expo-modules-core 57.0.2 → 57.0.4

package/ios/Core/SharedObjects/SharedObjectRegistry.swift

@@ -12,21 +12,6 @@ public typealias SharedObjectId = Int
  */
 let sharedObjectIdPropertyName = "__expo_shared_object_id__"
 
-/**
- A pair of matching native and JS objects. Uses a weak reference to the JS object
- so that the registry doesn't prevent JS garbage collection. The C++ NativeState
- deallocator removes the pair from the registry when the JS object is collected.
- */
-internal final class SharedObjectPair: @unchecked Sendable {
-  let native: SharedObject
-  let javaScript: JavaScriptWeakObject
-
-  init(native: SharedObject, javaScript: consuming JavaScriptWeakObject) {
-    self.native = native
-    self.javaScript = javaScript
-  }
-}
-
 /**
  The registry of shared objects.
  */
@@ -36,15 +21,20 @@ public final class SharedObjectRegistry: Sendable {
    */
   private weak let appContext: AppContext?
 
-  internal struct State: Sendable {
+  // `@unchecked` because `SharedObjectNativeState` isn't `Sendable` (its JSI base class isn't), yet a
+  // value escapes `withLock` whenever `get`/the lookups return it. Access is always serialized through
+  // `state`'s `Mutex` and the callers run on `JavaScriptActor`, so the unchecked assertion is sound.
+  internal struct State: @unchecked Sendable {
     /**
-     A dictionary of shared object pairs.
+     Maps each shared object id to the native object's `SharedObjectNativeState`, which carries the
+     native object and its per-runtime JS counterparts. The state is held strongly so an id stays
+     resolvable via `get(_:)` until an explicit `delete(_:)`, independent of JS garbage collection.
      */
-    var pairs = [SharedObjectId: SharedObjectPair]()
+    var pairs = [SharedObjectId: SharedObjectNativeState]()
 
     /**
-     The counter of IDs to assign to the shared object pairs.
-     The next pair added to the registry will be saved using this ID.
+     The counter of IDs to assign to the shared objects.
+     The next object added to the registry will be saved using this ID.
      */
     var nextId: SharedObjectId = 1
   }
@@ -89,9 +79,10 @@ public final class SharedObjectRegistry: Sendable {
   }
 
   /**
-   Returns a pair of shared objects with given ID or `nil` when there is no such pair in the registry.
+   Returns the native state registered under the given ID, or `nil` when there is no such entry.
+   The state carries the native object (`native`) and its per-runtime JS counterparts.
    */
-  internal func get(_ id: SharedObjectId) -> SharedObjectPair? {
+  internal func get(_ id: SharedObjectId) -> SharedObjectNativeState? {
     return state.withLock { state in
       return state.pairs[id]
     }
@@ -102,7 +93,10 @@ public final class SharedObjectRegistry: Sendable {
    */
   @discardableResult
   internal func add(native nativeObject: SharedObject, javaScript jsObject: borrowing JavaScriptObject) -> SharedObjectId {
-    let id = pullNextId()
+    // A native object that already carries a native state was paired in an earlier runtime. Reuse its
+    // id rather than minting a new one: the C++ `NativeState.objectId` is immutable and drives the
+    // releaser/`delete`, so a fresh id would disagree with it and leak this object's registry entry.
+    let id = nativeObject.nativeState != nil ? nativeObject.sharedObjectId : pullNextId()
 
     // Assign the ID and the app context to the object.
     nativeObject.sharedObjectId = id
@@ -122,32 +116,48 @@ public final class SharedObjectRegistry: Sendable {
       jsObject.setExternalMemoryPressure(memoryPressure)
     }
 
