Skip to content

Fix Hermes crash from TurboModule void method NSException handling#56265

Closed
fabriziocucci wants to merge 1 commit intofacebook:mainfrom
fabriziocucci:export-D98660782
Closed

Fix Hermes crash from TurboModule void method NSException handling#56265
fabriziocucci wants to merge 1 commit intofacebook:mainfrom
fabriziocucci:export-D98660782

Conversation

@fabriziocucci
Copy link
Copy Markdown
Contributor

Summary:
When an async void TurboModule method throws an NSException,
performVoidMethodInvocation calls convertNSExceptionToJSError which
accesses the Hermes JSI runtime from the native method call invoker
thread. Since jsi::Runtime is not thread-safe, this causes heap
corruption and EXC_BAD_ACCESS crashes across various hermes::vm::*
functions.

The sibling function performMethodInvocation was already fixed in
D71619229 to re-throw the ObjC exception instead of converting to
JSError when the call is async. This applies the same fix to
performVoidMethodInvocation, which is always async.

Related to SEV S641230 (4,550+ Hermes crashes in AMA iOS from OTA
bundle 921191722). A JS change behind a QE/MC gate is triggering an
NSException in a void TurboModule method for non-employee users, and
this bug turns that into widespread memory corruption. This fix
prevents the crash, but the triggering diff and throwing TurboModule
still need to be identified separately.

Matches upstream GitHub issue: https://github.com/facebook/hermes/issues/1957Commits affecting the React Native open source repository must have a changelog
entry in the commit summary. Every React Native release has almost 1000 commits,
and manually categorizing these commits is very time consuming.


Changelog:
[iOS][Fixed] - Fix Hermes crash when async void TurboModule method throws NSException by re-throwing instead of converting to JSError on wrong thread

Reviewed By: javache

Differential Revision: D98660782

Summary:
When an async void TurboModule method throws an NSException,
performVoidMethodInvocation calls convertNSExceptionToJSError which
accesses the Hermes JSI runtime from the native method call invoker
thread. Since jsi::Runtime is not thread-safe, this causes heap
corruption and EXC_BAD_ACCESS crashes across various hermes::vm::*
functions.

The sibling function performMethodInvocation was already fixed in
D71619229 to re-throw the ObjC exception instead of converting to
JSError when the call is async. This applies the same fix to
performVoidMethodInvocation, which is always async.

Related to SEV S641230 (4,550+ Hermes crashes in AMA iOS from OTA
bundle 921191722). A JS change behind a QE/MC gate is triggering an
NSException in a void TurboModule method for non-employee users, and
this bug turns that into widespread memory corruption. This fix
prevents the crash, but the triggering diff and throwing TurboModule
still need to be identified separately.

Matches upstream GitHub issue: https://github.com/facebook/hermes/issues/1957Commits affecting the React Native open source repository must have a changelog
entry in the commit summary. Every React Native release has almost 1000 commits,
and manually categorizing these commits is very time consuming.


---

Changelog:
[iOS][Fixed] - Fix Hermes crash when async void TurboModule method throws NSException by re-throwing instead of converting to JSError on wrong thread

Reviewed By: javache

Differential Revision: D98660782
@meta-codesync
Copy link
Copy Markdown

meta-codesync bot commented Mar 29, 2026

@fabriziocucci has exported this pull request. If you are a Meta employee, you can view the originating Diff in D98660782.

@meta-cla meta-cla bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Mar 29, 2026
@meta-codesync meta-codesync bot closed this in 4083a6f Mar 29, 2026
@react-native-bot
Copy link
Copy Markdown
Collaborator

This pull request was successfully merged by @fabriziocucci in 4083a6f

When will my fix make it into a release? | How to file a pick request?

@react-native-bot react-native-bot added the Merged This PR has been merged. label Mar 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. fb-exported Merged This PR has been merged. meta-exported p: Facebook Partner: Facebook Partner

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants