[Bug]: Random crashes on iOS when using local ZXY tiles

[cristianob]

Mapbox Implementation

Mapbox

Mapbox Version

11.8.0

React Native Version

0.76.0

Platform

iOS

@rnmapbox/maps version

10.1.33

Standalone component to reproduce

import React from 'react';
import {
  MapView,
  RasterSource,
  RasterLayer,
  Camera,
} from '@rnmapbox/maps';

class BugReportExample extends React.Component {
  render() {
    return (
      <MapView style={{flex: 1}}>
        <Camera centerCoordinate={[0,0]} zoomLevel={5} />
          <RasterSource tileUrlTemplates={["any LOCAL ZXY path"]} tileSize={256}>
            <RasterLayer
              minZoomLevel={3}
              maxZoomLevel={13}
            />
          </RasterSource>
      </MapView>
    );
  }
}

Observed behavior and steps to reproduce

• Run the app as many times possible and pan to load the tiles
• In very rare cases (3 per day in a production app with 5000 users), this stack trace will happen

OS Version: iOS 18.2 (22C152)
Report Version: 104

Exception Type: EXC_CRASH (SIGABRT)
Crashed Thread: 10 **(This thread number is random every time)**

Application Specific Information:
*** error for object %p: pointer being freed was not allocated
 > MyAppName > MyAppName(1724,0x16be8b000) malloc: *** error for object 0x3007949e0: pointer being freed was not allocated


Thread 10 Crashed:
0   libsystem_kernel.dylib          0x3b825e2d4         __pthread_kill
1   libsystem_pthread.dylib         0x42aca059c         pthread_kill
2   libsystem_c.dylib               0x32525bb08         abort
3   libsystem_malloc.dylib          0x3361f8bdc         <redacted>
4   libsystem_malloc.dylib          0x3361f8850         <redacted>
5   libsystem_malloc.dylib          0x3361f5dc4         <redacted>
6   libcache.dylib                  0x466b21a8c         cache_set_name
7   CoreFoundation                  0x3156deb88         <redacted>
8   CoreUI                          0x352495184         <redacted>
9   CoreUI                          0x352490320         <redacted>
10  CoreUI                          0x3524ab560         <redacted>
11  CoreUI                          0x3524ab414         <redacted>
12  CoreUI                          0x3524ab2e4         <redacted>
13  CoreUI                          0x3524ab124         <redacted>
14  UIKitCore                       0x31aa9546c         <redacted>
15  UIKitCore                       0x31a6e148c         <redacted>
16  UIKitCore                       0x31a6deff0         <redacted>
17  UIKitCore                       0x31aa94954         <redacted>
18  UIKitCore                       0x31aa94820         <redacted>
19  UIKitCore                       0x31a6ddc8c         <redacted>
20  UIKitCore                       0x31a6dd778         <redacted>
21  UIKitCore                       0x31aa94db0         <redacted>
22  UIKitCore                       0x31a82f8ec         <redacted>
23  MyAppName                        0x204658188         RCTImageFromLocalAssetURL (RCTUtils.m:864)
24  MyAppName                        0x2047a9164         -[RCTBundleAssetImageLoader loadImageForURL:size:scale:resizeMode:progressHandler:partialLoadHandler:completionHandler:] (RCTBundleAssetImageLoader.mm:52)
25  MyAppName                        0x2047acc94         -[RCTImageLoader _loadImageOrDataWithURLRequest:size:scale:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:561)
26  MyAppName                        0x2047aebe4         -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:841)
27  MyAppName                        0x2047ac090         -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:373)
28  MyAppName                        0x2047abf88         -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:352)
29  MyAppName                        0x204b3b67c         RNMBXImageQueueOperation.start (RNMBXImageQueue.swift:72)
30  MyAppName                        0x20450af68         thunk for closure
31  libdispatch.dylib               0x32515a248         <redacted>
32  libdispatch.dylib               0x32515bfa8         <redacted>
33  libdispatch.dylib               0x32515f0f4         <redacted>
34  libdispatch.dylib               0x32516dec0         <redacted>
35  libdispatch.dylib               0x32516e6c4         <redacted>
36  libsystem_pthread.dylib         0x42ac9b644         _pthread_wqthread

