Steps to reproduce
- Create a Flutter app using the standard implicit engine pattern (FlutterAppDelegate + FlutterImplicitEngineDelegate + FlutterSceneDelegate + Main.storyboard)
- Build and deploy to an iPad Pro M4 (or any ProMotion device) running iOS 26.4 beta (23E5223f)
- Launch the app without the Xcode debugger attached (tap the icon on the home screen)
- App crashes immediately on launch
The app works perfectly when launched from Xcode with the debugger attached.
Expected results
App launches successfully without the debugger attached.
Actual results
SIGSEGV (EXC_BAD_ACCESS) crash at address 0x0 in -[VSyncClient initWithTaskRunner:callback:], called from -[FlutterViewController createTouchRateCorrectionVSyncClientIfNeeded] during viewDidLoad.
Crash stack trace (Thread 0, main thread)
0: -[VSyncClient initWithTaskRunner:callback:] +300 (Flutter)
1: -[FlutterViewController createTouchRateCorrectionVSyncClientIfNeeded] +216 (Flutter)
2: -[FlutterViewController viewDidLoad] +396 (Flutter)
3: -[UIViewController _sendViewDidLoadWithAppearanceProxyObjectTaggingEnabled] +83 (UIKitCore)
4: -[UIViewController loadViewIfRequired] +967 (UIKitCore)
5: -[UIViewController view] +23 (UIKitCore)
6: -[UIWindow addRootViewControllerViewIfPossible] +143 (UIKitCore)
7: -[UIWindow _updateLayerOrderingAndSetLayerHidden:actionBlock:] +179 (UIKitCore)
8: -[UIWindow _setHidden:forced:] +259 (UIKitCore)
9: -[UIWindow _mainQueue_makeKeyAndVisible] +39 (UIKitCore)
Root cause analysis
The implicit engine flow creates the FlutterViewController from Main.storyboard during scene connection. viewDidLoad fires before the implicit engine is fully attached to the VC, so self.engine.platformTaskRunner is a null fml::RefPtr, causing a null pointer dereference inside VSyncClient initWithTaskRunner:callback:.
The debugger masks this because it slows process startup enough for the engine to finish initializing before viewDidLoad fires.
What we tried
- Explicit engine creation (
FlutterEngine(name:) in AppDelegate or SceneDelegate) — the engine init returns nil on iOS 26 beta when called outside the implicit flow. This was confirmed by wrapping in Optional and hitting the nil path.
- Subclassing FlutterSceneDelegate with programmatic VC creation —
super.scene() creates its own FlutterViewController with the nil implicit engine, causing FML_CHECK abort.
- Flutter upgrade from 3.41.1 to 3.41.5 — same crash.
Additional notes
Environment
Flutter 3.41.5 • channel stable
Framework revision 2c9eb20739 (2026-03-17)
Engine revision 052f31d115
Dart 3.11.3
Device: iPad Pro M4 11-inch (iPad16,3)
OS: iPadOS 26.4 beta (23E5223f)
Xcode: 26.3 (17C529)
macOS: 26.4 (25E5233c)
Full crash log
Available on request (.ips file from device logs).
Steps to reproduce
The app works perfectly when launched from Xcode with the debugger attached.
Expected results
App launches successfully without the debugger attached.
Actual results
SIGSEGV (EXC_BAD_ACCESS) crash at address 0x0 in
-[VSyncClient initWithTaskRunner:callback:], called from-[FlutterViewController createTouchRateCorrectionVSyncClientIfNeeded]duringviewDidLoad.Crash stack trace (Thread 0, main thread)
Root cause analysis
The implicit engine flow creates the
FlutterViewControllerfrom Main.storyboard during scene connection.viewDidLoadfires before the implicit engine is fully attached to the VC, soself.engine.platformTaskRunneris a nullfml::RefPtr, causing a null pointer dereference insideVSyncClient initWithTaskRunner:callback:.The debugger masks this because it slows process startup enough for the engine to finish initializing before
viewDidLoadfires.What we tried
FlutterEngine(name:)in AppDelegate or SceneDelegate) — the engine init returnsnilon iOS 26 beta when called outside the implicit flow. This was confirmed by wrapping in Optional and hitting the nil path.super.scene()creates its own FlutterViewController with the nil implicit engine, causing FML_CHECK abort.Additional notes
viewDidLoadfiresCADisableMinimumFrameDurationOnPhoneis set totruein Info.plistEnvironment
Full crash log
Available on request (
.ipsfile from device logs).