EXC_BAD_ACCESS crash in CommandQueue::processMessages() on teardown after setValue

[mfazekas]

Description

EXC_BAD_ACCESS crash in rive::CommandQueue::processMessages() when a ViewModelInstance property is set via setValue and the Rive view is torn down before the next CADisplayLink tick processes the queued message.

Thread 0 (com.apple.main-thread):
#0  rive::CommandQueue::processMessages()
#1  -[RiveCommandQueue processMessages] (RiveCommandQueue.mm:2318)
#2  CA::Display::DisplayLinkItem::dispatch_()
#3  CA::Display::DisplayLink::dispatch_items()
#4  CA::Display::DisplayLink::dispatch_deferred_display_links()
#5  _UIUpdateSequenceRun()

Exception: EXC_BAD_ACCESS (SIGSEGV) KERN_INVALID_ADDRESS

Provide a Repro

@_spi(RiveExperimental) import RiveRuntime

let worker = Worker()
let file = try await File(source: .local("lists_demo", Bundle.main), worker: worker)
let artboard = try await file.createArtboard(nil)
let stateMachine = try await artboard.createStateMachine(nil)
let vmi = try await file.createViewModelInstance(
    .viewModelDefault(from: .artboardDefault(artboard))
)

let rive = try await Rive(
    file: file, artboard: artboard,
    stateMachine: stateMachine, dataBind: .instance(vmi)
)

let riveView = RiveUIView(rive: rive)
riveView.frame = view.bounds
view.addSubview(riveView)

// Wait at least one frame
try await Task.sleep(nanoseconds: 200_000_000)

// setValue on a list item, then tear down
let itemVmi = vmi.value(of: ListProperty(path: "menu"), at: 0)
itemVmi.setValue(of: StringProperty(path: "label"), to: "Updated")

// Tear down (pop view controller / release all references)
// → crash on next CADisplayLink tick in processMessages()

Crashes on the first attempt.

Source .riv/.rev file

lists_demo.riv (also in rive-nitro-react-native/example/assets)

Expected behavior

Tearing down a Rive view after calling setValue should not crash. The CommandQueue should handle teardown gracefully regardless of pending messages.

Screenshots

N/A — this is a crash, not a visual issue.

Device & Versions (please complete the following information)

• Device: iOS Simulator (iPhone 16 Pro)
• iOS version: 18.6
• rive-ios: main (397b290)
• API: @_spi(RiveExperimental)

Additional context

The crash reproduces with any action after setValue — navigating back, appending to a list, or touch input on the view. The common pattern is setValue followed by teardown or another operation before processMessages() runs.

[dskuza]

This will be addressed in an upcoming release. Until then, this can remain open.