From 1482b4c1d7375a63fa6f229634de717b6560b425 Mon Sep 17 00:00:00 2001 From: Shubham Kumar Savita Date: Thu, 19 Mar 2026 12:21:19 -0700 Subject: [PATCH] Fix null pointer crash in Scheduler::animationTick by adding null check for uiManager_ (#56128) Summary: Pull Request resolved: https://github.com/facebook/react-native/pull/56128 ## Summary Fixes a null pointer dereference crash in `Scheduler::animationTick()` that occurs during shutdown race conditions. ### Root Cause Analysis **The Symptom**: `uiManager_` is null when `Scheduler::animationTick()` is called, causing a crash at offset 0x50 from null when accessing members of `UIManager`. **The Root Cause**: During shutdown, when `uninstallFabricUIManager()` is called, the Choreographer's animation frame callback (`doFrame`) can still arrive. While `FabricUIManagerBinding::driveCxxAnimations()` checks for null scheduler (added in D92986523), the internal `Scheduler::animationTick()` method didn't check if `uiManager_` is valid before dereferencing it: ```cpp void Scheduler::animationTick() const { uiManager_->animationTick(); // No null check - crashes if uiManager_ is null } ``` **The Fix**: Added a null check for `uiManager_` before accessing it, following the same defensive pattern used in `driveCxxAnimations()` and other methods in the codebase: ```cpp void Scheduler::animationTick() const { if (!uiManager_) { return; } uiManager_->animationTick(); } ``` **Why This Fix Works**: It prevents the null pointer dereference by checking `uiManager_` validity before use. During shutdown, if the scheduler is accessed after `uiManager_` becomes invalid, the method will safely return instead of crashing. ### Related Diffs - D92986523: Similar fix for null scheduler check in `driveCxxAnimations()` Logview link: [b3d4c4d8f7e6dd50b09fb7df9a1ad66a](https://www.internalfb.com/logview/system_vros_crashes/b3d4c4d8f7e6dd50b09fb7df9a1ad66a) Reviewed By: cortinico Differential Revision: D93363797 --- .../ReactCommon/react/renderer/scheduler/Scheduler.cpp | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/react-native/ReactCommon/react/renderer/scheduler/Scheduler.cpp b/packages/react-native/ReactCommon/react/renderer/scheduler/Scheduler.cpp index 3a1393ef40b0..12fb1b0ac4b0 100644 --- a/packages/react-native/ReactCommon/react/renderer/scheduler/Scheduler.cpp +++ b/packages/react-native/ReactCommon/react/renderer/scheduler/Scheduler.cpp @@ -271,6 +271,9 @@ SchedulerDelegate* Scheduler::getDelegate() const { #pragma mark - UIManagerAnimationDelegate void Scheduler::animationTick() const { + if (!uiManager_) { + return; + } uiManager_->animationTick(); }