Uh oh!
There was an error while loading. Please reload this page.
Fix potential race conditions when executing commitHooks - #53862
Fix potential race conditions when executing commitHooks#53862christophpurrer wants to merge 1 commit into
Conversation
facebook-github-bot
commented
Sep 19, 2025
@christophpurrer has exported this pull request. If you are a Meta employee, you can view the originating diff in D82846245. |
cc03e41 to
42ab383Comparefacebook-github-bot
commented
Sep 19, 2025
@christophpurrer has exported this pull request. If you are a Meta employee, you can view the originating diff in D82846245. |
42ab383 to
160497aComparefacebook-github-bot
commented
Sep 19, 2025
@christophpurrer has exported this pull request. If you are a Meta employee, you can view the originating diff in D82846245. |
160497a to
d200c2eComparefacebook-github-bot
commented
Sep 20, 2025
@christophpurrer has exported this pull request. If you are a Meta employee, you can view the originating diff in D82846245. |
Summary: Recently we saw `use-after-free race condition` where the ImageFetcher object was being destroyed while still registered as a UIManagerCommitHook. The crash occurred in `std::vector::size()` at line 635 when accessing corrupted memory. The root cause could be improper lifecycle management between ImageFetcher destruction and commit hook execution. The fix here modifies `UIManager::shadowTreeWillCommit()` to create a stable snapshot by copying the commitHooks_ vector while holding the lock. ## Reason - If a thread is iterating over `commitHooks_` with a `shared_lock`, and another thread acquires a `unique_lock` to modify the vector (add/remove), the iterator in the first thread can become invalid, leading to a crash (use-after-free or out-of-bounds). - This can happen if the lock is not held for the entire duration of the read or write, or if the lock is not correctly used everywhere commitHooks_ is accessed. Changelog: [Internal] Differential Revision: D82846245
d200c2e to
ab61f78Comparefacebook-github-bot
commented
Sep 24, 2025
@christophpurrer has exported this pull request. If you are a Meta employee, you can view the originating diff in D82846245. |
ab61f78 to
b38b4deComparefacebook-github-bot
commented
Sep 24, 2025
@christophpurrer has exported this pull request. If you are a Meta employee, you can view the originating diff in D82846245. |
b38b4de to
7ff03a1Comparefacebook-github-bot
commented
Sep 24, 2025
@christophpurrer has exported this pull request. If you are a Meta employee, you can view the originating diff in D82846245. |
7ff03a1 to
e3f1dbbComparefacebook-github-bot
commented
Sep 25, 2025
@christophpurrer has exported this pull request. If you are a Meta employee, you can view the originating diff in D82846245. |
e3f1dbb to
538dcfcCompare@christophpurrer has exported this pull request. If you are a Meta employee, you can view the originating Diff in D82846245. |
538dcfc to
cf6cd2aComparecf6cd2a to
f09a8a8Compare…mitHooks (react#53862) Summary: Recently, we observed a `use-after-free race condition` where the ImageFetcher object was destroyed while it was still registered as a UIManagerCommitHook. The crash occurred in `std::vector::size()` at line 635 when accessing corrupted memory. Changelog: [Internal] Differential Revision: D82846245
f09a8a8 to
520adb5CompareThis pull request has been merged in 44725b8. |
react-native-bot
commented
Oct 7, 2025
This pull request was successfully merged by @christophpurrer in 44725b8 When will my fix make it into a release? | How to file a pick request? |
Summary:
Recently we saw use-after-free race condition where the ImageFetcher object was being destroyed while still registered as a UIManagerCommitHook.
The crash occurred in std::vector::size() at line 635 when accessing corrupted memory.
The root cause could be improper lifecycle management between ImageFetcher destruction and commit hook execution.
The fix here modifies UIManager::shadowTreeWillCommit() to create a stable snapshot by copying the commitHooks_ vector while holding the lock.
Changelog: [Internal]
Differential Revision: D82846245