Summary
On iOS, mounting a sandbox in a Release build crashes with SIGSEGV during the sandbox's own ReactInstance initialization, before any user JS ever runs. Reproduced deterministically (3/3 runs, including on a freshly erased simulator) on RN 0.80.1 and RN 0.81.4. Does not reproduce on RN 0.82.1.
Android is not affected. I tested the equivalent scenario on RN 0.80.1 Release (both a successfully loading sandbox bundle and a missing bundle case) with no crash in either.
Repro
Any SandboxReactNativeView mount in a Release configured iOS build, regardless of jsBundleSource (reproduces with the default bare bundle name, no custom loading involved).
- apps/demo in this repo, RN 0.80.1, react-native run-ios --mode Release
- Same result after bumping to RN 0.81.4
- Clean on RN 0.82.1 (tested via apps/fs-experiment in this repo)
Crash details
EXC_BAD_ACCESS (code=1, address=0x17)
Thread: com.facebook.react.runtime.JavaScript
facebook::hermes::HermesRuntimeImpl::debugJavaScript(...)
<+120>: ldrb w9, [x2, #0x17] ; x2 = 0x0 (null sourceURL reference)
facebook::react::ReactInstance::initializeRuntime(...)::$_0::operator()
at ReactInstance.cpp:401 [inlined]
-> runtime_->unstable_initializeOnJsThread()
-> HermesInstance::unstable_initializeOnJsThread() { runtime_->registerForProfiling(); }
Confirmed live with lldb (process attach plus a breakpoint on debugJavaScript), not just from the crash report's own approximate symbolication.
What I believe is happening
registerForProfiling() in the Hermes version bundled with RN 0.80.1/0.81.4 ends up calling debugJavaScript() with a null sourceURL reference, which segfaults. Checking the current Hermes source (facebook/hermes main), registerForProfiling() no longer touches debugJavaScript at all, it only manages runtime.samplingProfiler. This code path looks like it was refactored away upstream, which lines up with 0.82.1 not reproducing the crash.
This isn't specific to the sandbox's own code. ReactInstance.cpp and HermesInstance.cpp are shared RN/Hermes internals invoked for any Hermes runtime, sandbox or host. The sandbox just happens to be the mechanism that creates a second Hermes runtime in process, which is what surfaces it.
Suggested fix
Bump the peer dependency floor. Today's peerDependencies says react-native >= 0.78.0, but that's only accurate for Debug builds. Any Release build on iOS with RN < ~0.82 will crash the moment a sandbox mounts.
Summary
On iOS, mounting a sandbox in a Release build crashes with SIGSEGV during the sandbox's own ReactInstance initialization, before any user JS ever runs. Reproduced deterministically (3/3 runs, including on a freshly erased simulator) on RN 0.80.1 and RN 0.81.4. Does not reproduce on RN 0.82.1.
Android is not affected. I tested the equivalent scenario on RN 0.80.1 Release (both a successfully loading sandbox bundle and a missing bundle case) with no crash in either.
Repro
Any SandboxReactNativeView mount in a Release configured iOS build, regardless of jsBundleSource (reproduces with the default bare bundle name, no custom loading involved).
Crash details
Confirmed live with lldb (process attach plus a breakpoint on debugJavaScript), not just from the crash report's own approximate symbolication.
What I believe is happening
registerForProfiling() in the Hermes version bundled with RN 0.80.1/0.81.4 ends up calling debugJavaScript() with a null sourceURL reference, which segfaults. Checking the current Hermes source (facebook/hermes main), registerForProfiling() no longer touches debugJavaScript at all, it only manages runtime.samplingProfiler. This code path looks like it was refactored away upstream, which lines up with 0.82.1 not reproducing the crash.
This isn't specific to the sandbox's own code. ReactInstance.cpp and HermesInstance.cpp are shared RN/Hermes internals invoked for any Hermes runtime, sandbox or host. The sandbox just happens to be the mechanism that creates a second Hermes runtime in process, which is what surfaces it.
Suggested fix
Bump the peer dependency floor. Today's peerDependencies says react-native >= 0.78.0, but that's only accurate for Debug builds. Any Release build on iOS with RN < ~0.82 will crash the moment a sandbox mounts.