Android Fabric crash: null pointer dereference in FabricUIManager::findNextFocusableElement when focusing TextInput inside ScrollView

Description

Description

We are seeing a native Android crash in production while a user interacts with a React Native TextInput inside a scrollable screen using the New Architecture/Fabric.

The crash occurs during Android focus resolution while creating the input connection for ReactEditText.

The relevant stack is:

ReactEditText.onTouchEvent
→ TextView.onCreateInputConnection
→ View.focusSearch
→ ReactScrollView.focusSearch
→ FabricUIManager.findNextFocusableElement
→ ShadowTreeRegistry::enumerate
→ null pointer dereference

Relevant native frames:

#13 facebook::react::ShadowTreeRegistry::enumerate(...)
#14 facebook::react::FabricUIManagerBinding::findNextFocusableElement(int, int, int)
#19 com.facebook.react.fabric.FabricUIManager.findNextFocusableElement
#23 com.facebook.react.views.scroll.ReactScrollView.focusSearch
#26 android.widget.TextView.onCreateInputConnection
#30 com.facebook.react.views.textinput.ReactEditText.onCreateInputConnection

The crash appears to happen when Android attempts to determine the next focusable element while opening/focusing a text input.

Expected behavior

Focusing or tapping a TextInput inside a ScrollView should open the keyboard and update focus normally without crashing the application.

Actual behavior

The application crashes natively with a null pointer dereference inside:

facebook::react::FabricUIManagerBinding::findNextFocusableElement(...)

The crash ultimately reaches:

facebook::react::ShadowTreeRegistry::enumerate(...)

Reproduction

Unfortunately, we have not yet been able to reproduce this consistently on our development devices.

It has been observed from production crash reports and appears to be triggered while:

1. A screen containing a ScrollView is displayed.
2. The user taps/focuses a React Native TextInput.
3. Android creates the input connection.
4. ReactScrollView.focusSearch() calls Fabric's custom focus-search implementation.
5. A native null pointer dereference occurs.

A simplified structure looks similar to:

<KeyboardAwareScrollView>
  <TextInput
    value={value}
    onChangeText={setValue}
  />
</KeyboardAwareScrollView>

We are continuing to investigate whether a more deterministic reproducer can be created.

Possible mitigation

We found that disabling the custom clipped-element focus-search behavior prevents ReactScrollView.focusSearch() from entering this Fabric path:

override fun enableCustomFocusSearchOnClippedElementsAndroid(): Boolean = false

Because this is a native React Native feature flag, it requires a new Android binary and cannot be delivered through an OTA JavaScript update.

We would appreciate guidance on:

• Whether this is a known issue in Fabric focus handling.
• Whether findNextFocusableElement() / ShadowTreeRegistry::enumerate() has a possible race or invalid ShadowTree access.
• Whether disabling enableCustomFocusSearchOnClippedElementsAndroid is the recommended mitigation.
• Whether there is an existing upstream fix or patch we should use instead.

Environment

• Platform: Android
• Architecture: React Native New Architecture / Fabric
• Renderer: Fabric
• Input: React Native TextInput / ReactEditText
• Parent: React Native ScrollView
• ABI: arm64
• React Native version: <add version>
• Android version/device: <add affected versions/devices>
• Hermes: <yes/no>
• Expo: <add version if applicable>

Crash

signal: null pointer dereference

#13 pc ... facebook::react::ShadowTreeRegistry::enumerate(...)
#14 pc ... facebook::react::FabricUIManagerBinding::findNextFocusableElement(int, int, int)
#19 pc ... com.facebook.react.fabric.FabricUIManager.findNextFocusableElement
#23 pc ... com.facebook.react.views.scroll.ReactScrollView.focusSearch
#26 pc ... android.widget.TextView.onCreateInputConnection
#28 pc ... androidx.appcompat.widget.AppCompatEditText.onCreateInputConnection
#30 pc ... com.facebook.react.views.textinput.ReactEditText.onCreateInputConnection
#31 pc ... android.view.inputmethod.InputMethodManager.createInputConnection

We can provide the complete native crash stack if needed.

Steps to reproduce

We are currently unable to reproduce the issue consistently in our development/testing environments.

The crash is being observed in production and appears to happen when a user taps or focuses a TextInput inside a scrollable screen.

Based on production crash data:

~81% of affected devices are Samsung.

