@depup/react-native 0.86.0-depup.49 → 0.87.0-depup.0

package/ReactCommon/react/renderer/imagemanager/platform/ios/react/renderer/imagemanager/RCTSyncImageManager.mm

@@ -76,7 +76,7 @@ using namespace facebook::react;
     observerCoordinator->nativeImageResponseProgress((float)progress / (float)total, progress, total);
   };
 
-  RCTImageURLLoaderRequest *loaderRequest =
+  RCTImageURLLoaderRequest *__unused loaderRequest =
       [self->_imageLoader loadImageWithURLRequest:request
                                              size:CGSizeMake(imageSource.size.width, imageSource.size.height)
                                             scale:imageSource.scale

package/ReactCommon/react/renderer/mapbuffer/MapBuffer.cpp

@@ -8,8 +8,43 @@
 #include "MapBuffer.h"
 #include <react/renderer/mapbuffer/MapBufferBuilder.h>
 
+#include <algorithm>
+#include <cstring>
+
 namespace facebook::react {
 
+namespace {
+// Reads a value of type T from a (possibly unaligned) offset in the buffer.
+// MapBuffer's packed layout places multi-byte values at offsets that are not
+// naturally aligned for their type (e.g. an 8-byte value at a 2-byte boundary),
+// so dereferencing a reinterpret_cast pointer there is undefined behavior and
+// can fault on 32-bit ARM. memcpy compiles to a single unaligned load on
+// arm64/x86 and to alignment-safe loads on armv7.
+template <typename T>
+inline T readUnaligned(const uint8_t* data, int32_t offset) {
+  T value;
+  std::memcpy(&value, data + offset, sizeof(T));
+  return value;
+}
+
+// Debug-asserts on OOB (catches corrupt buffers early in dev) AND clamps in
+// release so a corrupt bucket length can never drive an OOB memcpy read.
+// react_native_assert is compiled out in release, so the runtime cost outside
+// dev is the single min() call.
+inline int32_t
+clampToBufferBounds(int32_t offset, int32_t byteLength, size_t bufferSize) {
+  react_native_assert(offset >= 0 && byteLength >= 0);
+  react_native_assert(
+      static_cast<size_t>(offset) + static_cast<size_t>(byteLength) <=
+      bufferSize);
+  size_t maxLength = bufferSize > static_cast<size_t>(offset)
+      ? bufferSize - static_cast<size_t>(offset)
+      : 0;
+  return static_cast<int32_t>(
+      std::min(static_cast<size_t>(std::max(byteLength, 0)), maxLength));
+}
+} // namespace
+
 static inline int32_t bucketOffset(int32_t index) {
   return sizeof(MapBuffer::Header) + sizeof(MapBuffer::Bucket) * index;
 }
@@ -18,16 +53,20 @@ static inline int32_t valueOffset(int32_t bucketIndex) {
   return bucketOffset(bucketIndex) + offsetof(MapBuffer::Bucket, data);
 }
 
+// Dynamic-data entries pack [offset (low 32 bits)][byteLength (high 32 bits)]
+// into the bucket's 8-byte value, so the payload in the dynamic data section
+// carries no in-band length prefix. This returns the position of the high
+// 32 bits (the length).
+static inline int32_t lengthOffset(int32_t bucketIndex) {
+  return valueOffset(bucketIndex) + static_cast<int32_t>(sizeof(int32_t));
+}
+
 // TODO T83483191: Extend MapBuffer C++ implementation to support basic random
 // access
 MapBuffer::MapBuffer(std::vector<uint8_t> data) : bytes_(std::move(data)) {
-  auto header = reinterpret_cast<const Header*>(bytes_.data());
-  count_ = header->count;
-
-  if (header->bufferSize != bytes_.size()) {
-    LOG(ERROR) << "Error: Data size does not match, expected "
-               << header->bufferSize << " found: " << bytes_.size();
-    abort();
+  if (bytes_.size() >= sizeof(Header)) {
+    auto header = reinterpret_cast<const Header*>(bytes_.data());
+    count_ = header->count;
   }
 }
 