Thread 0
0   MapboxCoreMaps                  0x105d871c4         mbgl::FillLayerFactory::getTypeInfo
1   MapboxCoreMaps                  0x105cf7b94         mbgl::LayerManagerDefault::addLayerType
2   MapboxCoreMaps                  0x105cf7664         mbgl::LayerManagerDefault::LayerManagerDefault
3   MapboxCoreMaps                  0x106023fe4         mbgl::style::conversion::Converter<T>::operator()
4   MapboxCoreMaps                  0x105c92e14         mapbox::maps::StyleManagerImpl::addStyleLayer
5   MapboxCoreMaps                  0x105c1eb54         mapbox::maps::StyleManager::addPersistentStyleLayer
6   MapboxCoreMaps                  0x105be1acc         -[MBMStyleManager addPersistentStyleLayerForProperties:layerPosition:]
7   MapboxMaps                      0x10716f9c0         MBMStyleManager
8   MapboxMaps                      0x107166ee0         StyleManager.addPersistentLayer
9   MapboxMaps                      0x10716b6bc         handleExpected<T>
10  MapboxMaps                      0x1071620c8         StyleManager.addLayer
11  MapboxMaps                      0x107161f90         StyleManager.addPersistentLayer
12  MapboxMaps                      0x1071686c8         StyleManager
13  MapboxMaps                      0x1070dd418         AnnotationManagerImpl.init (AnnotationManagerImpl.swift:135)
14  MapboxMaps                      0x1070c8acc         PointAnnotationManager.init
15  MapboxMaps                      0x106ea36b8         [inlined] PointAnnotationManager.init
16  MapboxMaps                      0x106ea36b8         [inlined] PointAnnotationManager.__allocating_init (PointAnnotationManager.swift:36)
17  MapboxMaps                      0x106ea36b8         [inlined] PointAnnotationManager (<compiler-generated>:30)
18  MapboxMaps                      0x106ea36b8         AnnotationOrchestrator.make<T> (AnnotationOrchestrator.swift:154)
19  MapboxMaps                      0x106ea21c8         [inlined] AnnotationOrchestrator.make<T>
20  MapboxMaps                      0x106ea21c8         AnnotationOrchestrator.makePointAnnotationManager (AnnotationOrchestrator.swift:104)
21  MyAppName                        0x204b6d98c         RNMBXPointAnnotationManager.init (RNMBXMapView.swift:1594)
22  MyAppName                        0x204b598d4         [inlined] RNMBXPointAnnotationManager.init
23  MyAppName                        0x204b598d4         [inlined] RNMBXPointAnnotationManager.__allocating_init (RNMBXMapView.swift:1597)
24  MyAppName                        0x204b598d4         [inlined] RNMBXMapView.pointAnnotationManager.getter (RNMBXMapView.swift:201)
25  MyAppName                        0x204b598d4         RNMBXMapView.pointAnnotationManager.getter (RNMBXMapView.swift:200)
26  MyAppName                        0x204b5ba04         RNMBXMapView.applyOnPress (RNMBXMapView.swift:1169)
27  MyAppName                        0x204b5b328         RNMBXMapView.Property.apply (RNMBXMapView.swift:383)
28  MyAppName                        0x204b740d0         [inlined] thunk for closure
29  MyAppName                        0x204b740d0         thunk for closure
30  MyAppName                        0x204b74470         thunk for closure
31  MyAppName                        0x204b742f4         [inlined] thunk for closure
32  MyAppName                        0x204b742f4         thunk for closure
33  MyAppName                        0x204b742c0         [inlined] PropertyChanges.apply (PropertyChanges.swift:53)
34  MyAppName                        0x204b742c0         [inlined] PropertyChanges.apply
35  MyAppName                        0x204b742c0         PropertyChanges.apply
36  MyAppName                        0x204b6d7d4         [inlined] thunk for closure
37  MyAppName                        0x204b6d7d4         [inlined] thunk for closure
38  MyAppName                        0x204b6d7d4         Sequence.forEach
39  MyAppName                        0x204b6f3fc         [inlined] Sequence.forEach
40  MyAppName                        0x204b6f3fc         [inlined] PropertyChanges.apply (PropertyChanges.swift:52)
41  MyAppName                        0x204b6f3fc         RNMBXMapView.didSetProps (RNMBXMapView.swift:752)
42  MyAppName                        0x204b5fbf4         [inlined] RNMBXMapView.didSetProps
43  MyAppName                        0x204b5fbf4         RNMBXMapView.didSetProps (<compiler-generated>:746)
44  MyAppName                        0x204652714         __45-[RCTUIManager _dispatchPropsDidChangeEvents]_block_invoke (RCTUIManager.m:1263)
45  MyAppName                        0x204651eac         __44-[RCTUIManager flushUIBlocksWithCompletion:]_block_invoke (RCTUIManager.m:1162)
46  MyAppName                        0x204651fb0         __44-[RCTUIManager flushUIBlocksWithCompletion:]_block_invoke.144 (RCTUIManager.m:1182)
47  libdispatch.dylib               0x32515a248         <redacted>
48  libdispatch.dylib               0x32515bfa8         <redacted>
49  libdispatch.dylib               0x32516aa34         <redacted>
50  libdispatch.dylib               0x32516a64c         _dispatch_main_queue_callback_4CF
51  CoreFoundation                  0x315679bbc         <redacted>
52  CoreFoundation                  0x3156761b0         <redacted>
53  CoreFoundation                  0x3156c8274         CFRunLoopRunSpecific
54  GraphicsServices                0x3afa214c0         GSEventRunModal
55  UIKitCore                       0x31aa2677c         <redacted>
56  UIKitCore                       0x31a64ce64         UIApplicationMain
57  MyAppName                        0x2044f01f0         main (main.m:8)
58  <unknown>                       0x1b8cfcde8         <redacted>

