SIGSEGV from JSI in Frame Processor/Worklet during unmount or reload

[eebirke]

What happened?

When a Nitro Module is running from a worklet as a frame processor, reloading with fast refresh or unmounting the Camera component often results in the JSI translation of the return value causing a SIGSEGV crash.

Reproducing the crash is difficult to do consistently by remounting the camera, but refreshing from Metro seems to work pretty consistently with similar looking crash logs.

I first noticed it from a high (8-9 %) crash rate on Android. The custom OCR Nitro module we use works synchronously, and the frame processing takes enough time for this bug to appear regularly.

The crash dumps generally include calls involving the jsi runtime, decltype and generally the code translating the return values to JS values.

Not sure where this issue fits best; in Nitro or Vision Camera, it happens in the Nitro module in the interaction between the two. I made a separate reproduction repo linked below, as I'm not sure how to best integrate the reproduction in any of the relevant repos.

Reproduction repo: https://github.com/eebirke/nitro-modules-error-repro

Reproduceable Code

Nitro module:

class HybridExample : HybridExampleSpec() {
  override fun delayedReturn(): String {
    Thread.sleep(1000)
    return "test"
  }
}

RN + Vision camera code

const nitroExample = NitroModules.createHybridObject<Example>("Example");

const exampleWorklet = (frame: Frame) => {
  "worklet";
  console.log(nitroExample.delayedReturn());
  frame.dispose();
};

// Repeatedly remounting this / metro refresh can provoke the crash 
function NitroComponent() {
  const device = useCameraDevice("back");
  const frameOutput = useFrameOutput({
    onFrame: exampleWorklet,
    pixelFormat: "yuv",
  });
  if (!device) {
    return null;
  }

  return (
    <Camera
      device={device}
      isActive={true}
      outputs={[frameOutput]}
      style={{ width: 200, height: 200 }}
    />
  );
}

Relevant log output

Android crash backtrace

2026-09-08 15:53:16.148 31459-31459 DEBUG                   crash_dump64                         A  *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2026-09-08 15:53:16.148 31459-31459 DEBUG                   crash_dump64                         A  Build fingerprint: 'samsung/a32eea/a32:13/TP1A.220624.014/A325FXXSCDYB2:user/release-keys'
2026-09-08 15:53:16.148 31459-31459 DEBUG                   crash_dump64                         A  Revision: '4'
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A  ABI: 'arm64'
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A  Processor: '7'
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A  Timestamp: 2026-09-08 15:53:15.625707967+0200
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A  Process uptime: 42s
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A  Cmdline: com.anonymous.nitromoduleserrorrepro
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A  pid: 29567, tid: 31358, name: lo.camera.frame  >>> com.anonymous.nitromoduleserrorrepro <<<
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A  uid: 10321
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A  signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000006a07400058
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A      x0  b400006b8e343b00  x1  0000006ea4eed1a9  x2  0000000000000004  x3  0000000000000000
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A      x4  0000000000000000  x5  0000000000000001  x6  0000000000000002  x7  0000000000000002
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A      x8  0000006ea4eecf10  x9  0000007b30e93000  x10 0000006a07400000  x11 0000006ea4eecf20
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A      x12 0000006ea4eecfa0  x13 0000006ea4eed1a9  x14 0000000000157fd8  x15 0000000000000004
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A      x16 0000007b330d73f8  x17 0000007b3300bd28  x18 0000006a04ae0000  x19 0000006ea4eed1c0
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A      x20 b400006b8e343b00  x21 0000006ea4ef1000  x22 0000006ea4ef1000  x23 0000006ea4eecfb0
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A      x24 0000006ea4ef1000  x25 0000006ea4eed928  x26 0000000000000000  x27 b40000781d7f7f80
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A      x28 b40000781d7f7e41  x29 0000006ea4eecff0
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A      lr  0000007b3300bd70  sp  0000006ea4eecf10  pc  0000007b30f3ee38  pst 0000000060000000
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A  backtrace:
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #00 pc 00000000000e5e38  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libhermesvm.so (BuildId: ad8f6a3c901d0e6d9eab8b2c375d703499481521)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #01 pc 000000000039fd6c  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (facebook::jsi::RuntimeDecorator<facebook::jsi::Runtime, facebook::jsi::Runtime>::createStringFromUtf8(unsigned char const*, unsigned long)+68) (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #02 pc 000000000039a958  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (facebook::jsi::WithRuntimeDecorator<worklets::WorkletsReentrancyCheck, facebook::jsi::Runtime, facebook::jsi::Runtime>::createStringFromUtf8(unsigned char const*, unsigned long)+80) (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #03 pc 000000000039fd6c  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (facebook::jsi::RuntimeDecorator<facebook::jsi::Runtime, facebook::jsi::Runtime>::createStringFromUtf8(unsigned char const*, unsigned long)+68) (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #04 pc 00000000003b40d8  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (facebook::jsi::WithRuntimeDecorator<worklets::AroundLock, facebook::jsi::Runtime, facebook::jsi::Runtime>::createStringFromUtf8(unsigned char const*, unsigned long)+80) (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #05 pc 0000000000016d20  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libNitroReproModule.so (_ZN7margelo5nitro14HybridFunction10callMethodINS0_11repromodule17HybridExampleSpecENSt6__ndk112basic_stringIcNS5_11char_traitsIcEENS5_9allocatorIcEEEEJETpTnmJEEEN8facebook3jsi5ValueEPT_MSF_FT0_DpT1_ERNSD_7RuntimeEPKSE_mNS5_16integer_sequenceImJXspT2_EEEE+128) (BuildId: f1e9f8dd26d43a4ec6c46057ebe7e200f32429e2)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #06 pc 0000000000015ae4  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libNitroReproModule.so (margelo::nitro::HybridFunction margelo::nitro::HybridFunction::createHybridFunction<margelo::nitro::repromodule::HybridExampleSpec, std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > >(std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > const&, std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > (margelo::nitro::repromodule::HybridExampleSpec::*)(), margelo::nitro::FunctionKind)::'lambda'(facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)::operator()(facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long) const+116) (BuildId: f1e9f8dd26d43a4ec6c46057ebe7e200f32429e2)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #07 pc 00000000002647f4  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #08 pc 000000000026473c  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #09 pc 00000000003a601c  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (facebook::jsi::DecoratedHostFunction::operator()(facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)+96) (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #10 pc 00000000003a5f90  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #11 pc 00000000003a5ebc  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (facebook::jsi::Value std::__ndk1::__invoke_void_return_wrapper<facebook::jsi::Value, false>::__call[abi:ne180000]<facebook::jsi::DecoratedHostFunction&, facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long>(facebook::jsi::DecoratedHostFunction&, facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*&&, unsigned long&&)+72) (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #12 pc 00000000003a5e48  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #13 pc 00000000003a44c4  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #14 pc 00000000002647f4  