Skip to content

Commit a9a976a

Browse files
fabriziocuccireact-native-bot
authored andcommitted
Fix Hermes crash from TurboModule void method NSException handling (#56265)
Summary: Pull Request resolved: #56265 When an async void TurboModule method throws an NSException, performVoidMethodInvocation calls convertNSExceptionToJSError which accesses the Hermes JSI runtime from the native method call invoker thread. Since jsi::Runtime is not thread-safe, this causes heap corruption and EXC_BAD_ACCESS crashes across various hermes::vm::* functions. The sibling function performMethodInvocation was already fixed in D71619229 to re-throw the ObjC exception instead of converting to JSError when the call is async. This applies the same fix to performVoidMethodInvocation, which is always async. Related to SEV S641230 (4,550+ Hermes crashes in AMA iOS from OTA bundle 921191722). A JS change behind a QE/MC gate is triggering an NSException in a void TurboModule method for non-employee users, and this bug turns that into widespread memory corruption. This fix prevents the crash, but the triggering diff and throwing TurboModule still need to be identified separately. Matches upstream GitHub issue: https://github.com/facebook/hermes/issues/1957Commits affecting the React Native open source repository must have a changelog entry in the commit summary. Every React Native release has almost 1000 commits, and manually categorizing these commits is very time consuming. --- Changelog: [iOS][Fixed] - Fix Hermes crash when async void TurboModule method throws NSException by re-throwing instead of converting to JSError on wrong thread Reviewed By: javache Differential Revision: D98660782 fbshipit-source-id: bdedc769f17d9aec4156c45d0286c6c31ca006e4
1 parent 3dd61db commit a9a976a

File tree

1 file changed

+3
-1
lines changed
  • packages/react-native/ReactCommon/react/nativemodule/core/platform/ios/ReactCommon

1 file changed

+3
-1
lines changed

packages/react-native/ReactCommon/react/nativemodule/core/platform/ios/ReactCommon/RCTTurboModule.mm

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -470,7 +470,9 @@ TraceSection s(
470470
@try {
471471
[inv invokeWithTarget:strongModule];
472472
} @catch (NSException *exception) {
473-
throw convertNSExceptionToJSError(runtime, exception, std::string{moduleName}, methodNameStr);
473+
// Void methods are always async, re-throw instead of converting to
474+
// JSError, same as the async branch in performMethodInvocation.
475+
@throw exception;
474476
} @finally {
475477
[retainedObjectsForInvocation removeAllObjects];
476478
}

0 commit comments

Comments
 (0)