Android Fabric crash: null pointer dereference in FabricUIManager::findNextFocusableElement when focusing TextInput inside ScrollView

Description

Description

We are seeing a native Android crash in production while a user interacts with a React Native TextInput inside a scrollable screen using the New Architecture/Fabric.

The crash occurs during Android focus resolution while creating the input connection for ReactEditText.

The relevant stack is:

ReactEditText.onTouchEvent
→ TextView.onCreateInputConnection
→ View.focusSearch
→ ReactScrollView.focusSearch
→ FabricUIManager.findNextFocusableElement
→ ShadowTreeRegistry::enumerate
→ null pointer dereference

Relevant native frames:

#13 facebook::react::ShadowTreeRegistry::enumerate(...)
#14 facebook::react::FabricUIManagerBinding::findNextFocusableElement(int, int, int)
#19 com.facebook.react.fabric.FabricUIManager.findNextFocusableElement
#23 com.facebook.react.views.scroll.ReactScrollView.focusSearch
#26 android.widget.TextView.onCreateInputConnection
#30 com.facebook.react.views.textinput.ReactEditText.onCreateInputConnection

The crash appears to happen when Android attempts to determine the next focusable element while opening/focusing a text input.

Expected behavior

Focusing or tapping a TextInput inside a ScrollView should open the keyboard and update focus normally without crashing the application.

Actual behavior

The application crashes natively with a null pointer dereference inside:

facebook::react::FabricUIManagerBinding::findNextFocusableElement(...)

The crash ultimately reaches:

facebook::react::ShadowTreeRegistry::enumerate(...)

Reproduction

Unfortunately, we have not yet been able to reproduce this consistently on our development devices.

It has been observed from production crash reports and appears to be triggered while:

1. A screen containing a ScrollView is displayed.
2. The user taps/focuses a React Native TextInput.
3. Android creates the input connection.
4. ReactScrollView.focusSearch() calls Fabric's custom focus-search implementation.
5. A native null pointer dereference occurs.

A simplified structure looks similar to:

<KeyboardAwareScrollView>
  <TextInput
    value={value}
    onChangeText={setValue}
  />
</KeyboardAwareScrollView>

We are continuing to investigate whether a more deterministic reproducer can be created.

Possible mitigation

We found that disabling the custom clipped-element focus-search behavior prevents ReactScrollView.focusSearch() from entering this Fabric path:

override fun enableCustomFocusSearchOnClippedElementsAndroid(): Boolean = false

Because this is a native React Native feature flag, it requires a new Android binary and cannot be delivered through an OTA JavaScript update.

We would appreciate guidance on:

• Whether this is a known issue in Fabric focus handling.
• Whether findNextFocusableElement() / ShadowTreeRegistry::enumerate() has a possible race or invalid ShadowTree access.
• Whether disabling enableCustomFocusSearchOnClippedElementsAndroid is the recommended mitigation.
• Whether there is an existing upstream fix or patch we should use instead.

Environment

• Platform: Android
• Architecture: React Native New Architecture / Fabric
• Renderer: Fabric
• Input: React Native TextInput / ReactEditText
• Parent: React Native ScrollView
• ABI: arm64
• React Native version: <add version>
• Android version/device: <add affected versions/devices>
• Hermes: <yes/no>
• Expo: <add version if applicable>

Crash

signal: null pointer dereference

#13 pc ... facebook::react::ShadowTreeRegistry::enumerate(...)
#14 pc ... facebook::react::FabricUIManagerBinding::findNextFocusableElement(int, int, int)
#19 pc ... com.facebook.react.fabric.FabricUIManager.findNextFocusableElement
#23 pc ... com.facebook.react.views.scroll.ReactScrollView.focusSearch
#26 pc ... android.widget.TextView.onCreateInputConnection
#28 pc ... androidx.appcompat.widget.AppCompatEditText.onCreateInputConnection
#30 pc ... com.facebook.react.views.textinput.ReactEditText.onCreateInputConnection
#31 pc ... android.view.inputmethod.InputMethodManager.createInputConnection

We can provide the complete native crash stack if needed.

Steps to reproduce

We are currently unable to reproduce the issue consistently in our development/testing environments.