@@ -37,8 +76,7 @@ int32_t MapBuffer::getKeyBucket(Key key) const {
   while (lo <= hi) {
     int32_t mid = (lo + hi) >> 1;
 
-    Key midVal =
-        *reinterpret_cast<const Key*>(bytes_.data() + bucketOffset(mid));
+    Key midVal = readUnaligned<Key>(bytes_.data(), bucketOffset(mid));
 
     if (midVal < key) {
       lo = mid + 1;
@@ -53,8 +91,7 @@ int32_t MapBuffer::getKeyBucket(Key key) const {
 }
 
 inline int32_t MapBuffer::getIntAtBucket(int32_t bucketIndex) const {
-  return *reinterpret_cast<const int32_t*>(
-      bytes_.data() + valueOffset(bucketIndex));
+  return readUnaligned<int32_t>(bytes_.data(), valueOffset(bucketIndex));
 }
 
 int32_t MapBuffer::getInt(Key key) const {
@@ -74,8 +111,7 @@ int64_t MapBuffer::getLong(Key key) const {
     return 0;
   }
 
-  return *reinterpret_cast<const int64_t*>(
-      bytes_.data() + valueOffset(bucketIndex));
+  return readUnaligned<int64_t>(bytes_.data(), valueOffset(bucketIndex));
 }
 
 bool MapBuffer::getBool(Key key) const {
@@ -89,8 +125,7 @@ double MapBuffer::getDouble(Key key) const {
     return 0;
   }
 
-  return *reinterpret_cast<const double*>(
-      bytes_.data() + valueOffset(bucketIndex));
+  return readUnaligned<double>(bytes_.data(), valueOffset(bucketIndex));
 }
 
 int32_t MapBuffer::getDynamicDataOffset() const {
@@ -107,9 +142,10 @@ std::string MapBuffer::getString(Key key) const {
   }
 
   int32_t offset = getDynamicDataOffset() + getIntAtBucket(bucketIndex);
-  int32_t stringLength =
-      *reinterpret_cast<const int32_t*>(bytes_.data() + offset);
-  const uint8_t* stringPtr = bytes_.data() + offset + sizeof(int);
+  auto stringLength =
+      readUnaligned<int32_t>(bytes_.data(), lengthOffset(bucketIndex));
+  stringLength = clampToBufferBounds(offset, stringLength, bytes_.size());
+  const uint8_t* stringPtr = bytes_.data() + offset;
 
   return {stringPtr, stringPtr + stringLength};
 }
@@ -122,17 +158,13 @@ MapBuffer MapBuffer::getMapBuffer(Key key) const {
   }
 
   int32_t offset = getDynamicDataOffset() + getIntAtBucket(bucketIndex);
-  int32_t mapBufferLength =
-      *reinterpret_cast<const int32_t*>(bytes_.data() + offset);
-  size_t maxLength = bytes_.size() - offset - sizeof(int32_t);
-  if (mapBufferLength > maxLength) {
-    mapBufferLength = maxLength;
-  }
+  auto mapBufferLength =
+      readUnaligned<int32_t>(bytes_.data(), lengthOffset(bucketIndex));
+  mapBufferLength = clampToBufferBounds(offset, mapBufferLength, bytes_.size());
 
   std::vector<uint8_t> value(mapBufferLength);
 