Thread 1
0   libsystem_kernel.dylib          0x3b825359c         __ulock_wait2
1   libsystem_platform.dylib        0x42ab41d9c         <redacted>
2   UIKitCore                       0x31a6dd6c0         <redacted>
3   UIKitCore                       0x31a82f844         <redacted>
4   MyAppName                        0x204658188         RCTImageFromLocalAssetURL (RCTUtils.m:864)
5   MyAppName                        0x2047a9164         -[RCTBundleAssetImageLoader loadImageForURL:size:scale:resizeMode:progressHandler:partialLoadHandler:completionHandler:] (RCTBundleAssetImageLoader.mm:52)
6   MyAppName                        0x2047acc94         -[RCTImageLoader _loadImageOrDataWithURLRequest:size:scale:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:561)
7   MyAppName                        0x2047aebe4         -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:841)
8   MyAppName                        0x2047ac090         -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:373)
9   MyAppName                        0x2047abf88         -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:progressBlock:partialLoadBlock:completionBlock:] (RCTImageLoader.mm:352)
10  MyAppName                        0x204b3b67c         RNMBXImageQueueOperation.start (RNMBXImageQueue.swift:72)
11  MyAppName                        0x20450af68         thunk for closure
12  libdispatch.dylib               0x32515a248         <redacted>
13  libdispatch.dylib               0x32515bfa8         <redacted>
14  libdispatch.dylib               0x32515f0f4         <redacted>
15  libdispatch.dylib               0x32516dec0         <redacted>
16  libdispatch.dylib               0x32516e6c4         <redacted>
17  libsystem_pthread.dylib         0x42ac9b644         _pthread_wqthread

Thread 2
...
<More 82 threads like Thread 1, all starting with RNMBXImageQueueOperation.start (RNMBXImageQueue.swift:72) and crashing on RCTImageFromLocalAssetURL (RCTUtils.m:864)>

Expected behavior

App not crashing randomly

Notes / preliminary analysis

The traces shows Mapbox running 82 threads of image loading.

Randomly, some thread crash, starting on this call:
RNMBXImageQueueOperation.start (RNMBXImageQueue.swift:72)
and crashing on this call
RCTImageFromLocalAssetURL (RCTUtils.m:864)

Those crashs are rare (2 per day on a production app with 5000 users) and is very possible it is a race condition.

Additional links and references

No response

[mcastets]

Hi, I'm experiencing the same issue.

About 5 crashes per day on a production app with 5k daily users.

A few differences though:

• Mapbox Version : 10.18.2
• React Native Version : 0.76.6
• @rnmapbox/maps version : 10.1.34

Hope this helps.

[Mathiaslachot]

Hello, I’m experiencing the same crash too.