The crash is being observed in production and appears to happen when a user taps or focuses a TextInput inside a scrollable screen.

Based on production crash data:

~81% of affected devices are Samsung.

~76% of crashes are on Android 16.

~12% are Google devices.

A smaller percentage affects Motorola, OnePlus, and other manufacturers.

The crash occurs while the app is in the foreground, not in the background.

Probable flow:

Open a screen that contains a React Native TextInput inside a ScrollView/KeyboardAwareScrollView.

Tap/focus the input field.

Android starts creating the keyboard input connection.

ReactScrollView.focusSearch() invokes Fabric's findNextFocusableElement().

The app crashes with a native null pointer dereference.

We have tried to reproduce this on our available devices but have not been able to trigger it reliably. At the moment, this is a production-only/intermittent issue based on crash reports.

React Native Version

0.86.2

Affected Platforms

Runtime - Android

Areas

Fabric - The New Renderer

Output of npx @react-native-community/cli info

System:
  OS: macOS 26.6.1
  CPU: (14) arm64 Apple M4 Pro
  Memory: 279.48 MB / 48.00 GB
  Shell:
    version: "5.9"
    path: /bin/zsh
Binaries:
  Node:
    version: 24.16.0
    path: /Users/minhajulislam/.volta/tools/image/node/24.16.0/bin/node
  Yarn:
    version: 4.17.0
    path: /Users/minhajulislam/.volta/tools/image/yarn/4.17.0/bin/yarn
  npm:
    version: 11.13.0
    path: /Users/minhajulislam/.volta/tools/image/node/24.16.0/bin/npm
  Watchman:
    version: 2025.09.08.00
    path: /opt/homebrew/bin/watchman