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.149 31459-31459 DEBUG                   crash_dump64                         A        #15 pc 000000000026473c  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #16 pc 00000000003a601c  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (facebook::jsi::DecoratedHostFunction::operator()(facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)+96) (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #17 pc 00000000003a5f90  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #18 pc 00000000003a5ebc  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (facebook::jsi::Value std::__ndk1::__invoke_void_return_wrapper<facebook::jsi::Value, false>::__call[abi:ne180000]<facebook::jsi::DecoratedHostFunction&, facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long>(facebook::jsi::DecoratedHostFunction&, facebook::jsi::Runtime&, facebook::jsi::Value const&, facebook::jsi::Value const*&&, unsigned long&&)+72) (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #19 pc 00000000003a5e48  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #20 pc 00000000003a44c4  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #21 pc 00000000000f5fbc  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libhermesvm.so (BuildId: ad8f6a3c901d0e6d9eab8b2c375d703499481521)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #22 pc 0000000000275cd8  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libhermesvm.so (BuildId: ad8f6a3c901d0e6d9eab8b2c375d703499481521)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #23 pc 000000000027d060  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libhermesvm.so (BuildId: ad8f6a3c901d0e6d9eab8b2c375d703499481521)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #24 pc 0000000000275e64  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libhermesvm.so (BuildId: ad8f6a3c901d0e6d9eab8b2c375d703499481521)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #25 pc 000000000025b630  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libhermesvm.so (BuildId: ad8f6a3c901d0e6d9eab8b2c375d703499481521)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #26 pc 000000000025a754  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libhermesvm.so (BuildId: ad8f6a3c901d0e6d9eab8b2c375d703499481521)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #27 pc 0000000000275d20  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libhermesvm.so (BuildId: ad8f6a3c901d0e6d9eab8b2c375d703499481521)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #28 pc 000000000027d060  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libhermesvm.so (BuildId: ad8f6a3c901d0e6d9eab8b2c375d703499481521)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #29 pc 0000000000275e64  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libhermesvm.so (BuildId: ad8f6a3c901d0e6d9eab8b2c375d703499481521)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #30 pc 000000000025b630  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libhermesvm.so (BuildId: ad8f6a3c901d0e6d9eab8b2c375d703499481521)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #31 pc 00000000000ea838  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libhermesvm.so (BuildId: ad8f6a3c901d0e6d9eab8b2c375d703499481521)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #32 pc 00000000003a1374  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (facebook::jsi::RuntimeDecorator<facebook::jsi::Runtime, facebook::jsi::Runtime>::call(facebook::jsi::Function const&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)+84) (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #33 pc 000000000039ccbc  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (facebook::jsi::WithRuntimeDecorator<worklets::WorkletsReentrancyCheck, facebook::jsi::Runtime, facebook::jsi::Runtime>::call(facebook::jsi::Function const&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)+96) (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #34 pc 00000000003a1374  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (facebook::jsi::RuntimeDecorator<facebook::jsi::Runtime, facebook::jsi::Runtime>::call(facebook::jsi::Function const&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)+84) (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #35 pc 00000000003b643c  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libworklets.so (facebook::jsi::WithRuntimeDecorator<worklets::AroundLock, facebook::jsi::Runtime, facebook::jsi::Runtime>::call(facebook::jsi::Function const&, facebook::jsi::Value const&, facebook::jsi::Value const*, unsigned long)+96) (BuildId: 6b22801fe792f0965d539555d779b7fa9d4eb813)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #36 pc 00000000004d651c  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libVisionCamera.so (margelo::nitro::SyncJSCallback<bool (std::__ndk1::shared_ptr<margelo::nitro::camera::HybridFrameSpec> const&)>::call(std::__ndk1::shared_ptr<margelo::nitro::camera::HybridFrameSpec> const&) const+140) (BuildId: 3d45f1435562bcefb305e066dacc273087be112b)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #37 pc 00000000003dc3bc  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libVisionCamera.so (margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec__cxx::invoke_cxx(facebook::jni::alias_ref<margelo::nitro::camera::JHybridFrameSpec::JavaPart>)+100) (BuildId: 3d45f1435562bcefb305e066dacc273087be112b)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #38 pc 00000000003dc588  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libVisionCamera.so (facebook::jni::detail::MethodWrapper<unsigned char (margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec__cxx::*)(facebook::jni::alias_ref<margelo::nitro::camera::JHybridFrameSpec::JavaPart>), &(margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec__cxx::invoke_cxx(facebook::jni::alias_ref<margelo::nitro::camera::JHybridFrameSpec::JavaPart>)), margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec__cxx, unsigned char, facebook::jni::alias_ref<margelo::nitro::camera::JHybridFrameSpec::JavaPart> >::dispatch(facebook::jni::alias_ref<facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec__cxx, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_>::JavaPart, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_, void>::_javaobject*>, facebook::jni::alias_ref<margelo::nitro::camera::JHybridFrameSpec::JavaPart>&&)+48) (BuildId: 