~76% of crashes are on Android 16.

~12% are Google devices.

A smaller percentage affects Motorola, OnePlus, and other manufacturers.

The crash occurs while the app is in the foreground, not in the background.

Probable flow:

Open a screen that contains a React Native TextInput inside a ScrollView/KeyboardAwareScrollView.

Tap/focus the input field.

Android starts creating the keyboard input connection.

ReactScrollView.focusSearch() invokes Fabric's findNextFocusableElement().

The app crashes with a native null pointer dereference.

We have tried to reproduce this on our available devices but have not been able to trigger it reliably. At the moment, this is a production-only/intermittent issue based on crash reports.

React Native Version

0.86.2

Affected Platforms

Runtime - Android

Areas

Fabric - The New Renderer

Output of npx @react-native-community/cli info

System:
  OS: macOS 26.6.1
  CPU: (14) arm64 Apple M4 Pro
  Memory: 279.48 MB / 48.00 GB
  Shell:
    version: "5.9"
    path: /bin/zsh
Binaries:
  Node:
    version: 24.16.0
    path: /Users/minhajulislam/.volta/tools/image/node/24.16.0/bin/node
  Yarn:
    version: 4.17.0
    path: /Users/minhajulislam/.volta/tools/image/yarn/4.17.0/bin/yarn
  npm:
    version: 11.13.0
    path: /Users/minhajulislam/.volta/tools/image/node/24.16.0/bin/npm
  Watchman:
    version: 2025.09.08.00
    path: /opt/homebrew/bin/watchman

