool, unsigned char*) + 160
3 libsystem_blocks.dylib 0x21c8 _call_dispose_helpers_excp + 72
4 libsystem_blocks.dylib 0x2164 _Block_release + 252
5 libsystem_blocks.dylib 0x202c bool HelperBase::disposeCapture<(HelperBase::BlockCaptureKind)4>(unsigned int, unsigned char*) + 68
6 libsystem_blocks.dylib 0x26f0 HelperBase::destroyBlock(Block_layout*, bool, unsigned char*) + 180
7 libsystem_blocks.dylib 0x21c8 _call_dispose_helpers_excp + 72
8 libsystem_blocks.dylib 0x2164 _Block_release + 252
9 libsystem_blocks.dylib 0x202c bool HelperBase::disposeCapture<(HelperBase::BlockCaptureKind)4>(unsigned int, unsigned char*) + 68
10 libsystem_blocks.dylib 0x26f0 HelperBase::destroyBlock(Block_layout*, bool, unsigned char*) + 180
11 libsystem_blocks.dylib 0x21c8 _call_dispose_helpers_excp + 72
12 libsystem_blocks.dylib 0x2164 _Block_release + 252
13 libsystem_blocks.dylib 0x202c bool HelperBase::disposeCapture<(HelperBase::BlockCaptureKind)4>(unsigned int, unsigned char*) + 68
14 libsystem_blocks.dylib 0x26f0 HelperBase::destroyBlock(Block_layout*, bool, unsigned char*) + 180
15 libsystem_blocks.dylib 0x21c8 _call_dispose_helpers_excp + 72
16 libsystem_blocks.dylib 0x2164 _Block_release + 252
17 CoreFoundation 0x9b68 __RELEASE_OBJECTS_IN_THE_ARRAY__ + 116
18 CoreFoundation 0x9aa4 -[__NSArrayM dealloc] + 148
19 UIKitCore 0x311c74 -[_UIViewControllerTransitionContext _runAlongsideCompletions] + 144
20 UIKitCore 0x311a84 -[_UIViewControllerTransitionContext completeTransition:] + 128
21 UIKitCore 0x3b600c -[UITransitionView notifyDidCompleteTransition:] + 180
22 UIKitCore 0x3b5c90 -[UITransitionView _didCompleteTransition:] + 832
23 UIKitCore 0x90810 __UIVIEW_IS_EXECUTING_ANIMATION_COMPLETION_BLOCK__ + 36
24 UIKitCore 0x906f4 -[UIViewAnimationBlockDelegate _didEndBlockAnimation:finished:context:] + 624
25 UIKitCore 0x8f40c -[UIViewAnimationState sendDelegateAnimationDidStop:finished:] + 436
26 UIKitCore 0x9ca08 -[UIViewAnimationState animationDidStop:finished:] + 192
27 UIKitCore 0x9ca78 -[UIViewAnimationState animationDidStop:finished:] + 304
28 QuartzCore 0x4eb08 run_animation_callbacks(void*) + 132
29 libdispatch.dylib 0x3dd4 _dispatch_client_callout + 20
30 libdispatch.dylib 0x125a4 _dispatch_main_queue_drain + 988
31 libdispatch.dylib 0x121b8 _dispatch_main_queue_callback_4CF + 44
32 CoreFoundation 0x56710 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 16
33 CoreFoundation 0x53914 __CFRunLoopRun + 1996
34 CoreFoundation 0x52cd8 CFRunLoopRunSpecific + 608
35 GraphicsServices 0x11a8 GSEventRunModal + 164
36 UIKitCore 0x40aae8 -[UIApplication _run] + 888
37 UIKitCore 0x4bed98 UIApplicationMain + 340
38 NimbleDemo 0x24034e8 im::CoreMain(int, char**) + 30 (main.mm:30)
39 NimbleDemo 0x52b812c MainGame(int, char const**) + 282 (Main.cpp:282)
40 ??? 0x1c54e3154 (Missing)

```

### Steps to reproduce

Log in to the app using Facebook (FBSDKLoginManager) and allow login.

Background the app.

Go to iOS Settings → Safari → Clear History and Website Data.

Bring the app back to foreground.

When the Facebook login UI appears, tap Cancel.

Crash occurs shortly after the UI is dismissed.

### Code samples & details

```swift
// INSERT YOUR CODE HERE
- (void)login:(NSArray*)permissions handler:(FacebookCallback)handler
{
LOGPUBLICFUNC();
dispatch_async(dispatch_get_main_queue(), ^
{
@synchronized (self)
{
FBSDKLoginConfiguration *configuration = [FBSDKLoginConfiguration alloc];
if([permissions containsObject:@"LIMITED_LOGIN"])
{
NSMutableArray* permissions2 = [NSMutableArray arrayWithArray:permissions];
[permissions2 removeObject:@"LIMITED_LOGIN"];

configuration = [configuration initWithPermissions:permissions2
tracking:FBSDKLoginTrackingLimited
nonce:[NimbleUtility getUTCDateStringFormat:[NSDate date]]];
}
else
{
configuration = [configuration initWithPermissions:permissions
tracking:FBSDKLoginTrackingEnabled];
}
@try {
[m_loginManager logInFromViewController:nil configuration:configuration completion:^(FBSDKLoginManagerLoginResult *result, NSError *error)
{
// This block is empty during testing to isolate crash
}];
}
@catch (NSException *exception) {
NSLog(@"Caught Facebook exception: %@", exception);
}
}
});
}
```