Skip to content

Fix SIGSEGV in ShadowNode::getTag() caused by use-after-free in findShadowNodeByTag_DEPRECATED #55751

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Abbondanzo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix SIGSEGV in ShadowNode::getTag() caused by use-after-free in findShadowNodeByTag_DEPRECATED #55751

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion ...Android/src/main/java/com/facebook/react/internal/featureflags/ReactNativeFeatureFlags.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*
* @generated SignedSource<<e3509361f95f3681f0bb583da5540d31>>
* @generated SignedSource<<477777b9a795b57f3bb3eaeb030738a9>>
*/

/**
Expand Down Expand Up @@ -354,6 +354,12 @@ public object ReactNativeFeatureFlags {
@JvmStatic
public fun enableVirtualViewDebugFeatures(): Boolean = accessor.enableVirtualViewDebugFeatures()

/**
* Fix a use-after-free race condition in findShadowNodeByTag_DEPRECATED by using getCurrentRevision() instead of tryCommit() with a raw pointer.
*/
@JvmStatic
public fun fixFindShadowNodeByTagRaceCondition(): Boolean = accessor.fixFindShadowNodeByTagRaceCondition()

/**
* Uses the default event priority instead of the discreet event priority by default when dispatching events from Fabric to React.
*/
Expand Down
12 changes: 11 additions & 1 deletion .../main/java/com/facebook/react/internal/featureflags/ReactNativeFeatureFlagsCxxAccessor.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*
* @generated SignedSource<<ae86a1485b81df483dad1108b39fae31>>
* @generated SignedSource<<c7b6ea7f1672df7bb3396375378784c5>>
*/

/**
Expand Down Expand Up @@ -74,6 +74,7 @@ internal class ReactNativeFeatureFlagsCxxAccessor : ReactNativeFeatureFlagsAcces
private var enableViewRecyclingForViewCache: Boolean? = null
private var enableVirtualViewContainerStateExperimentalCache: Boolean? = null
private var enableVirtualViewDebugFeaturesCache: Boolean? = null
private var fixFindShadowNodeByTagRaceConditionCache: Boolean? = null
private var fixMappingOfEventPrioritiesBetweenFabricAndReactCache: Boolean? = null
private var fixTextClippingAndroid15useBoundsForWidthCache: Boolean? = null
private var fuseboxAssertSingleHostStateCache: Boolean? = null
Expand Down Expand Up @@ -590,6 +591,15 @@ internal class ReactNativeFeatureFlagsCxxAccessor : ReactNativeFeatureFlagsAcces
return cached
}

override fun fixFindShadowNodeByTagRaceCondition(): Boolean {
var cached = fixFindShadowNodeByTagRaceConditionCache
if (cached == null) {
cached = ReactNativeFeatureFlagsCxxInterop.fixFindShadowNodeByTagRaceCondition()
fixFindShadowNodeByTagRaceConditionCache = cached
}
return cached
}

override fun fixMappingOfEventPrioritiesBetweenFabricAndReact(): Boolean {
var cached = fixMappingOfEventPrioritiesBetweenFabricAndReactCache
if (cached == null) {
Expand Down
4 changes: 3 additions & 1 deletion ...c/main/java/com/facebook/react/internal/featureflags/ReactNativeFeatureFlagsCxxInterop.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*
* @generated SignedSource<<b57dc37b228c3d622be039686ea11471>>
* @generated SignedSource<<ec036cff49622b8c2b52d2f9eaa59e6c>>
*/

/**
Expand Down Expand Up @@ -136,6 +136,8 @@ public object ReactNativeFeatureFlagsCxxInterop {

@DoNotStrip @JvmStatic public external fun enableVirtualViewDebugFeatures(): Boolean

@DoNotStrip @JvmStatic public external fun fixFindShadowNodeByTagRaceCondition(): Boolean

@DoNotStrip @JvmStatic public external fun fixMappingOfEventPrioritiesBetweenFabricAndReact(): Boolean

@DoNotStrip @JvmStatic public external fun fixTextClippingAndroid15useBoundsForWidth(): Boolean
Expand Down
4 changes: 3 additions & 1 deletion ...src/main/java/com/facebook/react/internal/featureflags/ReactNativeFeatureFlagsDefaults.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*
* @generated SignedSource<<65cdfdcbe22ff163b75e0b067bd72693>>
* @generated SignedSource<<523e3c35d4bd1fc85f2a3bb26b8aad3f>>
*/