*** error for object %p: pointer being freed was not allocated > mobile > mobile(23538,0x16ba4f000) malloc: *** error for object 0x112cf7620: pointer being freed was not allocated

My setup:

@rnmapbox/maps: 10.1.38
react-native: 0.76.9

It happens in production for about 2% of our users.

[w8ight]

Experiencing the same quite a while

[yliu342]

Not sure if anyone got a fix on this but I was searching around and noticed there is a bug posed in the RN github as well react/react-native#54015. Looking at the stack trace I wasn't really sure what is actually being freed. It was only reproducible on a release build since the crash happened on RCTBundleAssetImageLoader. On debug this loader is not being used

[mfazekas]

This code is not thread safe:

https://github.com/facebook/react-native/blob/6d7a93f2b15dd275a4622625aef089e934a1a8dd/packages/react-native/React/Base/RCTUtils.mm#L853-L872

But RCTImageLoader is, so this seems to be a similar race condition to react/react-native#46115

[yliu342]

This code is not thread safe:

https://github.com/facebook/react-native/blob/6d7a93f2b15dd275a4622625aef089e934a1a8dd/packages/react-native/React/Base/RCTUtils.mm#L853-L872

But RCTImageLoader is, so this seems to be a similar race condition to facebook/react-native#46115

Interesting, the code you referenced point to bundleForPath just doing some debugging, I'm loading an image with url looks something like this MyApp.app/assets/application/modules/mapping/assets/Icon.png. Based on the crash report the method that crashed is RCTImageFromLocalAssetURL. With my code, the bundleForPath method never gets called.

UIImage *__nullable RCTImageFromLocalAssetURL(NSURL *imageURL)
{
  NSString *imageName = RCTBundlePathForURL(imageURL);

  NSBundle *bundle = nil;
  NSArray *imagePathComponents = [imageName pathComponents];
  if ([imagePathComponents count] > 1 &&
      [[[imagePathComponents firstObject] pathExtension] isEqualToString:@"bundle"]) {  <-- evaluate to false
    NSString *bundlePath = [imagePathComponents firstObject];
    bundle = bundleForPath([bundlePath stringByDeletingPathExtension]);
    imageName = [imageName substringFromIndex:(bundlePath.length + 1)];
  }

  UIImage *image = nil;
  if (imageName) {
    if (bundle) {
      image = [UIImage imageNamed:imageName inBundle:bundle compatibleWithTraitCollection:nil];
    } else {
      image = [UIImage imageNamed:imageName];  <-- here is the start of the OS level code and crash
    }
  }
.....
  return image;
}

[mfazekas]

@yliu342 yes good point.

https://github.com/facebook/react-native/blob/v0.76.0/packages/react-native/React/Base/RCTUtils.m#L864 which in in the original stack trace is also [UIImage imageNamed:imageName] but it's documented to be thread safe, since ios9:

https://developer.apple.com/documentation/uikit/uiimage/init(named:)?language=objc

In iOS 9 and later, this method is thread safe.

[yliu342]

original stack trace is also [UIImage imageNamed:imageName]

Do you mean react/react-native#46115 ticket? Looking closely at this, One crash I was able to reproduce with reproduce is and Customer is observing a different crash are two different crash. The one you are experiencing is looping through an array and while looping through it the array got changed. the customer one is what being reported here and what we are experiencing.

RN has put a lock on the setup to ensure the dispatch queue can't get modified while running the setup function which fixes your issue but I believe it is different from the one in here.

[yliu342]

In iOS 9 and later, this method is thread safe.

Yes the apple doc does say it is thread safe and I'm 100% agree since my background is writing native iOS code. My guess at this point is something along device running out of memory. If device is under memory pressure and then calling [UIImage imageNamed:imageName] then there might be some issue with the cache that comes with [UIImage imageNamed:imageName] method?

[konstmar-ion]

I think we just had a similar crash on app start.

• Production build
• Platform: iOS 18.6.2
• RN Version: 0.81.4
• @rnmapbox/maps Version: 10.1.45

Stacktrace:

EXC_BREAKPOINT: kCGImageProviderBitmapInfo
  libsystem_malloc    0x1aed0b020  _xzm_xzone_malloc_tiny_outlined
  CoreGraphics        0x1a07a74a8  CGPropertiesCreate
  CoreGraphics        0x1a07a74a8  CGPropertiesCreate
  CoreGraphics        0x1a07a7714  CGImageProviderSetProperty
  ImageIO             0x1a413aa98  IIOImagePlus::setImageBlockProc
  ImageIO             0x1a4153380  IIOReadPlugin::setupImageProviderCallbackV1
  ImageIO             0x1a41532b8  IIOReadPlugin::setupCallback
  ImageIO             0x1a413d57c  IIOReadPlugin::postInitialize
  ImageIO             0x1a41382d4  IIOReadPlugin::callInitialize
  ImageIO             0x1a4137784  IIO_Reader::initImageAtOffset
  ImageIO             0x1a4134504  IIOImageSource::makeImagePlus
  ImageIO             0x1a413e354  IIOImageSource::getPropertiesAtIndexInternal
  ImageIO             0x1a413e270  IIOImageSource::copyPropertiesAtIndex
  ImageIO             0x1a413d244  CGImageSourceCopyPropertiesAtIndex
  UIKitCore           0x1a1008254  _UIImageGetOrientationAndScale
  UIKitCore           0x1a1147654  ImageSourceAtPath
  UIKitCore           0x1a1143ae4  GetImageAtPath
  UIKitCore           0x1a11437e8  -[_UIPathLazyImageAsset imageWithConfiguration:]
  UIKitCore           0x1a10741d4  +[UIImage imageNamed:inBundle:withConfiguration:]
  React               0x1080f949c  RCTImageFromLocalAssetURL
  React               0x10831ab50  -[RCTBundleAssetImageLoader loadImageForURL:size:scale:resizeMode:progressHandler:partialLoadHandler:completionHandler:]
  React               0x10831f618  RCTLoadImageURLFromLoader
  React               0x10831e8e8  -[RCTImageLoader _loadImageOrDataWithURLRequest:size:scale:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:]
  React               0x108320b90  -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:]
  React               0x10831dc30  -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:progressBlock:partialLoadBlock:completionBlock:]
  React               0x10831db28  -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:progressBlock:partialLoadBlock:completionBlock:]
  IONDev              0x1055458ac  closure in RNMBXImageQueueOperation.start
  IONDev              0x1045f63bc  thunk for closure
  libdispatch         0x1a6606aa8  _dispatch_call_block_and_release
  libdispatch         0x1a6620580  _dispatch_client_callout
  libdispatch         0x1a663c2ac  _dispatch_queue_override_invoke.cold.3
  libdispatch         0x1a660b1f4  _dispatch_queue_override_invoke
  libdispatch         0x1a6618dac  _dispatch_root_queue_drain
  libdispatch         0x1a6619548  _dispatch_worker_thread2
  libsystem_pthread   0x228b249cc  _pthread_wqthread

  libsystem_malloc    0x1aed0b020  _xzm_xzone_malloc_tiny_outlined
  CoreGraphics        0x1a07a74a8  CGPropertiesCreate
  CoreGraphics        0x1a07a74a8  CGPropertiesCreate
  CoreGraphics        0x1a07a7714  CGImageProviderSetProperty
  ImageIO             0x1a413aa98  IIOImagePlus::setImageBlockProc
  ImageIO             0x1a4153380  IIOReadPlugin::setupImageProviderCallbackV1
  ImageIO             0x1a41532b8  IIOReadPlugin::setupCallback
  ImageIO             0x1a413d57c  IIOReadPlugin::postInitialize
  ImageIO             0x1a41382d4  IIOReadPlugin::callInitialize
  ImageIO             0x1a4137784  IIO_Reader::initImageAtOffset
  ImageIO             0x1a4134504  IIOImageSource::makeImagePlus
  ImageIO             0x1a413e354  IIOImageSource::getPropertiesAtIndexInternal
  ImageIO             0x1a413e270  IIOImageSource::copyPropertiesAtIndex
  ImageIO             0x1a413d244  CGImageSourceCopyPropertiesAtIndex
  UIKitCore           0x1a1008254  _UIImageGetOrientationAndScale
  UIKitCore           0x1a1147654  ImageSourceAtPath
  UIKitCore           0x1a1143ae4  GetImageAtPath
  UIKitCore           0x1a11437e8  -[_UIPathLazyImageAsset imageWithConfiguration:]
  UIKitCore           0x1a10741d4  +[UIImage imageNamed:inBundle:withConfiguration:]
  React               0x1080f949c  RCTImageFromLocalAssetURL
  React               0x10831ab50  -[RCTBundleAssetImageLoader loadImageForURL:size:scale:resizeMode:progressHandler:partialLoadHandler:completionHandler:]
  React               0x10831f618  RCTLoadImageURLFromLoader
  React               0x10831e8e8  -[RCTImageLoader _loadImageOrDataWithURLRequest:size:scale:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:]
  React               0x108320b90  -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:attribution:progressBlock:partialLoadBlock:completionBlock:]
  React               0x10831dc30  -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:priority:progressBlock:partialLoadBlock:completionBlock:]
  React               0x10831db28  -[RCTImageLoader loadImageWithURLRequest:size:scale:clipped:resizeMode:progressBlock:partialLoadBlock:completionBlock:]
  IONDev              0x1055458ac  closure in RNMBXImageQueueOperation.start
  IONDev              0x1045f63bc  thunk for closure
  libdispatch         0x1a6606aa8  _dispatch_call_block_and_release
  libdispatch         0x1a6620580  _dispatch_client_callout
  libdispatch         0x1a663c2ac  _dispatch_queue_override_invoke.cold.3
  libdispatch         0x1a660b1f4  _dispatch_queue_override_invoke
  libdispatch         0x1a6618dac  _dispatch_root_queue_drain
  libdispatch         0x1a6619548  _dispatch_worker_thread2
  libsystem_pthread   0x228b249cc  _pthread_wqthread