-  memcpy(
-      value.data(), bytes_.data() + offset + sizeof(int32_t), mapBufferLength);
+  memcpy(value.data(), bytes_.data() + offset, mapBufferLength);
 
   return MapBuffer(std::move(value));
 }
@@ -146,23 +178,81 @@ std::vector<MapBuffer> MapBuffer::getMapBufferList(MapBuffer::Key key) const {
 
   std::vector<MapBuffer> mapBufferList;
   int32_t offset = getDynamicDataOffset() + getIntAtBucket(bucketIndex);
-  int32_t mapBufferListLength =
-      *reinterpret_cast<const int32_t*>(bytes_.data() + offset);
-  offset = offset + sizeof(uint32_t);
+  auto mapBufferListLength =
+      readUnaligned<int32_t>(bytes_.data(), lengthOffset(bucketIndex));
+  mapBufferListLength =
+      clampToBufferBounds(offset, mapBufferListLength, bytes_.size());
 
   int32_t curLen = 0;
   while (curLen < mapBufferListLength) {
-    int32_t mapBufferLength =
-        *reinterpret_cast<const int32_t*>(bytes_.data() + offset + curLen);
-    curLen = curLen + sizeof(uint32_t);
+    if (curLen + sizeof(int32_t) > mapBufferListLength) {
+      break;
+    }
+
+    auto mapBufferLength =
+        readUnaligned<int32_t>(bytes_.data(), offset + curLen);
+    curLen += sizeof(int32_t);
+
+    mapBufferLength =
+        clampToBufferBounds(offset + curLen, mapBufferLength, bytes_.size());
     std::vector<uint8_t> value(mapBufferLength);
     memcpy(value.data(), bytes_.data() + offset + curLen, mapBufferLength);
     mapBufferList.emplace_back(std::move(value));
-    curLen = curLen + mapBufferLength;
+    curLen += mapBufferLength;
   }
   return mapBufferList;
 }
 
+std::vector<int32_t> MapBuffer::getIntBuffer(MapBuffer::Key key) const {
+  auto bucketIndex = getKeyBucket(key);
+  react_native_assert(bucketIndex != -1 && "Key not found in MapBuffer");
+  if (bucketIndex == -1) {
+    return {};
+  }
+
+  int32_t offset = getDynamicDataOffset() + getIntAtBucket(bucketIndex);
+  auto byteLength =
+      readUnaligned<int32_t>(bytes_.data(), lengthOffset(bucketIndex));
+  byteLength = clampToBufferBounds(offset, byteLength, bytes_.size());
+  int32_t count = byteLength / static_cast<int32_t>(sizeof(int32_t));
+
+  std::vector<int32_t> result(count);
+  if (count > 0) {
+    // Copy only whole elements: a clamped byteLength may not be a multiple of
+    // sizeof(int32_t), and result holds exactly count elements.
+    memcpy(
+        result.data(),
+        bytes_.data() + offset,
+        static_cast<size_t>(count) * sizeof(int32_t));
+  }
+  return result;
+}
+
+std::vector<double> MapBuffer::getDoubleBuffer(MapBuffer::Key key) const {
+  auto bucketIndex = getKeyBucket(key);
+  react_native_assert(bucketIndex != -1 && "Key not found in MapBuffer");
+  if (bucketIndex == -1) {
+    return {};
+  }
+
+  int32_t offset = getDynamicDataOffset() + getIntAtBucket(bucketIndex);
+  auto byteLength =
+      readUnaligned<int32_t>(bytes_.data(), lengthOffset(bucketIndex));
+  byteLength = clampToBufferBounds(offset, byteLength, bytes_.size());
+  int32_t count = byteLength / static_cast<int32_t>(sizeof(double));
+
+  std::vector<double> result(count);
+  if (count > 0) {
+    // Copy only whole elements: a clamped byteLength may not be a multiple of
+    // sizeof(double), and result holds exactly count elements.
+    memcpy(
+        result.data(),
+        bytes_.data() + offset,
+        static_cast<size_t>(count) * sizeof(double));
+  }
+  return result;
+}
+
 size_t MapBuffer::size() const {
   return bytes_.size();
 }