Stacktrace or Logs

: null pointer dereference
#00 pc 0x529eac (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#01 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#02 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#03 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#04 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#05 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#06 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#07 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#08 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#09 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#10 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#11 pc 0x529f08 (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#12 pc 0x529d0c (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#13 pc 0x4ed280 (facebook::react::ShadowTreeRegistry::enumerate(std::__ndk1::function<void (facebook::react::ShadowTree const&, bool&)> const&) const [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/lib/arm64/libreactnative.so]) (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#14 pc 0x31b9f0 (facebook::react::FabricUIManagerBinding::findNextFocusableElement(int, int, int) [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/lib/arm64/libreactnative.so]) (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#15 pc 0x3258d0 (facebook::jni::detail::MethodWrapper<int (facebook::react::FabricUIManagerBinding::*)(int, int, int), &facebook::react::FabricUIManagerBinding::findNextFocusableElement(int, int, int), facebook::react::FabricUIManagerBinding, int, int, int, int>::dispatch(facebook::jni::alias_ref<facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<facebook::react::FabricUIManagerBinding, facebook::jni::detail::BaseHybridClass>::JavaPart, facebook::jni::JObject, void>::_javaobject*>, int&&, int&&, int&&) [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/lib/arm64/libreactnative.so]) (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#16 pc 0x321a08 (facebook::jni::detail::MethodWrapper<int (facebook::react::FabricUIManagerBinding::*)(int, int, int), &facebook::react::FabricUIManagerBinding::findNextFocusableElement(int, int, int), facebook::react::FabricUIManagerBinding, int, int, int, int>::call(_JNIEnv*, _jobject*, int, int, int) [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/lib/arm64/libreactnative.so]) (BuildId: 8fa1b5b12688b858d4f776861cbd23108c7266fe)
#17 pc 0xdaeb00 (art_jni_trampoline [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#18 pc 0x72b8dc (nterp_helper [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#19 pc 0x3dcbfa (com.facebook.react.fabric.FabricUIManager.findNextFocusableElement [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/base.apk])
#20 pc 0x72b884 (nterp_helper [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#21 pc 0x425c86 (com.facebook.react.views.scroll.k.k [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/base.apk])
#22 pc 0x71dc6c (nterp1_op_invoke_static [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#23 pc 0x427236 (com.facebook.react.views.scroll.ReactScrollView.focusSearch [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/base.apk])
#24 pc 0xaffd28 (android.view.ViewGroup.focusSearch [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#25 pc 0xabb748 (android.view.View.focusSearch [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#26 pc 0xbd9980 (android.widget.TextView.onCreateInputConnection [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#27 pc 0x72b8dc (nterp_helper [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#28 pc 0x2ee42e (androidx.appcompat.widget.AppCompatEditText.onCreateInputConnection [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/base.apk])
#29 pc 0x72b884 (nterp_helper [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#30 pc 0x4347de (com.facebook.react.views.textinput.ReactEditText.onCreateInputConnection [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/base.apk])
#31 pc 0xb93768 (android.view.inputmethod.InputMethodManager.createInputConnection [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#32 pc 0xb96ee8 (android.view.inputmethod.InputMethodManager.startInputInner [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#33 pc 0xb98690 (android.view.inputmethod.InputMethodManager.checkFocus [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#34 pc 0xb9b9bc (android.view.inputmethod.InputMethodManager.viewClicked [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#35 pc 0xbe7d6c (android.widget.TextView.viewClicked [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#36 pc 0xbe06cc (android.widget.TextView.onTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#37 pc 0x72b8dc (nterp_helper [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#38 pc 0x434bbc (com.facebook.react.views.textinput.ReactEditText.onTouchEvent [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/base.apk])
#39 pc 0xab1ce4 (android.view.View.performOnTouchCallback [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#40 pc 0xab8b30 (android.view.View.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#41 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#42 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#43 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#44 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#45 pc 0x72bc18 (nterp_helper [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#46 pc 0x20894c (android.widget.ScrollView.dispatchTouchEvent [/system/framework/framework.jar])
#47 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#48 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#49 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#50 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#51 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#52 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#53 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#54 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#55 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#56 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#57 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#58 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#59 pc 0xb237a4 (com.swmansion.gesturehandler.react.RNGestureHandlerRootView.dispatchTouchEvent [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/oat/arm64/base.odex])
