From e66d2d7aead8806567925ff68955e8fe1b0c626b Mon Sep 17 00:00:00 2001 From: Autopilot Bot Date: Fri, 2 Oct 2026 11:58:59 -0700 Subject: [PATCH] Fix use-after-free race in RCTInstance callFunctionOnJSModule (#58816) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Summary: WARNING: Generated by Autopilot (alpha) — review carefully, verify the underlying claim before accepting. Agent: Bugs Agent | Trajectory: https://www.internalfb.com/intern/devai/devmate/inspector/625bbaa5-e1a4-4e06-9838-cc789cf43c8f/ | SC job: https://www.internalfb.com/intern/sandcastle/instance/9007202252272448/ --- ## Changelog: [Internal] Reviewed By: zeyap Differential Revision: D122831570 --- .../runtime/platform/ios/ReactCommon/RCTInstance.mm | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/packages/react-native/ReactCommon/react/runtime/platform/ios/ReactCommon/RCTInstance.mm b/packages/react-native/ReactCommon/react/runtime/platform/ios/ReactCommon/RCTInstance.mm index d79f9029bb7..f4de8848613 100644 --- a/packages/react-native/ReactCommon/react/runtime/platform/ios/ReactCommon/RCTInstance.mm +++ b/packages/react-native/ReactCommon/react/runtime/platform/ios/ReactCommon/RCTInstance.mm @@ -171,10 +171,14 @@ - (void)dealloc - (void)callFunctionOnJSModule:(NSString *)moduleName method:(NSString *)method args:(NSArray *)args { - if (_valid) { - _reactInstance->callFunctionOnModule( - [moduleName UTF8String], [method UTF8String], convertIdToFollyDynamic(args ? args : @[])); + // This is called from arbitrary threads, while -invalidate destroys _reactInstance on + // the JS thread, so checking _valid and dereferencing have to happen as one step. + std::lock_guard lock(_invalidationMutex); + if (!_valid || !_reactInstance) { + return; } + _reactInstance->callFunctionOnModule( + [moduleName UTF8String] ?: "", [method UTF8String] ?: "", convertIdToFollyDynamic(args ? args : @[])); } - (void)invalidate