TextField toggle a11y off/on crashes on iOS

[mehmetf]

More artifacts at: b/143568219

Crash observed on iOS 12.4.1 and 13.1. Repros with this simple layout:

MaterialApp(
        home: Scaffold(
            body: Center(
                child: Container(
      color: Colors.white,
      child: TextField(),
    ))));

steps:

1. a11y-focus the TextField and double-tap to bring up the keyboard
2. Tap the TextField again to make sure it has the a11y border around it
3. Toggle voiceover off then on again (I'm using the iOS triple-click shortcut) to get a native EXC_BAD_ACCESS in AccessibilityBridge::textInputView.

[HansMuller]

CC @darrenaustin

[darrenaustin]

I am able to reproduce the problem with the given test and instructions. Needs more investigation, but it looks like a problem in the engine.

Here is the stack trace for future reference:

#0	0x00000001033538c8 in flutter::AccessibilityBridge::textInputView() ()
#1	0x00000001033558b8 in -[TextInputSemanticsObject textInputSurrogate] ()
#2	0x000000010335599c in -[TextInputSemanticsObject accessibilityElementDidLoseFocus] ()

[darrenaustin]

So I think I understand what is going on here. The AccessibilityBridge constructs a mirror SemanticObject tree that it hands to the system for VoiceOver to navigate. When a text field is focused in the semantic tree a TextInputSemanticsObject object is constructed with a weak pointer back to the bridge.

When VoiceOver is turned off the bridge is destroyed and the semantic objects are released. However, it appears that something in the system is still holding onto a reference to the TextInputSemanticsObject, as it isn't dealloc'd at this time. When VoiceOver is turned back on, the system sends a accessibilityElementDidLoseFocus message to the text input object. In response it tries to dereference the weak pointer to the now defunct bridge and it crashes.

Not sure why or what part of the system is holding on to the text input object, as we have shut down the bridge and reset all the accessibility elements on the main view. I can fix this with a guard against the weak reference being dead, but that feels more like a bandaid. I would like to understand why the system is still referencing this after VoiceOver is shutdown and preferably find a way to reset set it completely.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.