package/ReactCommon/react/renderer/mapbuffer/MapBuffer.h

@@ -40,11 +40,11 @@ class JReadableMapBuffer;
  *
  * MapBuffer data is stored in a continuous chunk of memory (bytes_ field below) with the following layout:
  *
- * ┌─────────────────────Header──────────────────────┐
- * │                    10 bytes                     │
- * ├─Alignment─┬─Item count─┬──────Buffer size───────┤
- * │  2 bytes  │  2 bytes   │        4 bytes         │
- * └───────────┴────────────┴────────────────────────┘
+ * ┌──────Header──────┐
+ * │      2 bytes     │
+ * ├────Item count────┤
+ * │      2 bytes     │
+ * └──────────────────┘
  * ┌────────────────────────────────────────────────────────────────────────────────────────┐
  * │                           Buckets (one per item in the map)                            │
  * │                                                                                        │
@@ -69,14 +69,8 @@ class MapBuffer {
  public:
   using Key = uint16_t;
 
-  // The first value in the buffer, used to check correct encoding/endianness on
-  // JVM side.
-  constexpr static uint16_t HEADER_ALIGNMENT = 0xFE;
-
   struct Header {
-    uint16_t alignment = HEADER_ALIGNMENT; // alignment of serialization
     uint16_t count; // amount of items in the map
-    uint32_t bufferSize; // Amount of bytes used to store the map in memory
   };
 
 #pragma pack(push, 1)
@@ -89,13 +83,14 @@ class MapBuffer {
   };
 #pragma pack(pop)
 
-  static_assert(sizeof(Header) == 8, "MapBuffer header size is incorrect.");
+  static_assert(sizeof(Header) == 2, "MapBuffer header size is incorrect.");
   static_assert(sizeof(Bucket) == 12, "MapBuffer bucket size is incorrect.");
 
   /**
    * Data types available for serialization in MapBuffer
-   * Keep in sync with `DataType` enum in `JReadableMapBuffer.java`, which
-   * expects the same values after reading them through JNI.
+   * Keep in sync with the `DataType` enum in `MapBuffer.kt`
+   * (packages/react-native/ReactAndroid/.../common/mapbuffer/MapBuffer.kt),
+   * which is ordinal-indexed on the JVM side, so the order must match exactly.
    */
   enum DataType : uint16_t {
     Boolean = 0,
@@ -104,6 +99,19 @@ class MapBuffer {
     String = 3,
     Map = 4,
     Long = 5,
+    // Homogeneous arrays of raw elements stored contiguously in the dynamic
+    // data section. Unlike Map, they carry no per-element key/type overhead, so
+    // a batch of N values costs ~N*elementSize bytes instead of N*12-byte
+    // buckets. The bucket value packs [offset][byteLength]; the element count is
+    // recovered as byteLength / elementSize.
+    IntBuffer = 6,
+    DoubleBuffer = 7,
+    // A homogeneous, ordered array of nested MapBuffers. The bucket value packs
+    // [offset][byteLength] for the whole list region; within it each child stays
+    // framed as [int32 childSize][child bytes]. Distinct from `Map` so that a
+    // list of MapBuffers is self-describing (a single Map and a list are
+    // byte-distinct in payload but previously shared the `Map` type tag).
+    MapBufferList = 8,
   };
 
   explicit MapBuffer(std::vector<uint8_t> data);
@@ -131,6 +139,10 @@ class MapBuffer {
 
   std::vector<MapBuffer> getMapBufferList(MapBuffer::Key key) const;
 
+  std::vector<int32_t> getIntBuffer(MapBuffer::Key key) const;
+
+  std::vector<double> getDoubleBuffer(MapBuffer::Key key) const;
+
   size_t size() const;
 
   const uint8_t *data() const;

package/ReactCommon/react/renderer/mapbuffer/MapBufferBuilder.cpp

@@ -15,6 +15,14 @@ constexpr uint32_t LONG_SIZE = sizeof(uint64_t);
 constexpr uint32_t DOUBLE_SIZE = sizeof(double);
 constexpr uint32_t MAX_BUCKET_VALUE_SIZE = sizeof(uint64_t);
 
