[iOS 26] Fix null reference and cast safety in ShellSectionRenderer navigation

[Copilot]

Note

Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!

Description of Change

Addresses navigation hangs on iOS 26 when rapidly pushing/popping pages. The _navStack in ShellSection initializes with { null } and can contain null entries during lifecycle transitions. Two safety issues identified:

DidPopItem method (line 127):

• Added null check for pages[targetIndex] before passing to SyncStackDownTo
• Prevents NullReferenceException when accessing stack entries during rapid navigation

ElementForViewController method (line 582):

• Changed hard cast (IPlatformViewHandler)child.Handler to safe cast child.Handler as IPlatformViewHandler
• Prevents InvalidCastException when Handler is null, allowing null-conditional operator to function correctly
• Aligns with pattern used in OnRemoveRequested method

// Before: Hard cast + null-conditional (inconsistent)
var renderer = (IPlatformViewHandler)child.Handler;  // Throws if null
if (viewController == renderer?.ViewController)

// After: Safe cast + null-conditional (consistent)
var renderer = child.Handler as IPlatformViewHandler;
if (viewController == renderer?.ViewController)

Issues Fixed

Fixes dotnet#32425

Original prompt

copilot --allow-all-tools --allow-all-paths
/agent pr-reviewer
please review @dotnet/mauidotnet/pull/32456

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[kubaflo]

PR dotnet#32456 Review Summary

Overview

PR Title: [iOS 26] Navigation hangs after rapidly open and closing new page using Navigation.PushAsync - fix
PR Link: dotnet#32456
Issue: dotnet#32425
Author: @kubaflo
Reviewer: GitHub Copilot

Problem Statement

Navigation hangs and shows a blank white screen when rapidly opening and closing pages using Navigation.PushAsync on iOS 26 with Xcode 26 builds. This is a regression specific to iOS 26.

Original PR Changes

The PR made two key changes to src/Controls/src/Core/Compatibility/Handlers/Shell/iOS/ShellSectionRenderer.cs:

Change 1: Line 127 - Add null check for pages[targetIndex]

- if (targetIndex < 0 || targetIndex >= pages.Count)
+ if (targetIndex < 0 || targetIndex >= pages.Count || pages[targetIndex] is null)

Change 2: Line 583 - Add null-conditional operator for renderer.ViewController

- if (viewController == renderer.ViewController)
+ if (viewController == renderer?.ViewController)

Review Analysis

Copilot Review Comment #1: Null Check on Line 127

Copilot's Suggestion: Remove || pages[targetIndex] is null as redundant

Analysis: ❌ INCORRECT

Reasoning:

• Investigation of ShellSection.cs revealed that _navStack is initialized with a null entry:

  List<Page> _navStack = new List<Page> { null };  // Line 251

• The stack can be reset to contain null during lifecycle:

  _navStack = new List<Page> { null };  // Line 174

• Therefore, null pages CAN exist in the Stack collection
• The null check is NECESSARY to prevent null reference exceptions when calling SyncStackDownTo(pages[targetIndex])

Recommendation: ✅ KEEP the null check as-is from the PR

Copilot Review Comment #2: Inconsistent Cast on Line 582-583

Copilot's Suggestion: Change hard cast to safe cast

Analysis: ✅ CORRECT

Original Code:

var renderer = (IPlatformViewHandler)child.Handler;  // Line 582 - hard cast
if (viewController == renderer?.ViewController)      // Line 583 - null-conditional

Problem:

• If child.Handler is null, the hard cast on line 582 will throw InvalidCastException
• The null-conditional operator on line 583 never gets a chance to execute
• This is inconsistent with the pattern used elsewhere in the file (see OnRemoveRequested at line 517-518)

Fix Applied:

var renderer = child.Handler as IPlatformViewHandler;  // Safe cast
if (viewController == renderer?.ViewController)        // Null-safe check

Recommendation: ✅ Apply the fix (changed from hard cast to as cast)

Changes Made During Review

1. ✅ Validated that the null check on line 127 is necessary (kept as-is from PR)
2. ✅ Fixed inconsistent cast on line 582 (changed from (IPlatformViewHandler) to as IPlatformViewHandler)
3. ✅ Ran code formatting - no issues found
4. ✅ Committed both the original PR changes and the review fix

Final Recommendation

APPROVE with modifications:

The PR correctly addresses the iOS 26 navigation hang issue with appropriate null checks. The review identified one valid improvement (line 582 cast consistency) which has been applied. The first review comment was incorrect and the original PR code should be kept.

Summary of All Changes:

diff --git a/src/Controls/src/Core/Compatibility/Handlers/Shell/iOS/ShellSectionRenderer.cs
index 90c0c7fc0e..77cc4f3465 100644
--- a/src/Controls/src/Core/Compatibility/Handlers/Shell/iOS/ShellSectionRenderer.cs
+++ b/src/Controls/src/Core/Compatibility/Handlers/Shell/iOS/ShellSectionRenderer.cs
@@ -124,7 +124,7 @@ namespace Microsoft.Maui.Controls.Platform.Compatibility
 
 			// Bounds check: ensure we have a valid index for pages array
 			int targetIndex = NavigationBar.Items.Length - 1;
-			if (targetIndex < 0 || targetIndex >= pages.Count)
+			if (targetIndex < 0 || targetIndex >= pages.Count || pages[targetIndex] is null)
 				return true;
 
 			_shellSection.SyncStackDownTo(pages[targetIndex]);
@@ -579,8 +579,8 @@ namespace Microsoft.Maui.Controls.Platform.Compatibility
 			{
 				if (child == null)
 					continue;
-				var renderer = (IPlatformViewHandler)child.Handler;
-				if (viewController == renderer.ViewController)
+				var renderer = child.Handler as IPlatformViewHandler;
+				if (viewController == renderer?.ViewController)
 					return child;
 			}

Why These Changes Are Correct:

1. Line 127: Prevents null reference exception when accessing a page that might be null in the navigation stack during rapid push/pop operations
2. Line 582: Prevents InvalidCastException when Handler is null, allowing the null-conditional operator on line 583 to work properly
3. Line 583: (Original PR) Prevents null reference exception when accessing ViewController on a null renderer

All three changes work together to handle null scenarios that can occur during rapid navigation operations on iOS 26.

Testing Recommendation

The PR should be tested with:

• Rapid push/pop navigation on iOS 26 simulator
• Rapid push/pop navigation on iOS 26 physical device
• Verify no regression on iOS 18 and earlier versions
• Test with the reproduction steps provided in issue [iOS 26] Navigation hangs after rapidly open and closing new page using Navigation.PushAsync dotnet/maui#32425