🐛 [iOS 26] SIGABRT on camera teardown — AVCaptureSession dealloc → detachFromFigCaptureSession assert (V5 detach-side of #3730/#3773)

[duc-beluga]

What's happening?

On iOS 26, the app crashes with EXC_CRASH (SIGABRT) when the <Camera> view is torn down (unmounting the screen after capturing a photo). The crash is an AVFoundation assertion fired from -[AVCaptureSession dealloc] running on the main thread inside a CA::Transaction::commit() — the AVCaptureVideoPreviewLayer's deferred release cascades into a session dealloc that asserts in detachFromFigCaptureSession.

This is the detach/teardown side of the race in #3773 (attach side, open). #3730 was the detach side too and was closed as "fixed in V5" — this reproduces on V5 (5.0.10), so the teardown side does not appear fixed. Setting isActive={false} before unmount and delaying the unmount ~240ms both reduce but do not eliminate it.

Reproduceable Code

<Camera> is mounted inside a bottom-sheet/overlay. After capturePhotoToFile resolves, the photo-preview branch renders (so <Camera> unmounts), then the overlay itself unmounts on submit.

const device = useCameraDevice('back');
const photoOutput = usePhotoOutput({ qualityPrioritization: 'speed', containerFormat: 'jpeg' });

<Camera
  style={StyleSheet.absoluteFill}
  device={device}
  outputs={[photoOutput]}     // photo only
  isActive={appForeground && hostOpen}
  onError={...}
/>

Relevant log output

Symbolicated, byte-for-byte identical across 2 TestFlight crash reports:

2   libsystem_c.dylib   abort
3   libsystem_c.dylib   __assert_rtn
4   AVFCapture  -[AVCaptureOutput detachFromFigCaptureSession:]_block_invoke.cold.1 (AVCaptureOutput.m:329)
5   AVFCapture  -[AVCaptureOutput detachFromFigCaptureSession:]_block_invoke (AVCaptureOutput.m:329)
8   AVFCapture  -[AVCaptureOutput detachFromFigCaptureSession:] (AVCaptureOutput.m:325)
9   CoreFoundation  -[NSSet makeObjectsPerformSelector:withObject:]
10  AVFCapture  -[AVCaptureSession _makeConfigurationLive:] (AVCaptureSession.m:4862)
11  AVFCapture  -[AVCaptureSession dealloc] (AVCaptureSession.m:596)
12  AVFCapture  -[AVCaptureVideoPreviewLayer dealloc] (AVCaptureVideoPreviewLayer.m:440)
13  Foundation  _NSKVOPerformWithDeallocatingObservable
14  Foundation  NSKVODeallocate
15  QuartzCore  CA::release_objects(X::List<void const*>*)
16  QuartzCore  CA::Transaction::commit()
17  QuartzCore  CA::Transaction::flush_as_runloop_observer(bool)
18  UIKitCore   _UIApplicationFlushCATransaction

Camera Device

useCameraDevice('back') — the logical multi-cam virtual device.

Device

iPhone 13 Pro Max (iPhone14,3) — multi-physical-camera. #3773 notes the race widens on multi-cam devices (slower CoreMedia XPC commit propagation); consistent here.

VisionCamera Version

5.0.10 · React Native 0.83 · Expo SDK 55 · New Architecture / Nitro · iOS 26.5

Can you reproduce this issue in the VisionCamera Example app?

Not yet tried — happy to attempt a minimal repro if it would help.

Additional information

• HybridCameraSession has no deinit that stops the session / removes I/O before the AVCaptureSession deallocs; teardown is ARC-driven at unmount.
• The pre-V5 graceful-shutdown PRs (feat(shutdown): implement graceful shutdown for camera session #3650 / fix: implement more robust config and tear down bookkeeping #3664) don't port to the Nitro architecture (no CameraView.swift deinit, no HybridCameraSession.deinit).
• Suspected same root cause as Race-condition crash in HybridCameraSession.start() — attach-side sibling of #3730 (iPhone 11, iOS 18.7.7, v5.0.4) #3773: the serial session queue is not synchronized with CoreMedia's async configuration-committed notification, here surfacing on the dealloc/detach path during a CA transaction commit.

[mrousavy]

Thanks, we will try to take a look at this soon. I am not sure if we have reproduced this yet in our apps

[fracico-tech]

I don't know if it can help, but this is my patch file that seems to fix this crash:

diff --git a/ios/Hybrid Objects/HybridCameraSession.swift b/ios/Hybrid Objects/HybridCameraSession.swift
index 01112938b7fe007cafbb12ce909ceb97d9d61009..b18706351848f52eb7057654876217738689402e 100644
--- a/ios/Hybrid Objects/HybridCameraSession.swift	
+++ b/ios/Hybrid Objects/HybridCameraSession.swift	
@@ -29,6 +29,38 @@ final class HybridCameraSession: HybridCameraSessionSpec {
     super.init()
   }
 
+  deinit {
+    // Gracefully tear down the AVCaptureSession before ARC deallocates it.
+    // Without this, the session can be deallocated (e.g. on the main thread
+    // during a CATransaction commit, via AVCaptureVideoPreviewLayer dealloc)
+    // while its inputs/outputs are still attached - AVFoundation then asserts
+    // in `-[AVCaptureOutput detachFromFigCaptureSession:]`, especially when
+    // another CameraSession is concurrently starting up.
+    // Stopping the session and detaching all I/O on the shared serial session
+    // queue serializes teardown against any in-flight configure()/start(),
+    // and leaves the session empty so its eventual dealloc is a no-op.
+    // See https://github.com/mrousavy/react-native-vision-camera/issues/4026
+    // and https://github.com/mrousavy/react-native-vision-camera/issues/3773.
+    let session = self.session
+    Self.queue.async {
+      if session.isRunning {
+        session.stopRunning()
+      }
+      session.beginConfiguration()
+      for connection in session.connections {
+        session.removeConnection(connection)
+      }
+      for output in session.outputs {
+        session.removeOutput(output)
+      }
+      for input in session.inputs {
+        session.removeInput(input)
+      }
+      session.commitConfiguration()
+      logger.info("CameraSession torn down gracefully.")
+    }
+  }
+
   var isRunning: Bool {
     return session.isRunning
   }
diff --git a/ios/Extensions/AVFoundation/AVCaptureInput+isMicrophone.swift b/ios/Extensions/AVFoundation/AVCaptureInput+isMicrophone.swift
--- a/ios/Extensions/AVFoundation/AVCaptureInput+isMicrophone.swift
+++ b/ios/Extensions/AVFoundation/AVCaptureInput+isMicrophone.swift
@@ -10,13 +10,15 @@ import NitroModules

 extension AVCaptureInput {
   var isMicrophone: Bool {
-    guard let self = self as? AVCaptureDeviceInput else {
+    guard let deviceInput = self as? AVCaptureDeviceInput else {
       return false
     }
-    if #available(iOS 17.0, *) {
-      return self.device.deviceType == .microphone
-    } else {
-      return self.device.deviceType == .builtInMicrophone
-    }
+    // Check the device's media type instead of comparing `deviceType` against
+    // `.microphone`: that constant (`AVCaptureDeviceTypeMicrophone`) is an
+    // iOS 17+ weak-linked symbol, and the Swift optimizer hoists its load out
+    // of the `#available(iOS 17.0, *)` branch (out of the `session.inputs`
+    // loop in `HybridCameraSession.updateInputs`). On iOS 16 the symbol
+    // resolves to NULL and dereferencing it crashes with SIGSEGV (0x0).
+    return deviceInput.device.hasMediaType(.audio)
   }
 }