3d45f1435562bcefb305e066dacc273087be112b)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #39 pc 00000000003dc78c  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libVisionCamera.so (facebook::jni::detail::CallWithJniConversions<unsigned char (*)(facebook::jni::alias_ref<facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec__cxx, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_>::JavaPart, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_, void>::_javaobject*>, facebook::jni::alias_ref<margelo::nitro::camera::JHybridFrameSpec::JavaPart>&&), unsigned char, facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec__cxx, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_>::JavaPart, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_, void>::_javaobject*, facebook::jni::alias_ref<margelo::nitro::camera::JHybridFrameSpec::JavaPart> >::call(facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec__cxx, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_>::JavaPart, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_, void>::_javaobject*, facebook::jni::detail::JTypeFor<margelo::nitro::camera::JHybridFrameSpec::JavaPart, margelo::nitro::JHybridObject::JavaPart, void>::_javaobject*, unsigned char (*)(facebook::jni::alias_ref<facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec__cxx, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_>::JavaPart, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_, void>::_javaobject*>, facebook::jni::alias_ref<margelo::nitro::camera::JHybridFrameSpec::JavaPart>&&))+120) (BuildId: 3d45f1435562bcefb305e066dacc273087be112b)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #40 pc 00000000003dc4d4  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/base.apk!libVisionCamera.so (facebook::jni::detail::FunctionWrapper<unsigned char (*)(facebook::jni::alias_ref<facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec__cxx, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_>::JavaPart, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_, void>::_javaobject*>, facebook::jni::alias_ref<margelo::nitro::camera::JHybridFrameSpec::JavaPart>&&), facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec__cxx, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_>::JavaPart, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_, void>::_javaobject*, unsigned char, facebook::jni::alias_ref<margelo::nitro::camera::JHybridFrameSpec::JavaPart> >::call(_JNIEnv*, _jobject*, facebook::jni::detail::JTypeFor<margelo::nitro::camera::JHybridFrameSpec::JavaPart, margelo::nitro::JHybridObject::JavaPart, void>::_javaobject*, unsigned char (*)(facebook::jni::alias_ref<facebook::jni::detail::JTypeFor<facebook::jni::HybridClass<margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec__cxx, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_>::JavaPart, margelo::nitro::camera::JFunc_bool_std__shared_ptr_HybridFrameSpec_, void>::_javaobject*>, facebook::jni::alias_ref<margelo::nitro::camera::JHybridFrameSpec::JavaPart>&&))+68) (BuildId: 3d45f1435562bcefb305e066dacc273087be112b)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #41 pc 00000000002c2100  /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+144) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #42 pc 00000000002aad94  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #43 pc 0000000000586548  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+2688) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #44 pc 0000000000490b64  /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<false>(art::interpreter::SwitchImplContext*)+468) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #45 pc 00000000003d12b8  /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #46 pc 00000000010e1054  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/oat/arm64/base.vdex (com.margelo.nitro.camera.Func_bool_std__shared_ptr_HybridFrameSpec__cxx.invoke+0)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #47 pc 00000000003d1e84  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+448) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #48 pc 0000000000586938  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+3696) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #49 pc 0000000000490f5c  /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<false>(art::interpreter::SwitchImplContext*)+1484) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #50 pc 00000000003d12b8  /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.150 31459-31459 DEBUG                   crash_dump64                         A        #51 pc 00000000010e1080  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/oat/arm64/base.vdex (com.margelo.nitro.camera.Func_bool_std__shared_ptr_HybridFrameSpec__cxx.invoke+0)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #52 pc 00000000003d1e84  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+448) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #53 pc 0000000000586938  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+3696) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #54 pc 0000000000491124  /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<false>(art::interpreter::SwitchImplContext*)+1940) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #55 pc 00000000003d12b8  /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #56 pc 0000000000fbd278  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/oat/arm64/base.vdex (com.margelo.nitro.camera.hybrids.outputs.HybridFrameOutput.updateAnalyzer$lambda$4+0)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #57 pc 00000000003d1e84  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+448) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #58 pc 0000000000586938  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+3696) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #59 pc 0000000000490b64  /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<false>(art::interpreter::SwitchImplContext*)+468) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #60 pc 00000000003d12b8  /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #61 pc 0000000000fbd0e8  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/oat/arm64/base.vdex (com.margelo.nitro.camera.hybrids.outputs.HybridFrameOutput.