+// Dynamic-data entries store their location in the bucket's 8-byte value as
+// [offset (low 32 bits)][byteLength (high 32 bits)], so the payload in the
+// dynamic data section needs no in-band length prefix.
+static inline uint64_t packOffsetAndLength(int32_t offset, int32_t length) {
+  return static_cast<uint64_t>(static_cast<uint32_t>(offset)) |
+      (static_cast<uint64_t>(static_cast<uint32_t>(length)) << 32);
+}
+
 MapBuffer MapBufferBuilder::EMPTY() {
   return MapBufferBuilder(0).build();
 }
@@ -22,7 +30,6 @@ MapBuffer MapBufferBuilder::EMPTY() {
 MapBufferBuilder::MapBufferBuilder(uint32_t initialSize) {
   buckets_.reserve(initialSize);
   header_.count = 0;
-  header_.bufferSize = 0;
 }
 
 void MapBufferBuilder::storeKeyValue(
@@ -84,81 +91,111 @@ void MapBufferBuilder::putLong(MapBuffer::Key key, int64_t value) {
 }
 
 void MapBufferBuilder::putString(MapBuffer::Key key, const std::string& value) {
-  // The wire format encodes lengths and offsets as int32_t (see
-  // MapBuffer::getString). Without an explicit narrowing cast, `auto` deduces
-  // size_t (8 bytes on 64-bit) and `memcpy(&x, ..., INT_SIZE)` then copies only
-  // the first 4 bytes of an 8-byte value: silent truncation on little-endian,
-  // wrong (high) bytes on big-endian.
   auto strSize = static_cast<int32_t>(value.size());
-  const char* strData = value.data();
-
-  // format [length of string (int)] + [Array of Characters in the string]
   auto offset = static_cast<int32_t>(dynamicData_.size());
-  dynamicData_.resize(offset + INT_SIZE + strSize, 0);
-  memcpy(dynamicData_.data() + offset, &strSize, INT_SIZE);
-  memcpy(dynamicData_.data() + offset + INT_SIZE, strData, strSize);
 
-  // Store Key and pointer to the string
+  // The bucket stores [offset][byteLength]; the dynamic section holds only the
+  // raw string bytes.
+  dynamicData_.resize(offset + strSize, 0);
+  if (strSize > 0) {
+    memcpy(dynamicData_.data() + offset, value.data(), strSize);
+  }
+
+  uint64_t data = packOffsetAndLength(offset, strSize);
   storeKeyValue(
       key,
       MapBuffer::DataType::String,
-      reinterpret_cast<const uint8_t*>(&offset),
-      INT_SIZE);
+      reinterpret_cast<const uint8_t*>(&data),
+      sizeof(data));
 }
 
 void MapBufferBuilder::putMapBuffer(MapBuffer::Key key, const MapBuffer& map) {
-  // Wire format encodes lengths and offsets as int32_t (see
-  // MapBuffer::getMapBuffer). Cast explicitly so memcpy(&x, ..., INT_SIZE)
-  // copies the full value, not the first 4 bytes of an 8-byte size_t.
   auto mapBufferSize = static_cast<int32_t>(map.size());
-
   auto offset = static_cast<int32_t>(dynamicData_.size());
 
-  // format [length of buffer (int)] + [bytes of MapBuffer]
-  dynamicData_.resize(offset + INT_SIZE + mapBufferSize, 0);
-  memcpy(dynamicData_.data() + offset, &mapBufferSize, INT_SIZE);
-  // Copy the content of the map into dynamicData_
-  memcpy(dynamicData_.data() + offset + INT_SIZE, map.data(), mapBufferSize);
+  // The bucket stores [offset][byteLength]; the dynamic section holds only the
+  // serialized child MapBuffer bytes.
+  dynamicData_.resize(offset + mapBufferSize, 0);
+  memcpy(dynamicData_.data() + offset, map.data(), mapBufferSize);
 