/**
Expand Down Expand Up @@ -131,6 +131,8 @@ public open class ReactNativeFeatureFlagsDefaults : ReactNativeFeatureFlagsProvi

override fun enableVirtualViewDebugFeatures(): Boolean = false

override fun fixFindShadowNodeByTagRaceCondition(): Boolean = false

override fun fixMappingOfEventPrioritiesBetweenFabricAndReact(): Boolean = false

override fun fixTextClippingAndroid15useBoundsForWidth(): Boolean = false
Expand Down
13 changes: 12 additions & 1 deletion ...ain/java/com/facebook/react/internal/featureflags/ReactNativeFeatureFlagsLocalAccessor.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*
* @generated SignedSource<<7d8e2872030e38ccb038d9d7aab214a2>>
* @generated SignedSource<<cfd6a4514be320519a57566182b73f69>>
*/

/**
Expand Down Expand Up @@ -78,6 +78,7 @@ internal class ReactNativeFeatureFlagsLocalAccessor : ReactNativeFeatureFlagsAcc
private var enableViewRecyclingForViewCache: Boolean? = null
private var enableVirtualViewContainerStateExperimentalCache: Boolean? = null
private var enableVirtualViewDebugFeaturesCache: Boolean? = null
private var fixFindShadowNodeByTagRaceConditionCache: Boolean? = null
private var fixMappingOfEventPrioritiesBetweenFabricAndReactCache: Boolean? = null
private var fixTextClippingAndroid15useBoundsForWidthCache: Boolean? = null
private var fuseboxAssertSingleHostStateCache: Boolean? = null
Expand Down Expand Up @@ -648,6 +649,16 @@ internal class ReactNativeFeatureFlagsLocalAccessor : ReactNativeFeatureFlagsAcc
return cached
}

override fun fixFindShadowNodeByTagRaceCondition(): Boolean {
var cached = fixFindShadowNodeByTagRaceConditionCache
if (cached == null) {
cached = currentProvider.fixFindShadowNodeByTagRaceCondition()
accessedFeatureFlags.add("fixFindShadowNodeByTagRaceCondition")
fixFindShadowNodeByTagRaceConditionCache = cached
}
return cached
}

override fun fixMappingOfEventPrioritiesBetweenFabricAndReact(): Boolean {
var cached = fixMappingOfEventPrioritiesBetweenFabricAndReactCache
if (cached == null) {
Expand Down
4 changes: 3 additions & 1 deletion ...src/main/java/com/facebook/react/internal/featureflags/ReactNativeFeatureFlagsProvider.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*
* @generated SignedSource<<460d442da5dc25a441b671e7b30e7e56>>
* @generated SignedSource<<bbaa4d1498f606886341d34a62acb508>>
*/

/**
Expand Down Expand Up @@ -131,6 +131,8 @@ public interface ReactNativeFeatureFlagsProvider {

@DoNotStrip public fun enableVirtualViewDebugFeatures(): Boolean

@DoNotStrip public fun fixFindShadowNodeByTagRaceCondition(): Boolean

@DoNotStrip public fun fixMappingOfEventPrioritiesBetweenFabricAndReact(): Boolean

@DoNotStrip public fun fixTextClippingAndroid15useBoundsForWidth(): Boolean
Expand Down
16 changes: 15 additions & 1 deletion ...ative/ReactAndroid/src/main/jni/react/featureflags/JReactNativeFeatureFlagsCxxInterop.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*
* @generated SignedSource<<8d00a6310e0fae475007f11fa56a5a6f>>
* @generated SignedSource<<45063df01d7ce8726b4a7d901f1b3341>>
*/

/**
Expand Down Expand Up @@ -363,6 +363,12 @@ class ReactNativeFeatureFlagsJavaProvider
return method(javaProvider_);
}

bool fixFindShadowNodeByTagRaceCondition() override {
static const auto method =
getReactNativeFeatureFlagsProviderJavaClass()->getMethod<jboolean()>("fixFindShadowNodeByTagRaceCondition");
return method(javaProvider_);
}

bool fixMappingOfEventPrioritiesBetweenFabricAndReact() override {
static const auto method =
getReactNativeFeatureFlagsProviderJavaClass()->getMethod<jboolean()>("fixMappingOfEventPrioritiesBetweenFabricAndReact");
Expand Down Expand Up @@ -811,6 +817,11 @@ bool JReactNativeFeatureFlagsCxxInterop::enableVirtualViewDebugFeatures(
return ReactNativeFeatureFlags::enableVirtualViewDebugFeatures();
}

