Skip to content

[camera] Fix CameraController may update after dispose and crash with "used after being disposed. (fixes #184959) #11498

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Istiak-Ahmed78 wants to merge 14 commits into
base: main
Choose a base branch
from
Open

[camera] Fix CameraController may update after dispose and crash with "used after being disposed. (fixes #184959) #11498

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
e7d7b65
fix: CameraController crash with "used after being disposed
Istiak-Ahmed78 Apr 13, 2026
88032f2
test: Add regression tests for CameraController dispose race conditio…
Istiak-Ahmed78 Apr 13, 2026
1d40ee8
code clean up
Istiak-Ahmed78 Apr 13, 2026
96661b3
native code added
Istiak-Ahmed78 Apr 14, 2026
9dc0722
fix mamory leackage
Istiak-Ahmed78 Apr 15, 2026
e7f6120
Revert "native code added"
Istiak-Ahmed78 Apr 15, 2026
1805506
addressed: ANR, ufferQueue errors
Istiak-Ahmed78 Apr 15, 2026
367e0e9
performance improved
Istiak-Ahmed78 Apr 15, 2026
ff89a34
camera. java reverted
Istiak-Ahmed78 Apr 15, 2026
e3b32f5
unnecessary changes removed
Istiak-Ahmed78 Apr 15, 2026
a9a2cd0
Update ImageProxyProxyApi.java
Istiak-Ahmed78 Apr 15, 2026
fd3f963
code improvement
Istiak-Ahmed78 Apr 15, 2026
5a7fcdc
added test
Istiak-Ahmed78 Apr 15, 2026
446fd5e
Merge branch 'fix' of https://github.com/Istiak-Ahmed78/packages into…
Istiak-Ahmed78 Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 28 additions & 22 deletions packages/camera/camera/lib/src/camera_controller.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -341,7 +341,9 @@ class CameraController extends ValueNotifier<CameraValue> {
_deviceOrientationSubscription ??= CameraPlatform.instance
.onDeviceOrientationChanged()
.listen((DeviceOrientationChangedEvent event) {
value = value.copyWith(deviceOrientation: event.orientation);
if (!_isDisposed) {
Copy link
Copy Markdown
Contributor

@navaronbracke navaronbracke Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could these use early returns? That would reduce the indent changes in code.

Just a personal preference though.

Copy link
Copy Markdown
Author

@Istiak-Ahmed78 Istiak-Ahmed78 Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the suggestion! Early returns would definitely improve the code.

However, this PR is still in draft. @mbcorona from the Flutter team recently
discovered a deeper issue: ImageReader fails to drain pending frames on dispose,
flooding the queue with 290+ orphaned callbacks.
flutter/flutter#184959 (comment)

My current fix addresses the symptom (guarding state updates). but the root cause is the improper ImageReader cleanup at the native
level. So I'm currently reinvestigating the issue

Once I resolve the frame leakage issue, I'll:

  • Apply your early return suggestion
  • Update the fix comprehensively
  • Mark it ready for review

Thanks again for your suggestion!

Copy link
Copy Markdown
Collaborator

@stuartmorgan-g stuartmorgan-g Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Before marking it ready for review, please update the PR to use and follow our actual checklist, rather than an AI-hallucinated checklist.

value = value.copyWith(deviceOrientation: event.orientation);
}
});

_cameraId = await CameraPlatform.instance.createCameraWithSettings(
Expand All @@ -361,7 +363,9 @@ class CameraController extends ValueNotifier<CameraValue> {
CameraPlatform.instance.onCameraError(_cameraId).first.then((
CameraErrorEvent event,
) {
value = value.copyWith(errorDescription: event.description);
if (!_isDisposed) {
value = value.copyWith(errorDescription: event.description);
}
}),
);

Expand All @@ -370,26 +374,28 @@ class CameraController extends ValueNotifier<CameraValue> {
imageFormatGroup: imageFormatGroup ?? ImageFormatGroup.unknown,
);

value = value.copyWith(
isInitialized: true,
description: description,
previewSize: await initializeCompleter.future.then(
(CameraInitializedEvent event) =>
Size(event.previewWidth, event.previewHeight),
),
exposureMode: await initializeCompleter.future.then(
(CameraInitializedEvent event) => event.exposureMode,
),
focusMode: await initializeCompleter.future.then(
(CameraInitializedEvent event) => event.focusMode,
),
exposurePointSupported: await initializeCompleter.future.then(
(CameraInitializedEvent event) => event.exposurePointSupported,
),
focusPointSupported: await initializeCompleter.future.then(
(CameraInitializedEvent event) => event.focusPointSupported,
),
);
if (!_isDisposed) {
value = value.copyWith(
isInitialized: true,
description: description,
previewSize: await initializeCompleter.future.then(
(CameraInitializedEvent event) =>
Size(event.previewWidth, event.previewHeight),
),
exposureMode: await initializeCompleter.future.then(
(CameraInitializedEvent event) => event.exposureMode,
),
focusMode: await initializeCompleter.future.then(
(CameraInitializedEvent event) => event.focusMode,
),
exposurePointSupported: await initializeCompleter.future.then(
(CameraInitializedEvent event) => event.exposurePointSupported,
),
focusPointSupported: await initializeCompleter.future.then(
(CameraInitializedEvent event) => event.focusPointSupported,
),
);
}
Comment on lines +377 to +398
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The if (!_isDisposed) check is performed before the await expressions. Since await suspends execution, dispose() could be called while waiting for the initializeCompleter.future to complete. When execution resumes, the assignment to value will proceed regardless of the disposal state, which will trigger the 'used after being disposed' crash because notifyListeners() is called on a disposed object. The check should be performed after the future completes but before the assignment to value. Additionally, awaiting the same future multiple times is inefficient.

      final CameraInitializedEvent event = await initializeCompleter.future;
      if (!_isDisposed) {
        value = value.copyWith(
          isInitialized: true,
          description: description,
          previewSize: Size(event.previewWidth, event.previewHeight),
          exposureMode: event.exposureMode,
          focusMode: event.focusMode,
          exposurePointSupported: event.exposurePointSupported,
          focusPointSupported: event.focusPointSupported,
        );
      }

} on PlatformException catch (e) {
throw CameraException(e.code, e.message);
} finally {
Expand Down
Loading