Stacktrace or Logs

: null pointer dereference
#00 pc 0x529eac (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#01 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#02 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#03 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#04 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#05 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#06 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#07 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#08 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#09 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#10 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#11 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#12 pc 0x529d0c (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#13 pc 0x4ed280 (facebook::react::ShadowTreeRegistry::enumerate(std::__ndk1::function<void (facebook::react::ShadowTree const&, bool&)> const&) const [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/lib/arm64/libreactnative.so]) (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#14 pc 0x31b9f0 (facebook::react::FabricUIManagerBinding::findNextFocusableElement(int, int, int) [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/lib/arm64/libreactnative.so]) (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#15 pc 0x3258d0 (facebook::jni::detail::MethodWrapper<int (facebook::react::FabricUIManagerBinding::*)(int, int, int), &facebook::react::FabricUIManagerBinding::findNextFocusableElement(int, int, int), facebook::react::FabricUIManagerBinding, int, int, int, int>::dispatch(facebook::jni::alias_ref<facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<facebook::react::FabricUIManagerBinding, facebook::jni::detail::BaseHybridClass>::JavaPart, facebook::jni::JObject, void>::_javaobject*>, int&&, int&&, int&&) [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/lib/arm64/libreactnative.so]) (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#16 pc 0x321a08 (facebook::jni::detail::MethodWrapper<int (facebook::react::FabricUIManagerBinding::*)(int, int, int), &facebook::react::FabricUIManagerBinding::findNextFocusableElement(int, int, int), facebook::react::FabricUIManagerBinding, int, int, int, int>::call(_JNIEnv*, _jobject*, int, int, int) [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/lib/arm64/libreactnative.so]) (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#17 pc 0xdaeb00 (art_jni_trampoline [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#18 pc 0x72b8dc (nterp_helper [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#19 pc 0x3dcbfa (com.facebook.react.fabric.FabricUIManager.findNextFocusableElement [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/base.apk])
#20 pc 0x72b884 (nterp_helper [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#21 pc 0x425c86 (com.facebook.react.views.scroll.k.k [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/base.apk])
#22 pc 0x71dc6c (nterp1_op_invoke_static [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#23 pc 0x427236 (com.facebook.react.views.scroll.ReactScrollView.focusSearch [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/base.apk])
#24 pc 0xaffd28 (android.view.ViewGroup.focusSearch [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#25 pc 0xabb748 (android.view.View.focusSearch [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#26 pc 0xbd9980 (android.widget.TextView.onCreateInputConnection [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#27 pc 0x72b8dc (nterp_helper [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#28 pc 0x2ee42e (androidx.appcompat.widget.AppCompatEditText.onCreateInputConnection [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/base.apk])
#29 pc 0x72b884 (nterp_helper [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#30 pc 0x4347de (com.facebook.react.views.textinput.ReactEditText.onCreateInputConnection [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/base.apk])
#31 pc 0xb93768 (android.view.inputmethod.InputMethodManager.createInputConnection [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#32 pc 0xb96ee8 (android.view.inputmethod.InputMethodManager.startInputInner [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#33 pc 0xb98690 (android.view.inputmethod.InputMethodManager.checkFocus [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#34 pc 0xb9b9bc (android.view.inputmethod.InputMethodManager.viewClicked [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#35 pc 0xbe7d6c (android.widget.TextView.viewClicked [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#36 pc 0xbe06cc (android.widget.TextView.onTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#37 pc 0x72b8dc (nterp_helper [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#38 pc 0x434bbc (com.facebook.react.views.textinput.ReactEditText.onTouchEvent [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/base.apk])
#39 pc 0xab1ce4 (android.view.View.performOnTouchCallback [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#40 pc 0xab8b30 (android.view.View.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#41 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#42 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#43 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#44 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#45 pc 0x72bc18 (nterp_helper [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#46 pc 0x20894c (android.widget.ScrollView.dispatchTouchEvent [/system/framework/framework.jar])
#47 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#48 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#49 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#50 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#51 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#52 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#53 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#54 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#55 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#56 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#57 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#58 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#59 pc 0xb237a4 (com.swmansion.gesturehandler.react.RNGestureHandlerRootView.dispatchTouchEvent [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/oat/arm64/base.odex])