#60 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#61 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#62 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#63 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#64 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#65 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#66 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#67 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#68 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#69 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#70 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#71 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#72 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#73 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#74 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#75 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#76 pc 0xaf75a4 (android.view.ViewGroup.dispatchTransformedTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#77 pc 0xafe924 (android.view.ViewGroup.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#78 pc 0xc8698c (com.android.internal.policy.DecorView.superDispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#79 pc 0xc91960 (com.android.internal.policy.PhoneWindow.superDispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#80 pc 0x5fe8e0 (android.app.Activity.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#81 pc 0x6cc82c (androidx.appcompat.view.i.dispatchTouchEvent [/data/app/~~UbDm_oko5XCsEGh6QhE-8A==/com.fieldnation.android-W1Lv4BvvP0249cUThe7rFw==/oat/arm64/base.odex])
#82 pc 0xc82880 (com.android.internal.policy.DecorView.dispatchTouchEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#83 pc 0xb2804c (android.view.ViewRootImpl$ViewPostImeInputStage.processPointerEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#84 pc 0xb289a8 (android.view.ViewRootImpl$ViewPostImeInputStage.onProcess [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#85 pc 0xb23748 (android.view.ViewRootImpl$InputStage.deliver [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#86 pc 0xb23a00 (android.view.ViewRootImpl$InputStage.onDeliverToNext [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#87 pc 0xb246d8 (android.view.ViewRootImpl$AsyncInputStage.forward [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#88 pc 0xb235e0 (android.view.ViewRootImpl$InputStage.apply [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#89 pc 0xb24598 (android.view.ViewRootImpl$AsyncInputStage.apply [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#90 pc 0xb237c4 (android.view.ViewRootImpl$InputStage.deliver [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#91 pc 0xb23a00 (android.view.ViewRootImpl$InputStage.onDeliverToNext [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#92 pc 0xb2388c (android.view.ViewRootImpl$InputStage.forward [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#93 pc 0xb235e0 (android.view.ViewRootImpl$InputStage.apply [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#94 pc 0xb237c4 (android.view.ViewRootImpl$InputStage.deliver [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#95 pc 0xb2f780 (android.view.ViewRootImpl.deliverInputEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#96 pc 0xb47a84 (android.view.ViewRootImpl.doProcessInputEvents [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#97 pc 0xb48054 (android.view.ViewRootImpl.enqueueInputEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#98 pc 0xb4b4d0 (android.view.ViewRootImpl.processRawInputEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#99 pc 0xb2b8e4 (android.view.ViewRootImpl$WindowInputEventReceiver.onInputEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0100 pc 0xa90560 (android.view.InputEventReceiver.dispatchInputEvent [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0101 pc 0x2aaf94 (art_quick_invoke_stub [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0102 pc 0x2a7ca4 (art::JValue art::InvokeVirtualOrInterfaceWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list) [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0103 pc 0x6781e0 (art::JNI<false>::CallVoidMethodV(_JNIEnv*, _jobject*, _jmethodID*, std::__va_list) [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0104 pc 0x11ad64 (_JNIEnv::CallVoidMethod(_jobject*, _jmethodID*, ...) [/system/lib64/libandroid_runtime.so]) (BuildId: dc3467850a51b32e1af0fff33dbdedeb)
#0105 pc 0x1bc564 (android::NativeInputEventReceiver::consumeEvents(_JNIEnv*, bool, long, bool*) [/system/lib64/libandroid_runtime.so]) (BuildId: dc3467850a51b32e1af0fff33dbdedeb)
#0106 pc 0x1bbf68 (android::NativeInputEventReceiver::handleEvent(int, int, void*) [/system/lib64/libandroid_runtime.so]) (BuildId: dc3467850a51b32e1af0fff33dbdedeb)
#0107 pc 0x1b634 (android::Looper::pollOnce(int, int*, int*, void**) [/system/lib64/libutils.so]) (BuildId: 29f712b5ab6d3c6f02dc53f22005dd7c)
#0108 pc 0x1ee074 (android::android_os_MessageQueue_nativePollOnce(_JNIEnv*, _jobject*, long, int) [/system/lib64/libandroid_runtime.so]) (BuildId: dc3467850a51b32e1af0fff33dbdedeb)
#0109 pc 0xdaeb00 (art_jni_trampoline [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0110 pc 0x9644ac (android.os.MessageQueue.nextLegacy [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0111 pc 0x95a9f8 (android.os.Looper.loopOnce [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0112 pc 0x95a914 (android.os.Looper.loop [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0113 pc 0x65a26c (android.app.ActivityThread.main [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0114 pc 0x2ab260 (art_quick_invoke_static_stub [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0115 pc 0x29c070 (_jobject* art::InvokeMethod<(art::PointerSize)8>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jobject*, _jobject*, unsigned long) [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0116 pc 0x635ed4 (art::Method_invoke(_JNIEnv*, _jobject*, _jobject*, _jobjectArray*) (.__uniq.165753521025965369065708152063621506277) [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0117 pc 0xdafd14 (art_jni_trampoline [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0118 pc 0xc7417c (com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0119 pc 0xc7c4bc (com.android.internal.os.ZygoteInit.main [/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat])
#0120 pc 0x2ab260 (art_quick_invoke_static_stub [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0121 pc 0x2a8b8c (art::JValue art::InvokeWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list) [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0122 pc 0x6a44b4 (art::JNI<true>::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, std::__va_list) [/apex/com.android.art/lib64/libart.so]) (BuildId: cecb684d19b4f44ee3cbd66142c315f4)
#0123 pc 0x129fd4 (_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) [/system/lib64/libandroid_runtime.so]) (BuildId: dc3467850a51b32e1af0fff33dbdedeb)
#0124 pc 0x151744 (android::AndroidRuntime::start(char const*, android::Vector<android::String8> const&, bool) [/system/lib64/libandroid_runtime.so]) (BuildId: dc3467850a51b32e1af0fff33dbdedeb)
#0125 pc 0x459c (main [/system/bin/app_process64]) (BuildId: ef2ab7f05e4968e970850062d5b60aed)
#0126 pc 0x69a24 (__libc_init [/apex/com.android.runtime/lib64/bionic/libc.so]) (BuildId: 0669c520dd58ab0634801cae537d6b06)

MANDATORY Reproducer

https://github.com/minhajul-islam

Screenshots and Videos

No response

Bắt đầu với FabricUIManagerBinding::findNextFocusableElement và ShadowTreeRegistry::enumerate, sau đó lần theo lệnh gọi từ ReactScrollView.focusSearch trong quá trình focus TextInput. So sánh đường dẫn tìm kiếm focus tùy chỉnh với biện pháp giảm thiểu enableCustomFocusSearchOnClippedElementsAndroid đã được ghi nhận và tìm cách tái hiện một cách xác định. Hoàn thành khi ngăn được native null-pointer crash và bổ sung coverage cho luồng focus bị ảnh hưởng, nếu có thể thiết lập một test có thể tái hiện.