ui.Image.dispose() sometimes crashes on older Android devices

[jlahd]

On certain older devices, calling dispose on ui.Image instances crashes the app:
F/libc (14755): Fatal signal 11 (SIGSEGV), code 1, fault addr 0x18 in tid 14774 (1.ui)

I have witnessed this on an Oukitel K10000 (Android 6) and Samsung xCover 3 (SM-G388F, Android 5.1.1). It seems to not be an issue on newer phones, even with a much larger number of images.

The crash occurs both on debug and release builds.

Steps to Reproduce

This app reproduces the problem:
main.dart.zip

1. Create a set of ui.Image instances. The example downloads the images from the internet.
2. Dispose the images. Witness a crash.

Sometimes, the app crashes right on the first dispose, sometimes after a few successful disposes. Increasing kImages makes the problem occur more easily.

The culprit

This issue appeared when we switched to Flutter stable 1.20. Bisecting for the problem, I found out that the issue appeared with the commit 2adf0183ac007b829d7f2e9893aacf9d087bc970, which is an engine roll.

Further bisecting the engine commits, I found out that on the engine side the problem appears with the commit f46dde1f06e11b18fb07f51cfc93286bdda3eaa6; most likely, the crash occurs here:

void CanvasImage::dispose() {
   ClearDartWrapper();
+  image_.reset();
 }

Unfortunately, I am not well enough acquainted with the engine code to be able to provide a patch for the problem.

[jason-simmons]

Thank you for the very thorough bug report!

ClearDartWrapper drops the reference to the CanvasImage that is held on behalf of Dart. If that is the last reference then the CanvasImage may be deleted, which would make accessing image_ unsafe.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.