Skip to content

Commit 3e2e8ec

Browse files
zhongwuzwfacebook-github-bot
authored andcommitted
Bridge: Fixes HostTarget use after free when deallocated bridge (#48847)
Summary: Fixes #48805 . ## Changelog: [IOS] [FIXED] - Bridge: Fixes HostTarget use after free when deallocated bridge Pull Request resolved: #48847 Test Plan: Test code: ``` __weak RCTAlertManager *weakModule; autoreleasepool { RCTAlertManager *module = [RCTAlertManager new]; RCTBridge *bridge = [[RCTBridge alloc] initWithBundleURL:[self sourceURLForBridge:nil] moduleProvider:^{ return @[ module ]; } launchOptions:nil]; weakModule = module; (void)bridge; } ``` Reviewed By: realsoelynn Differential Revision: D68495576 Pulled By: huntie fbshipit-source-id: c3086a429f24488ac286ff22d039b8f049ccbffd
1 parent 1593142 commit 3e2e8ec

File tree

1 file changed

+12
-1
lines changed

1 file changed

+12
-1
lines changed

packages/react-native/React/Base/RCTBridge.mm

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,7 @@ - (instancetype)initWithDelegate:(id<RCTBridgeDelegate>)delegate
313313

314314
- (void)dealloc
315315
{
316+
RCTBridge *batchedBridge = self.batchedBridge;
316317
/**
317318
* This runs only on the main thread, but crashes the subclass
318319
* RCTAssertMainQueue();
@@ -332,7 +333,17 @@ - (void)dealloc
332333
RCTExecuteOnMainQueue(^{
333334
facebook::react::jsinspector_modern::getInspectorInstance().removePage(*inspectorPageId);
334335
inspectorPageId.reset();
335-
inspectorTarget.reset();
336+
// NOTE: RCTBridgeHostTargetDelegate holds a weak reference to RCTBridge.
337+
// Conditionally call `inspectorTarget.reset()` to avoid a crash.
338+
if (batchedBridge) {
339+
[batchedBridge
340+
dispatchBlock:^{
341+
inspectorTarget.reset();
342+
}
343+
queue:RCTJSThread];
344+
} else {
345+
inspectorTarget.reset();
346+
}
336347
});
337348
}
338349
}

0 commit comments

Comments
 (0)