[mathiasDayuse]

Any news on this? Still happening for us in production.

Update from my side — we've since upgraded our stack and the crash persists:

• @rnmapbox/maps: 10.3.1 (latest published)
• react-native: 0.83.6
• MapboxMaps (native): 11.20.3 / MapboxCoreMaps 11.20.3 / MapboxCommon 24.20.3
• Expo: 55
• Release builds only. We register a handful of bundled require('...png') marker images via <Images> for a SymbolLayer (clustered search map).

Fresh Crashlytics trace — SIGABRT in libmalloc (pointer being freed was not allocated), originating from RNMBXImageQueueOperation.start() → RCTImageFromLocalAssetURL → [UIImage imageNamed:] → CoreUI's
CUICatalog lookupCache / NSCache setName::

closure #1 in RNMBXImageQueueOperation.start()
SIGABRT (ABORT)
Crashed: com.apple.root.default-qos
0  libsystem_kernel.dylib    __pthread_kill + 8
1  libsystem_pthread.dylib   pthread_kill + 268
2  libsystem_c.dylib         abort + 124
3  libsystem_malloc.dylib    malloc_vreport + 892
4  libsystem_malloc.dylib    malloc_report + 64
5  libsystem_malloc.dylib    ___BUG_IN_CLIENT_OF_LIBMALLOC_POINTER_BEING_FREED_WAS_NOT_ALLOCATED + 32
6  libcache.dylib            cache_set_name + 36
7  CoreFoundation            -[NSCache setName:] + 224
8  CoreUI                    -[CUICatalog lookupCache] + 116
9  CoreUI                    -[CUICatalog _private_resolvedRenditionKeyFromThemeRef:...] + 528
10 CoreUI                    -[CUICatalog _imageWithName:scaleFactor:...] + 264
...
22 UIKitCore                 +[UIImage imageNamed:inBundle:withConfiguration:] + 520
23 React                     RCTImageFromLocalAssetURL + 1004
24 React                     -[RCTBundleAssetImageLoader loadImageForURL:...] + 76
25 React                     RCTLoadImageURLFromLoader(...) + 348
26 React                     -[RCTImageLoader _loadImageOrDataWithURLRequest:...] + 1888
27 React                     -[RCTImageLoader loadImageWithURLRequest:...] + 584
...
30 MyApp                     closure #1 in RNMBXImageQueueOperation.start() + 80 (RNMBXImageQueue.swift:80)
32 libdispatch.dylib         _dispatch_call_block_and_release + 32
...
38 libsystem_pthread.dylib   _pthread_wqthread + 232

The crash happens on com.apple.root.default-qos (the DispatchQueue.global(qos: .default) in RNMBXImageQueue.swift), while loading bundled marker images through RCTImageLoader. Let me know if there's any
additional data I can provide to help track this down.