-  // Store Key and pointer to the string
+  uint64_t data = packOffsetAndLength(offset, mapBufferSize);
   storeKeyValue(
       key,
       MapBuffer::DataType::Map,
-      reinterpret_cast<const uint8_t*>(&offset),
-      INT_SIZE);
+      reinterpret_cast<const uint8_t*>(&data),
+      sizeof(data));
 }
 
 void MapBufferBuilder::putMapBufferList(
     MapBuffer::Key key,
     const std::vector<MapBuffer>& mapBufferList) {
   auto offset = static_cast<int32_t>(dynamicData_.size());
-  int32_t dataSize = 0;
-  for (const MapBuffer& mapBuffer : mapBufferList) {
-    dataSize = dataSize + INT_SIZE + static_cast<int32_t>(mapBuffer.size());
-  }
-
-  dynamicData_.resize(offset + INT_SIZE, 0);
-  memcpy(dynamicData_.data() + offset, &dataSize, INT_SIZE);
 
+  // The bucket stores [offset][byteLength] for the whole list region; within it
+  // each child stays framed as [int32 childSize][child bytes] so the children
+  // remain individually delimited.
   for (const MapBuffer& mapBuffer : mapBufferList) {
     auto mapBufferSize = static_cast<int32_t>(mapBuffer.size());
-    auto dynamicDataSize = static_cast<int32_t>(dynamicData_.size());
-    dynamicData_.resize(dynamicDataSize + INT_SIZE + mapBufferSize, 0);
-    // format [length of buffer (int)] + [bytes of MapBuffer]
-    memcpy(dynamicData_.data() + dynamicDataSize, &mapBufferSize, INT_SIZE);
-    // Copy the content of the map into dynamicData_
+    auto pos = static_cast<int32_t>(dynamicData_.size());
+    dynamicData_.resize(pos + INT_SIZE + mapBufferSize, 0);
+    memcpy(dynamicData_.data() + pos, &mapBufferSize, INT_SIZE);
     memcpy(
-        dynamicData_.data() + dynamicDataSize + INT_SIZE,
-        mapBuffer.data(),
-        mapBufferSize);
+        dynamicData_.data() + pos + INT_SIZE, mapBuffer.data(), mapBufferSize);
   }
 
-  // Store Key and pointer to the string
+  auto totalSize = static_cast<int32_t>(dynamicData_.size()) - offset;
+  uint64_t data = packOffsetAndLength(offset, totalSize);
+  // Uses the dedicated MapBufferList type so the entry is self-describing and
+  // distinguishable from a single Map.
   storeKeyValue(
       key,
-      MapBuffer::DataType::Map,
-      reinterpret_cast<const uint8_t*>(&offset),
-      INT_SIZE);
+      MapBuffer::DataType::MapBufferList,
+      reinterpret_cast<const uint8_t*>(&data),
+      sizeof(data));
+}
+
+void MapBufferBuilder::putIntBuffer(
+    MapBuffer::Key key,
+    const std::vector<int32_t>& value) {
+  // The bucket stores [offset][byteLength]; the dynamic section holds the raw
+  // int32 elements. Element count is recovered as byteLength / sizeof(int32_t).
+  auto payloadSize = static_cast<int32_t>(value.size() * sizeof(int32_t));
+  auto offset = static_cast<int32_t>(dynamicData_.size());
+  dynamicData_.resize(offset + payloadSize, 0);
+  if (payloadSize > 0) {
+    memcpy(dynamicData_.data() + offset, value.data(), payloadSize);
+  }
+
+  uint64_t data = packOffsetAndLength(offset, payloadSize);
+  storeKeyValue(
+      key,
+      MapBuffer::DataType::IntBuffer,
+      reinterpret_cast<const uint8_t*>(&data),
+      sizeof(data));
+}
+
+void MapBufferBuilder::putDoubleBuffer(
+    MapBuffer::Key key,
+    const std::vector<double>& value) {
+  // The bucket stores [offset][byteLength]; the dynamic section holds the raw
+  // double elements. Element count is recovered as byteLength / sizeof(double).
+  // Doubles are copied byte-for-byte; the reader uses memcpy, so the payload
+  // needs no special alignment for correctness. A consumer that wants a
+  // zero-copy typed view on the JVM (ByteBuffer::asDoubleBuffer) must ensure
+  // 8-byte alignment itself.
+  auto payloadSize = static_cast<int32_t>(value.size() * sizeof(double));
+  auto offset = static_cast<int32_t>(dynamicData_.size());
+  dynamicData_.resize(offset + payloadSize, 0);
+  if (payloadSize > 0) {
+    memcpy(dynamicData_.data() + offset, value.data(), payloadSize);
+  }
+
+  uint64_t data = packOffsetAndLength(offset, payloadSize);
+  storeKeyValue(
+      key,
+      MapBuffer::DataType::DoubleBuffer,
+      reinterpret_cast<const uint8_t*>(&data),
+      sizeof(data));
 }
 
