iOS 26 crash – CALayer position contains NaN when selecting text / showing magnifier / selecting Image's Text in WKWebView

Environment • Device: any iPhone running iOS 26 Developer Beta 5 (23A5308g) • Xcode: 16.3

Short description

The app crashes the moment the user tries to long-press to select text inside a WKWebView, double-tap an image with Text (magnifier appears)

The exception is CALayer position contains NaN. frame = (nan,0;0,48) chorPoint=(inf, 0) and it is thrown in the UI process.

Build & run any project that hosts a WKWebView. Inject the following CSS via script (this is what we do to suppress the native callout menu):

WKWebView *webView = [[WKWebView alloc] initWithFrame:self.view.bounds
                                        configuration:[WKWebViewConfiguration new]];
NSString *js =
  @"document.documentElement.style.webkitUserSelect='none';"
   "document.documentElement.style.webkitTouchCallout='none';";
[webView evaluateJavaScript:js completionHandler:nil];
[self.view addSubview:webView];
Incident Identifier: EE6FB046-5087-4F15-A72D-A74965347A30
CrashReporter Key:   29e8e58e02a07557adb4ce3f463d764f3ce8bbd5
Hardware Model:      iPhone16,1
Process:             wallet [642]
Path:                /private/var/containers/Bundle/Application/4B4E609A-C8BF-4C56-AB2A-1638249B98A5/wallet.app/wallet
Identifier:          xxxxxxx
Version:             xxxx
AppStoreTools:       16F7
AppVariant:          1:iPhone16,1:18
Code Type:           ARM-64 (Native)
Role:                Foreground
Parent Process:      launchd [1]
Coalition:           xxxxxx

Date/Time:           2025-08-06 12:05:24.0732 +0800
Launch Time:         2025-08-06 11:49:40.3802 +0800
OS Version:          iPhone OS 26.0 (23A5308g)
Release Type:        Beta
Baseband Version:    3.02.02
Report Version:      104

Exception Type:  EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Termination Reason: SIGNAL 6 Abort trap: 6
Terminating Process: wallet [642]

Triggered by Thread:  0

Application Specific Information:
abort() called

Thread 0 Crashed:
0   libsystem_kernel.dylib        	       0x22da0f0cc __pthread_kill + 8
1   libsystem_pthread.dylib       	       0x1e097b7e8 pthread_kill + 268
2   libsystem_c.dylib             	       0x191361f1c abort + 124
3   libc++abi.dylib               	       0x182e7a808 __abort_message + 132
4   libc++abi.dylib               	       0x182e69484 demangling_terminate_handler() + 304
5   libobjc.A.dylib               	       0x182d7bf28 _objc_terminate() + 156
6   wallet                        	       0x1068ff8c8 0x1046f4000 + 35698888
7   libc++abi.dylib               	       0x182e79bdc std::__terminate(void (*)()) + 16
8   libc++abi.dylib               	       0x182e7d314 __cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*) + 88
9   libc++abi.dylib               	       0x182e7d2bc __cxa_throw + 92
10  libobjc.A.dylib               	       0x182d7992c objc_exception_throw + 448
11  CoreFoundation                	       0x185e908d4 +[NSException raise:format:] + 128
12  QuartzCore                    	       0x18678a874 CA::Layer::set_position(CA::Vec2<double> const&, bool) + 160
13  QuartzCore                    	       0x1869a7270 -[CALayer setPosition:] + 52
14  UIKitCore                     	       0x18c4ac564 -[UIView _backing_setPosition:] + 176
15  UIKitCore                     	       0x18cefdf0c -[UIView setCenter:] + 220
16  UIKitCore                     	       0x18cd9f794 -[_UIEditMenuContentPresentation _displayPreparedMenu:titleView:reason:didDismissMenu:configuration:] + 936
17  UIKitCore                     	       0x18cd9f3c0 __54-[_UIEditMenuContentPresentation _displayMenu:reason:]_block_invoke + 104
18  UIKitCore                     	       0x18ced1060 -[UIEditMenuInteraction _editMenuPresentation:preparedMenuForDisplay:completion:] + 384
19  UIKitCore                     	       0x18cd9f2e4 -[_UIEditMenuContentPresentation _displayMenu:reason:] + 304
20  UIKitCore                     	       0x18cd9f0d8 -[_UIEditMenuContentPresentation displayMenu:configuration:] + 64
21  UIKitCore                     	       0x18ced0344 __58-[UIEditMenuInteraction presentEditMenuWithConfiguration:]_block_invoke + 260
22  UIKitCore                     	       0x18ced1f8c __80-[UIEditMenuInteraction _prepareMenuAtLocation:configuration:completionHandler:]_block_invoke + 80
23  UIKitCore                     	       0x18cc8403c __109-[UITextContextMenuInteraction _editMenuInteraction:menuForConfiguration:suggestedActions:completionHandler:]_block_invoke + 180
24  UIKitCore                     	       0x18cc84584 __107-[UITextContextMenuInteraction _querySelectionCommandsForConfiguration:suggestedActions:completionHandler:]_block_invoke + 148
25  WebKit                        	       0x1a05ae5d4 WTF::CompletionHandler<void (WebKit::DocumentEditingContext&&)>::operator()(WebKit::DocumentEditingContext&&) + 64
26  WebKit                        	       0x1a05bb468 WTF::Detail::CallableWrapper<WTF::CompletionHandler<void (IPC::Connection*, IPC::Decoder*)> IPC::Connection::makeAsyncReplyCompletionHandler<Messages::WebPage::RequestDocumentEditingContext, WTF::CompletionHandler<void (WebKit::DocumentEditingContext&&)>>(WTF::CompletionHandler<void (WebKit::DocumentEditingContext&&)>&&, WTF::ThreadLikeAssertion)::'lambda'(IPC::Connection*, IPC::Decoder*), void, IPC::Connection*, IPC::Decoder*>::call(IPC::Connection*, IPC::Decoder*) + 196
27  WebKit                        	       0x19fcf5db8 WTF::Detail::CallableWrapper<WebKit::AuxiliaryProcessProxy::sendMessage(WTF::UniqueRef<IPC::Encoder>&&, WTF::OptionSet<IPC::SendOption>, std::__1::optional<IPC::ConnectionAsyncReplyHandler>, WebKit::AuxiliaryProcessProxy::ShouldStartProcessThrottlerActivity)::$_1, void, IPC::Connection*, IPC::Decoder*>::call(IPC::Connection*, IPC::Decoder*) + 64
28  WebKit                        	       0x19fce54f0 IPC::Connection::dispatchMessage(WTF::UniqueRef<IPC::Decoder>) + 340
29  WebKit                        	       0x19fcf5aa0 IPC::Connection::dispatchIncomingMessages() + 536
30  JavaScriptCore                	       0x19a8f85d4 WTF::RunLoop::performWork() + 552
31  JavaScriptCore                	       0x19a8f838c WTF::RunLoop::performWork(void*) + 36
32  CoreFoundation                	       0x185da6230 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 28
33  CoreFoundation                	       0x185da61a4 __CFRunLoopDoSource0 + 172
34  CoreFoundation                	       0x185d83c6c __CFRunLoopDoSources0 + 232
35  CoreFoundation                	       0x185d598b0 __CFRunLoopRun + 820
36  CoreFoundation                	       0x185d58c44 _CFRunLoopRunSpecificWithOptions + 532
37  GraphicsServices              	       0x224ce0498 GSEventRunModal + 120
38  UIKitCore                     	       0x18b6c84b8 -[UIApplication _run] + 792
39  UIKitCore                     	       0x18b66cbc0 UIApplicationMain + 336
40  wallet                        	       0x1046f8558 0x1046f4000 + 17752
41  dyld                          	       0x182dcdb18 start + 6332
iOS 26 crash – CALayer position contains NaN when selecting text / showing magnifier / selecting Image's Text in WKWebView
 
 
Q