$r8$lambda$QOZf64jbb5nHd86DibBg2YZlTZo+0)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #62 pc 00000000003d1e84  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+448) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #63 pc 0000000000586938  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+3696) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #64 pc 0000000000490b64  /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<false>(art::interpreter::SwitchImplContext*)+468) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #65 pc 00000000003d12b8  /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #66 pc 0000000000fbcd58  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/oat/arm64/base.vdex (com.margelo.nitro.camera.hybrids.outputs.HybridFrameOutput$$ExternalSyntheticLambda3.analyze+0)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #67 pc 00000000003d1e84  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+448) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #68 pc 0000000000586938  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+3696) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #69 pc 0000000000491124  /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<false>(art::interpreter::SwitchImplContext*)+1940) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #70 pc 00000000003d12b8  /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #71 pc 00000000002b8790  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/oat/arm64/base.vdex (androidx.camera.core.ImageAnalysis.lambda$setAnalyzer$3+0)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #72 pc 00000000003d1e84  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+448) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #73 pc 0000000000586938  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+3696) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #74 pc 0000000000490b64  /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<false>(art::interpreter::SwitchImplContext*)+468) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #75 pc 00000000003d12b8  /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #76 pc 00000000002b5f94  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/oat/arm64/base.vdex (androidx.camera.core.ImageAnalysis$$ExternalSyntheticLambda4.analyze+0)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #77 pc 00000000003d1e84  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+448) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #78 pc 0000000000586938  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+3696) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #79 pc 0000000000491124  /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<false>(art::interpreter::SwitchImplContext*)+1940) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #80 pc 00000000003d12b8  /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #81 pc 00000000002b72e8  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/oat/arm64/base.vdex (androidx.camera.core.ImageAnalysisAbstractAnalyzer.lambda$analyzeImage$0$androidx-camera-core-ImageAnalysisAbstractAnalyzer+0)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #82 pc 00000000003d1e84  /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+448) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #83 pc 000000000051cbac  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<true>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, bool, art::JValue*)+1536) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #84 pc 0000000000492ab0  /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<false>(art::interpreter::SwitchImplContext*)+8480) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #85 pc 00000000003d12b8  /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #86 pc 00000000002b6bb0  /data/app/~~YjP9a_DwTcpZGSVxGU8Sxw==/com.anonymous.nitromoduleserrorrepro-TdxWHChbz6N1UX5mekR7HQ==/oat/arm64/base.vdex (androidx.camera.core.ImageAnalysisAbstractAnalyzer$$ExternalSyntheticLambda0.run+0)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #87 pc 00000000003d0f18  /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.__uniq.112435418011751916792819755956732575238.llvm.4073957672844042480)+364) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.151 31459-31459 DEBUG                   crash_dump64                         A        #88 pc 00000000003d064c  /apex/com.android.art/lib64/libart.so (artQuickToInterpreterBridge+1020) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.152 31459-31459 DEBUG                   crash_dump64                         A        #89 pc 00000000002c2238  /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.152 31459-31459 DEBUG                   crash_dump64                         A        #90 pc 00000000021652c4  /memfd:jit-cache (deleted) (java.util.concurrent.ThreadPoolExecutor.runWorker+468)
2026-09-08 15:53:16.152 31459-31459 DEBUG                   crash_dump64                         A        #91 pc 0000000002165008  /memfd:jit-cache (deleted) (java.util.concurrent.ThreadPoolExecutor$Worker.run+136)
2026-09-08 15:53:16.152 31459-31459 DEBUG                   crash_dump64                         A        #92 pc 000000000200d7a0  /memfd:jit-cache (deleted) (java.lang.Thread.run+144)
2026-09-08 15:53:16.152 31459-31459 DEBUG                   crash_dump64                         A        #93 pc 00000000002aad94  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.152 31459-31459 DEBUG                   crash_dump64                         A        #94 pc 00000000002707ac  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+220) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.152 31459-31459 DEBUG                   crash_dump64                         A        #95 pc 00000000004bdc28  /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+1184) (BuildId: 7087b2f2160bfbf3335d54ba9779e325)
2026-09-08 15:53:16.152 31459-31459 DEBUG                   crash_dump64                         A        #96 pc 00000000000fd040  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208) (BuildId: 4d6e56b2321dd2889f771482b268b706)
2026-09-08 15:53:16.152 31459-31459 DEBUG                   crash_dump64                         A        #97 pc 000000000008f5e0  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 4d6e56b2321dd2889f771482b268b706)

Device

Android (any)

Nitro Modules Version

0.37.1, 0.36.5

Nitrogen Version

0.37.1

Can you reproduce this issue in the Nitro Example app here?

No, I cannot reproduce the issue in the Example app

Additional information

• I am using Expo
• I am using nitrogen
• I have read and followed the Troubleshooting Guide.
• I created a reproduction PR to reproduce this issue here in the nitro repo. (See Contributing for more information)
• I searched for similar issues in this repository and found none.

[eebirke]

This commit from React Native Skia seems to tackle a related issue, that caused a similar looking crash during reload and was fixed by the latest patch version (but I'm not sure if this is only relevant for the hot reload issue, or if it's also relevant for when the caller is umounted):
Shopify/react-native-skia#4037

[mrousavy]

Thanks for the report! That's a valid issue.

In VisionCamera, the Worklets integration intentionally does not use any Worklets APIs in native C++ code to keep it fully flexible, and Nitro also just deals with jsi::Runtime, conforming to its guarantees and API restrictions.
Worklets support is a nice plugin with the abstractions we built over the years and intentionally not tightly integrated, so a non-goal is to add custom worklets::... runtime support to VisionCamera or Nitro.

That mentioned, I believe this is a Worklets bug. Not entirely sure, and maybe also only surfaced because of our VisionCamera integration, but yea.
If you do the same Thread.sleep(1000) in the normal React Native runtime and reload it, it doesn't crash - that's because the jsi::Runtime can never be deallocated (from another Thread?) while a synchronous function is still running.
If the function is asynchronous, then of course the jsi::Runtime can be deleted, but Nitro's Promise code already detects this and bails out, so it doesn't crash.

So I think to fix this, react-native-worklets needs to ensure that its jsi::Runtime can never be deallocated while a synchronous function is still running on it.
I think AroundLock::call() has a mutex, but it doesn't guarantee jsi::Runtime lifetime.

Any thoughts on that @tjzel ?

[eebirke]

Based on the issue and the discussion here, my coworker generated a patch with Fable that seems to fix the crash from react-native-worklets.

My C++ is a bit rusty, and I don't really know much about the architecture of these packages, so I can't say whether this is useful or not, but here it is:

react-native-worklets+0.11.4.patch

diff --git a/node_modules/react-native-worklets/Common/cpp/worklets/WorkletRuntime/WorkletRuntime.cpp b/node_modules/react-native-worklets/Common/cpp/worklets/WorkletRuntime/WorkletRuntime.cpp
--- a/node_modules/react-native-worklets/Common/cpp/worklets/WorkletRuntime/WorkletRuntime.cpp
+++ b/node_modules/react-native-worklets/Common/cpp/worklets/WorkletRuntime/WorkletRuntime.cpp
@@ -70,6 +70,18 @@
     eventLoop_ = std::make_shared<EventLoop>(name_, runtime_, queue_);
     eventLoop_->run();
   }
+}
+
+WorkletRuntime::~WorkletRuntime() {
+  // runtimeMutex_ is held (via LockableRuntime's AroundLock) for the whole
+  // duration of any synchronous call running on the runtime from another
+  // thread (e.g. a VisionCamera frame processor calling a Nitro Module).
+  // Release our strong references to the jsi::Runtime while holding that
+  // mutex so the runtime can never be deallocated mid-call - otherwise the
+  // in-flight call converts its return value into a freed runtime (SIGSEGV).
+  eventLoop_.reset(); // drops EventLoop's strong runtime reference
+  const std::lock_guard<std::recursive_mutex> lock(*runtimeMutex_);
+  runtime_.reset();
 }
 