 static inline bool compareBuckets(
@@ -173,8 +210,6 @@ MapBuffer MapBufferBuilder::build() {
   auto headerSize = sizeof(MapBuffer::Header);
   auto bufferSize = headerSize + bucketSize + dynamicData_.size();
 
-  header_.bufferSize = static_cast<uint32_t>(bufferSize);
-
   if (needsSort_) {
     std::sort(buckets_.begin(), buckets_.end(), compareBuckets);
   }
@@ -183,11 +218,19 @@ MapBuffer MapBufferBuilder::build() {
 
   std::vector<uint8_t> buffer(bufferSize);
   memcpy(buffer.data(), &header_, headerSize);
-  memcpy(buffer.data() + headerSize, buckets_.data(), bucketSize);
-  memcpy(
-      buffer.data() + headerSize + bucketSize,
-      dynamicData_.data(),
-      dynamicData_.size());
+  // buckets_.data() / dynamicData_.data() return nullptr when the vector is
+  // empty; passing nullptr to memcpy is UB even with size 0 (glibc marks the
+  // src argument nonnull) and trips UBSan halt-on-error on empty / scalar-only
+  // MapBuffers.
+  if (!buckets_.empty()) {
+    memcpy(buffer.data() + headerSize, buckets_.data(), bucketSize);
+  }
+  if (!dynamicData_.empty()) {
+    memcpy(
+        buffer.data() + headerSize + bucketSize,
+        dynamicData_.data(),
+        dynamicData_.size());
+  }
 
   return MapBuffer(std::move(buffer));
 }

package/ReactCommon/react/renderer/mapbuffer/MapBufferBuilder.h

@@ -39,6 +39,10 @@ class MapBufferBuilder {
 
   void putMapBufferList(MapBuffer::Key key, const std::vector<MapBuffer> &mapBufferList);
 
+  void putIntBuffer(MapBuffer::Key key, const std::vector<int32_t> &value);
+
+  void putDoubleBuffer(MapBuffer::Key key, const std::vector<double> &value);
+
   MapBuffer build();
 
  private:

package/ReactCommon/react/renderer/mapbuffer/tests/MapBufferTest.cpp

@@ -49,7 +49,7 @@ TEST(MapBufferTest, testSimpleLongMap) {
 }
 
 TEST(MapBufferTest, testMapBufferExtension) {
-  // 26 = 2 buckets: 2*10 + 6 sizeof(header)
+  // initialSize is a reserve hint for the number of buckets
   int initialSize = 26;
   auto buffer = MapBufferBuilder(initialSize);
 
@@ -205,6 +205,101 @@ TEST(MapBufferTest, testMapListEntries) {
   EXPECT_EQ(mapBufferList2[1].getDouble(3), 908.1);
 }
 