bool JReactNativeFeatureFlagsCxxInterop::fixFindShadowNodeByTagRaceCondition(
facebook::jni::alias_ref<JReactNativeFeatureFlagsCxxInterop> /*unused*/) {
return ReactNativeFeatureFlags::fixFindShadowNodeByTagRaceCondition();
}

bool JReactNativeFeatureFlagsCxxInterop::fixMappingOfEventPrioritiesBetweenFabricAndReact(
facebook::jni::alias_ref<JReactNativeFeatureFlagsCxxInterop> /*unused*/) {
return ReactNativeFeatureFlags::fixMappingOfEventPrioritiesBetweenFabricAndReact();
Expand Down Expand Up @@ -1149,6 +1160,9 @@ void JReactNativeFeatureFlagsCxxInterop::registerNatives() {
makeNativeMethod(
"enableVirtualViewDebugFeatures",
JReactNativeFeatureFlagsCxxInterop::enableVirtualViewDebugFeatures),
makeNativeMethod(
"fixFindShadowNodeByTagRaceCondition",
JReactNativeFeatureFlagsCxxInterop::fixFindShadowNodeByTagRaceCondition),
makeNativeMethod(
"fixMappingOfEventPrioritiesBetweenFabricAndReact",
JReactNativeFeatureFlagsCxxInterop::fixMappingOfEventPrioritiesBetweenFabricAndReact),
Expand Down
5 changes: 4 additions & 1 deletion ...-native/ReactAndroid/src/main/jni/react/featureflags/JReactNativeFeatureFlagsCxxInterop.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*
* @generated SignedSource<<c884eaa1b04699c8deb66eb62bb5e3f8>>
* @generated SignedSource<<5ac93ed057017f8d1a388b8029614f18>>
*/

/**
Expand Down Expand Up @@ -192,6 +192,9 @@ class JReactNativeFeatureFlagsCxxInterop
static bool enableVirtualViewDebugFeatures(
facebook::jni::alias_ref<JReactNativeFeatureFlagsCxxInterop>);

static bool fixFindShadowNodeByTagRaceCondition(
facebook::jni::alias_ref<JReactNativeFeatureFlagsCxxInterop>);

static bool fixMappingOfEventPrioritiesBetweenFabricAndReact(
facebook::jni::alias_ref<JReactNativeFeatureFlagsCxxInterop>);

Expand Down
6 changes: 5 additions & 1 deletion packages/react-native/ReactCommon/react/featureflags/ReactNativeFeatureFlags.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*
* @generated SignedSource<<20f3c045c134a0dae21f8428c6f8714a>>
* @generated SignedSource<<9d81f74c5926706ee353813e594575e8>>
*/

/**
Expand Down Expand Up @@ -242,6 +242,10 @@ bool ReactNativeFeatureFlags::enableVirtualViewDebugFeatures() {
return getAccessor().enableVirtualViewDebugFeatures();
}

bool ReactNativeFeatureFlags::fixFindShadowNodeByTagRaceCondition() {
return getAccessor().fixFindShadowNodeByTagRaceCondition();
}

bool ReactNativeFeatureFlags::fixMappingOfEventPrioritiesBetweenFabricAndReact() {
return getAccessor().fixMappingOfEventPrioritiesBetweenFabricAndReact();
}
Expand Down
7 changes: 6 additions & 1 deletion packages/react-native/ReactCommon/react/featureflags/ReactNativeFeatureFlags.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*
* @generated SignedSource<<20d4471389baccef0854624bb31550a5>>
* @generated SignedSource<<84e2800073ffab2313a4e27897c0c246>>
*/

/**
Expand Down Expand Up @@ -309,6 +309,11 @@ class ReactNativeFeatureFlags {
*/
RN_EXPORT static bool enableVirtualViewDebugFeatures();

/**
* Fix a use-after-free race condition in findShadowNodeByTag_DEPRECATED by using getCurrentRevision() instead of tryCommit() with a raw pointer.
*/
RN_EXPORT static bool fixFindShadowNodeByTagRaceCondition();

/**
* Uses the default event priority instead of the discreet event priority by default when dispatching events from Fabric to React.
*/
Expand Down
Loading
Loading