 void WorkletRuntime::init(const std::shared_ptr<JSIWorkletsModuleProxy> &jsiWorkletsModuleProxy) {
diff --git a/node_modules/react-native-worklets/Common/cpp/worklets/WorkletRuntime/WorkletRuntime.h b/node_modules/react-native-worklets/Common/cpp/worklets/WorkletRuntime/WorkletRuntime.h
--- a/node_modules/react-native-worklets/Common/cpp/worklets/WorkletRuntime/WorkletRuntime.h
+++ b/node_modules/react-native-worklets/Common/cpp/worklets/WorkletRuntime/WorkletRuntime.h
@@ -168,6 +168,8 @@
       const std::shared_ptr<AsyncQueue> &queue = nullptr,
       bool enableEventLoop = true);
 
+  ~WorkletRuntime() override;
+
   void init(const std::shared_ptr<JSIWorkletsModuleProxy> &jsiWorkletsModuleProxy);
 
   /* #region deprecated */
@@ -229,7 +231,9 @@
 
   const RuntimeData::RuntimeId runtimeId_;
   const std::shared_ptr<std::recursive_mutex> runtimeMutex_;
-  const std::shared_ptr<jsi::Runtime> runtime_;
+  // Non-const: released in the destructor while holding runtimeMutex_ so the
+  // jsi::Runtime is never deallocated while a synchronous call is running.
+  std::shared_ptr<jsi::Runtime> runtime_;
   std::shared_ptr<JSScheduler> jsScheduler_;
   const RuntimeData::RuntimeKind runtimeKind_;
   const std::string name_;

[tjzel]

Hi, it seems the issue is two-fold.

First, as you mentioned, we don't prevent the runtime from being cleaned up when AroundLock is locked during execution.

Second, Nitro stores the runtime reference as a raw pointer without any notion of keeping the runtime alive https://github.com/margelo/nitro/blob/main/packages/react-native-nitro-modules/cpp/utils/JSCallback.hpp#L65. In Worklets library we always obtain a strong reference to the runtime instead https://github.com/software-mansion/react-native-reanimated/blob/main/packages/react-native-worklets/Common/cpp/worklets/SharedItems/Serializable/SerializableRemoteFunction.cpp#L58 to avoid this exact issue reported here. This is obviously easy for us as we do it with our own headers.

We'll make the destructor claim the mutex exclusively, but I'm afraid it won't fix all issues that can stem from using a raw pointer to invoke callbacks.

[mrousavy]

The raw jsi::Runtime* pointer I keep in Nitro is safe per JSI rules because it is never being dereferenced unless you are running in a synchronous jsi::HostFunction on that specific jsi::Runtime*. That's how promises work as well.

But Worklets destroys a jsi::Runtime* even though a blocking synchronous jsi::HostFunction is still running on it.

So I think either this is a missing or imprecise JSI rule, or Worklets is violating that JSI rule - I am not sure about this to be honest.

Thoughts?

[mrousavy]

Nitro stores the runtime reference as a raw pointer without any notion of keeping the runtime alive https://github.com/margelo/nitro/blob/main/packages/react-native-nitro-modules/cpp/utils/JSCallback.hpp#L65

To clarify this part; Nitro is smart about keeping the JSI Values alive because I store references in my own nitro::BorrowingReference<...> concept. jsi::NativeState installed inside the jsi::Runtime / globals are driving destructors via RAII, so once those run, they will deallocate my types under a lock, which has to be acquired first if you are off that specific runtime.
So if you are running on the JSI Runtime, there is zero overhead involved (hence why Nitro is so fast), but if you are off that JSI Runtime you will have to acquire that lock first - once you have that, jump to the JSI Runtime and you are safe to use JSI there - and the jsi::Runtime* will never be deallocated here (React Native also follows this rule with the main JS Runtime)