#60 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#61 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#62 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#63 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#64 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#65 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#66 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#67 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#68 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#69 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#70 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#71 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#72 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#73 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#74 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#75 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#76 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#77 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#78 pc 0xc8698c (com.android.internal.policy.DecorView.superDispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#79 pc 0xc91960 (com.android.internal.policy.PhoneWindow.superDispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#80 pc 0x5fe8e0 (android.app.Activity.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#81 pc 0x6cc82c (androidx.appcompat.view.i.dispatchTouchEvent [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/oat/arm64/base.odex])
#82 pc 0xc82880 (com.android.internal.policy.DecorView.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#83 pc 0xb2804c (android.view.ViewRootImpl$ViewPostImeInputStage.processPointerEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#84 pc 0xb289a8 (android.view.ViewRootImpl$ViewPostImeInputStage.onProcess [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#85 pc 0xb23748 (android.view.ViewRootImpl$InputStage.deliver [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#86 pc 0xb23a00 (android.view.ViewRootImpl$InputStage.onDeliverToNext [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#87 pc 0xb246d8 (android.view.ViewRootImpl$AsyncInputStage.forward [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#88 pc 0xb235e0 (android.view.ViewRootImpl$InputStage.apply [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#89 pc 0xb24598 (android.view.ViewRootImpl$AsyncInputStage.apply [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#90 pc 0xb237c4 (android.view.ViewRootImpl$InputStage.deliver [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#91 pc 0xb23a00 (android.view.ViewRootImpl$InputStage.onDeliverToNext [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#92 pc 0xb2388c (android.view.ViewRootImpl$InputStage.forward [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#93 pc 0xb235e0 (android.view.ViewRootImpl$InputStage.apply [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#94 pc 0xb237c4 (android.view.ViewRootImpl$InputStage.deliver [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#95 pc 0xb2f780 (android.view.ViewRootImpl.deliverInputEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#96 pc 0xb47a84 (android.view.ViewRootImpl.doProcessInputEvents [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#97 pc 0xb48054 (android.view.ViewRootImpl.enqueueInputEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#98 pc 0xb4b4d0 (android.view.ViewRootImpl.processRawInputEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#99 pc 0xb2b8e4 (android.view.ViewRootImpl$WindowInputEventReceiver.onInputEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0100 pc 0xa90560 (android.view.InputEventReceiver.dispatchInputEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0101 pc 0x2aaf94 (art_quick_invoke_stub [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0102 pc 0x2a7ca4 (art::JValue art::InvokeVirtualOrInterfaceWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list) [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0103 pc 0x6781e0 (art::JNI<false>::CallVoidMethodV(_JNIEnv*, _jobject*, _jmethodID*, std::__va_list) [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0104 pc 0x11ad64 (_JNIEnv::CallVoidMethod(_jobject*, _jmethodID*, ...) [/system/lib64/libandroid_runtime.so]) (BuildId: dc3467850a51b32e1af0fff33dbdedeb)
#0105 pc 0x1bc564 (android::NativeInputEventReceiver::consumeEvents(_JNIEnv*, bool, long, bool*) [/system/lib64/libandroid_runtime.so]) (BuildId: dc3467850a51b32e1af0fff33dbdedeb)
#0106 pc 0x1bbf68 (android::NativeInputEventReceiver::handleEvent(int, int, void*) [/system/lib64/libandroid_runtime.so]) (BuildId: dc3467850a51b32e1af0fff33dbdedeb)
#0107 pc 0x1b634 (android::Looper::pollOnce(int, int*, int*, void**) [/system/lib64/libutils.so]) (BuildId: 29f712b5ab6d3c6f02dc53f22005dd7c)
#0108 pc 0x1ee074 (android::android_os_MessageQueue_nativePollOnce(_JNIEnv*, _jobject*, long, int) [/system/lib64/libandroid_runtime.so]) (BuildId: dc3467850a51b32e1af0fff33dbdedeb)
#0109 pc 0xdaeb00 (art_jni_trampoline [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0110 pc 0x9644ac (android.os.MessageQueue.nextLegacy [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0111 pc 0x95a9f8 (android.os.Looper.loopOnce [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0112 pc 0x95a914 (android.os.Looper.loop [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0113 pc 0x65a26c (android.app.ActivityThread.main [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0114 pc 0x2ab260 (art_quick_invoke_static_stub [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0115 pc 0x29c070 (_jobject* art::InvokeMethod<(art::PointerSize)8>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jobject*, _jobject*, unsigned long) [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0116 pc 0x635ed4 (art::Method_invoke(_JNIEnv*, _jobject*, _jobject*, _jobjectArray*) (.__uniq.165753521025965369065708152063621506277) [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0117 pc 0xdafd14 (art_jni_trampoline [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0118 pc 0xc7417c (com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0119 pc 0xc7c4bc (com.android.internal.os.ZygoteInit.main [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0120 pc 0x2ab260 (art_quick_invoke_static_stub [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0121 pc 0x2a8b8c (art::JValue art::InvokeWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list) [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0122 pc 0x6a44b4 (art::JNI<true>::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, std::__va_list) [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0123 pc 0x129fd4 (_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) [/system/lib64/libandroid_runtime.so]) (BuildId: dc3467850a51b32e1af0fff33dbdedeb)
#0124 pc 0x151744 (android::AndroidRuntime::start(char const*, android::Vector<android::String8> const&, bool) [/system/lib64/libandroid_runtime.so]) (BuildId: dc3467850a51b32e1af0fff33dbdedeb)
#0125 pc 0x459c (main [/system/bin/app_process64]) (BuildId: ef2ab7f05e4968e970850062d5b60aed)
#0126 pc 0x69a24 (__libc_init [/apex/com.android.runtime/lib64/bionic/libc.so]) (BuildId: 0669c520dd58ab0634801cae537d6b06)

MANDATORY Reproducer

https://github.com/minhajul-islam

Screenshots and Videos

No response

Commencez par FabricUIManagerBinding::findNextFocusableElement et ShadowTreeRegistry::enumerate, puis suivez l'appel depuis ReactScrollView.focusSearch lors du focus de TextInput. Comparez le chemin personnalisé de recherche de focus avec l'atténuation documentée enableCustomFocusSearchOnClippedElementsAndroid et cherchez à obtenir une reproduction déterministe. Le travail est considéré comme terminé lorsque le crash natif dû à un pointeur nul est empêché et qu'une couverture est ajoutée pour le flux de focus concerné, si un test reproductible peut être établi.