)]}'
{
  "commit": "99a98f13425921c8339a4f8d438c0130fe2df355",
  "tree": "fda5627cdea551a4bd9852043f890d51d5e30a36",
  "parents": [
    "d063bd83f71608aa257f6c0fb7906ce5e9e42720"
  ],
  "author": {
    "name": "Chris Bracken",
    "email": "chris@bracken.jp",
    "time": "Wed Jul 29 06:16:35 2026 +0900"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Tue Jul 28 21:16:35 2026 +0000"
  },
  "message": "iOS: Fix use-after-free race during shell teardown (#190132)\n\n-[FlutterEngine waitForFirstFrame:callback:] dispatches a block to a\nQOS_CLASS_BACKGROUND queue that dereferences the `_shell` unique_ptr and\nblocks in `Shell::WaitForFirstFrame()` on Shell-owned\n`waiting_for_first_frame_mutex_`/`waiting_for_first_frame_condition_`.\n\nPreviously, nothing prevented `-destroyContext` from running\nconcurrently on the main thread and calling `_shell.reset()` while that\nbackground block was still running, or hadn\u0027t started yet.\n`Shell::~Shell` only joins the platform/UI/raster/IO task runners. It\nhas no idea a separate GCD thread might be parked (or about to park)\ninside the object, so `_shell.reset()` can free the Shell out from under\nthe block, which then reads and locks/unlocks freed memory.\n\nSpecifically:\n* We dispatch the background block in `-[FlutterEngine\nwaitForFirstFrame:callback:]`, which captures `weakSelf`.\n* Before the block runs, or while it\u0027s blocked on the condition\nvariable, the main thread calls `destroyContext`, which resets `_shell`.\n* The block resolves `strongSelf` which is still valid -- that\u0027s the\nFlutterEngine wrapper, not `_shell`, and calls\n`strongSelf.shell.WaitForFirstFrame(...)` on a Shell that\u0027s already been\nfreed.\n\nThis is reachable via -sendDeepLinkToFramework:completionHandler:, which\ncalls waitForFirstFrame: with a 3s timeout, racing any concurrent\nlifecycle teardown (scene disconnect, view controller dealloc).\n\nThis adds `Shell::CancelWaitForFirstFrame()`, which flips a cancelled\nflag under `waiting_for_first_frame_mutex_` and notifies the condition\nvar, causing any current/upcoming `WaitForFirstFrame()` call to return\n`kAborted` promptly instead of blocking out its timeout. We call this\nbefore resetting the shell in `-destroyContext`, then wait on a\ndispatch_group for that block to actually finish touching `_shell`\nbefore freeing it.\n\nThis is a separate dispatch_group to the one that already blocks the\ncompletion callback, so that concurrent waitForFirstFrame: calls don\u0027t\nhave their callbacks coupled to each other.\n\nThe unit tests was copied (near-)verbatim from repro on the bug.\n\nIssue: b/521830222\n\n\u003c!--\nThanks for filing a pull request!\nReviewers are typically assigned within a week of filing a request.\nTo learn more about code review, see our documentation on Tree Hygiene:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md\n--\u003e\n\n## Pre-launch Checklist\n\n- [X] I read the [Contributor Guide] and followed the process outlined\nthere for submitting PRs.\n- [X] I read the [AI contribution guidelines] and understand my\nresponsibilities, or I am not using AI tools.\n- [X] I read the [Tree Hygiene] wiki page, which explains my\nresponsibilities.\n- [X] I read and followed the [Flutter Style Guide], including [Features\nwe expect every widget to implement].\n- [X] I signed the [CLA].\n- [X] I listed at least one issue that this PR fixes in the description\nabove.\n- [X] I updated/added relevant documentation (doc comments with `///`).\n- [X] I added new tests to check the change I am making, or this PR is\n[test-exempt].\n- [X] I followed the [breaking change policy] and added [Data Driven\nFixes] where supported.\n- [X] All existing and new tests are passing.\n\nIf you need help, consider asking for advice on the #hackers-new channel\non [Discord].\n\nIf this change needs to override an active code freeze, provide a\ncomment explaining why. The code freeze workflow can be overridden by\ncode reviewers. See pinned issues for any active code freezes with\nguidance.\n\n**Note**: The Flutter team is currently trialing the use of [Gemini Code\nAssist for\nGitHub](https://developers.google.com/gemini-code-assist/docs/review-github-code).\nComments from the `gemini-code-assist` bot should not be taken as\nauthoritative feedback from the Flutter team. If you find its comments\nuseful you can update your code accordingly, but if you are unsure or\ndisagree with the feedback, please feel free to wait for a Flutter team\nmember\u0027s review for guidance on which automated comments should be\naddressed.\n\n\u003c!-- Links --\u003e\n[Contributor Guide]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#overview\n[AI contribution guidelines]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#ai-contribution-guidelines\n[Tree Hygiene]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md\n[test-exempt]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#tests\n[Flutter Style Guide]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Style-guide-for-Flutter-repo.md\n[Features we expect every widget to implement]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Style-guide-for-Flutter-repo.md#features-we-expect-every-widget-to-implement\n[CLA]: https://cla.developers.google.com/\n[flutter/tests]: https://github.com/flutter/tests\n[breaking change policy]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#handling-breaking-changes\n[Discord]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Chat.md\n[Data Driven Fixes]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Data-driven-Fixes.md",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2200280ecc4dac18894029ccf503a1e6f8cf9afd",
      "old_mode": 33188,
      "old_path": "engine/src/flutter/shell/common/shell.cc",
      "new_id": "a4414c6cb095353c43c784f314ef63a9369106ed",
      "new_mode": 33188,
      "new_path": "engine/src/flutter/shell/common/shell.cc"
    },
    {
      "type": "modify",
      "old_id": "0eb7248946e99246607869d1054350e8b26fc7f5",
      "old_mode": 33188,
      "old_path": "engine/src/flutter/shell/common/shell.h",
      "new_id": "bc845af79551612d324b830e5d0ca8deaecfc56b",
      "new_mode": 33188,
      "new_path": "engine/src/flutter/shell/common/shell.h"
    },
    {
      "type": "modify",
      "old_id": "56ca523fd0f50e3026707ea13f627336b2575738",
      "old_mode": 33188,
      "old_path": "engine/src/flutter/shell/common/shell_unittests.cc",
      "new_id": "110b4ccbe96403c3d92e0fc9ac1f4718f3324100",
      "new_mode": 33188,
      "new_path": "engine/src/flutter/shell/common/shell_unittests.cc"
    },
    {
      "type": "modify",
      "old_id": "1bf55855a7ff8848d6e63dc3908211b5dffe8cb6",
      "old_mode": 33188,
      "old_path": "engine/src/flutter/shell/platform/darwin/ios/framework/Source/FlutterEngine.mm",
      "new_id": "b07f3c32c4844434f38b0d0b9078ce24b93dba75",
      "new_mode": 33188,
      "new_path": "engine/src/flutter/shell/platform/darwin/ios/framework/Source/FlutterEngine.mm"
    }
  ]
}