+TEST(MapBufferTest, testEmptyMapBufferList) {
+  auto builder = MapBufferBuilder();
+
+  builder.putMapBufferList(0, {});
+  auto map = builder.build();
+
+  EXPECT_EQ(map.getMapBufferList(0).size(), 0);
+}
+
+// Place the list behind another dynamic-data entry so its offset is non-zero,
+// exercising `getDynamicDataOffset() + getIntAtBucket(...)` against a non-zero
+// base rather than the zero-offset path testMapListEntries covers.
+TEST(MapBufferTest, testMapListEntriesAtNonZeroOffset) {
+  std::vector<MapBuffer> mapBufferList;
+  auto inner = MapBufferBuilder();
+  inner.putString(0, "inner");
+  inner.putInt(1, 42);
+  mapBufferList.push_back(inner.build());
+
+  auto builder = MapBufferBuilder();
+  builder.putString(0, "prefix");
+  builder.putMapBufferList(1, mapBufferList);
+  auto map = builder.build();
+
+  EXPECT_EQ(map.getString(0), "prefix");
+  std::vector<MapBuffer> readList = map.getMapBufferList(1);
+  EXPECT_EQ(readList.size(), 1);
+  EXPECT_EQ(readList[0].getString(0), "inner");
+  EXPECT_EQ(readList[0].getInt(1), 42);
+}
+
+TEST(MapBufferTest, testIntBufferEntries) {
+  auto builder = MapBufferBuilder();
+
+  std::vector<int32_t> values{
+      1,
+      -2,
+      3,
+      std::numeric_limits<int32_t>::min(),
+      std::numeric_limits<int32_t>::max()};
+  builder.putIntBuffer(0, values);
+  auto map = builder.build();
+
+  EXPECT_EQ(map.count(), 1);
+  EXPECT_EQ(map.getIntBuffer(0), values);
+}
+
+TEST(MapBufferTest, testEmptyIntBuffer) {
+  auto builder = MapBufferBuilder();
+
+  builder.putIntBuffer(0, {});
+  auto map = builder.build();
+
+  EXPECT_EQ(map.getIntBuffer(0).size(), 0);
+}
+
+TEST(MapBufferTest, testDoubleBufferEntries) {
+  auto builder = MapBufferBuilder();
+
+  std::vector<double> values{0.0, -1.5, 3.14159, 1e300, -1e-300};
+  builder.putDoubleBuffer(0, values);
+  auto map = builder.build();
+
+  EXPECT_EQ(map.count(), 1);
+  EXPECT_EQ(map.getDoubleBuffer(0), values);
+}
+
+TEST(MapBufferTest, testEmptyDoubleBuffer) {
+  auto builder = MapBufferBuilder();
+
+  builder.putDoubleBuffer(0, {});
+  auto map = builder.build();
+
+  EXPECT_EQ(map.getDoubleBuffer(0).size(), 0);
+}
+
+// Mirrors the batched-animated-props use case: a pair of typed streams plus
+// some scalar metadata, with keys inserted out of order to exercise both the
+// dynamic-data section and the bucket sort path.
+TEST(MapBufferTest, testIntAndDoubleBuffersAlongsideScalars) {
+  std::vector<int32_t> intStream{1, 100, 1, 2, 4, 15, 4};
+  std::vector<double> doubleStream{0.5, 12.0, 0.25};
+
+  auto builder = MapBufferBuilder();
+  builder.putDoubleBuffer(2, doubleStream);
+  builder.putInt(0, 7);
+  builder.putIntBuffer(1, intStream);
+  auto map = builder.build();
+
+  EXPECT_EQ(map.count(), 3);
+  EXPECT_EQ(map.getInt(0), 7);
+  EXPECT_EQ(map.getIntBuffer(1), intStream);
+  EXPECT_EQ(map.getDoubleBuffer(2), doubleStream);
+}
+
 TEST(MapBufferTest, testMapRandomAccess) {
   auto builder = MapBufferBuilder();
   builder.putInt(1234, 4321);