Fix use-after-free race in RCTInstance callFunctionOnJSModule (#58816)

Summary:

## Changelog:

[Internal]

Differential Revision: D122831570

Author: Autopilot Bot

packages/react-native/ReactCommon/react/runtime/platform/ios/ReactCommon/RCTInstance.mm

@@ -171,10 +171,19 @@ - (void)dealloc
 
 - (void)callFunctionOnJSModule:(NSString *)moduleName method:(NSString *)method args:(NSArray *)args
 {
-  if (_valid) {
-    _reactInstance->callFunctionOnModule(
-        [moduleName UTF8String], [method UTF8String], convertIdToFollyDynamic(args ? args : @[]));
+  // Convert outside the lock: the payload can be large, and -invalidate blocks on
+  // _invalidationMutex.
+  auto dynamicArgs = convertIdToFollyDynamic(args ? args : @[]);
+  std::string moduleNameString = [moduleName UTF8String] ?: "";
+  std::string methodString = [method UTF8String] ?: "";
+
+  // This is called from arbitrary threads, while -invalidate destroys _reactInstance on
+  // the JS thread, so checking _valid and dereferencing have to happen as one step.
+  std::lock_guard<std::mutex> lock(_invalidationMutex);
+  if (!_valid || !_reactInstance) {
+    return;
   }
+  _reactInstance->callFunctionOnModule(moduleNameString, methodString, std::move(dynamicArgs));
 }
 
 - (void)invalidate