-    // Save the pair in the dictionary with a weak reference to the JS object.
-    state.withLock { state in
-      state.pairs[id] = SharedObjectPair(native: nativeObject, javaScript: jsObject.createWeak())
-    }
-
     // Attach the C++ shared-object native state. Because `expo::SharedObject::NativeState`
     // inherits from `expo::EventEmitter::NativeState`, later `addListener` calls see an
     // existing native state (via the inheritance check) and don't overwrite it.
-    let releaser: ObjectReleaser = { [weak self] id in
-      self?.delete(id)
-    }
-    let nativeState = SharedObjectNativeState(native: nativeObject) { context, deallocator in
-      return SharedObjectUtils.makeSharedObjectNativeStatePtr(
-        objectId: id,
-        releaser: releaser,
-        context: context,
-        contextDeallocator: deallocator
-      )
+    //
+    // A native object may already carry a native state from a previous pairing in another runtime.
+    // Reuse it so all runtimes share one native state (and one underlying C++ pointee, via
+    // `acquireShared`); a fresh state per runtime would leave `nativeObject.nativeState` pointing at
+    // whichever ran last and lose the earlier runtimes' pairings.
+    let nativeState = nativeObject.nativeState ?? {
+      let releaser: ObjectReleaser = { [weak self] id in
+        self?.delete(id)
+      }
+      let state = SharedObjectNativeState(native: nativeObject) { context, deallocator in
+        return SharedObjectUtils.makeSharedObjectNativeStatePtr(
+          objectId: id,
+          releaser: releaser,
+          context: context,
+          contextDeallocator: deallocator
+        )
+      }
+      nativeObject.nativeState = state
+      return state
+    }()
+
+    // Index the native state by id. One entry per native object: re-pairing in another runtime stores
+    // the same state under the same id (idempotent); the per-runtime JS counterparts live on the state.
+    state.withLock { state in
+      state.pairs[id] = nativeState
     }
+
     // setNativeState calls acquireShared() synchronously, which retains `nativeState`
     // via Unmanaged.passRetained. That's the wrapper's only strong reference — once
-    // the C++ pointee dies, the contextDeallocator releases it. The local going out
-    // of scope here is intentional.
+    // the C++ pointee dies, the contextDeallocator releases it. Reattaching the same
+    // native state to another runtime's JS object reuses that same C++ pointee.
     jsObject.setNativeState(nativeState)
-    nativeState.pairedWeakObject = jsObject.createWeak()
-    nativeObject.nativeState = nativeState
+
+    // The registry is scoped to its app context, so the JS object being paired here lives in that
+    // context's runtime. Record the pairing under that runtime so the native object can recover this
+    // JS counterpart via `native.nativeState?.javaScriptObject(in:)`.
+    if let runtime = try? appContext?.runtime {
+      nativeState.setJavaScriptObject(jsObject, in: runtime)
+    }
 
     return id
   }
@@ -157,14 +167,15 @@ public final class SharedObjectRegistry: Sendable {
    */
   internal func delete(_ id: SharedObjectId) {
     state.withLock { state in
-      if let pair = state.pairs[id] {
-        pair.native.sharedObjectWillRelease()
-        // Reset an ID on the objects.
-        pair.native.sharedObjectId = 0
+      if let nativeState = state.pairs[id] {
+        let native = nativeState.native
+        native.sharedObjectWillRelease()
+        // Reset an ID on the object.
+        native.sharedObjectId = 0
 
-        // Delete the pair from the dictionary.
+        // Delete the entry from the dictionary.
         state.pairs[id] = nil
-        pair.native.sharedObjectDidRelease()
+        native.sharedObjectDidRelease()
       }
     }
   }
@@ -200,25 +211,29 @@ public final class SharedObjectRegistry: Sendable {
    */
   @JavaScriptActor
   internal func toJavaScriptValue(sharedObjectId id: SharedObjectId) -> JavaScriptValue? {
-    let pair = state.withLock { state in
+    guard let runtime = try? appContext?.runtime else {
+      return nil
+    }
+    let nativeState = state.withLock { state in
       return state.pairs[id]
     }
-    return pair?.javaScript.lock()?.asValue()
+    return nativeState?.javaScriptObject(in: runtime)?.asValue()
   }
 
   /**
-   Gets the JS shared object that is paired with a given native object.
+   Gets the JS shared object that is paired with a given native object in this registry's runtime.
    */
   internal func toJavaScriptObject(_ nativeObject: SharedObject) -> JavaScriptObject? {
-    if let pairedObject = nativeObject.nativeState?.pairedWeakObject?.lock() {
-      return pairedObject
+    guard let runtime = try? appContext?.runtime else {
+      return nil
     }
-    // Fallback to the id-based lookup for cases where the native object was registered
-    // through a path that doesn't attach a `SharedObjectNativeState`.
-    let pair = state.withLock { state in
+    // The id table and the native object both resolve to the same `SharedObjectNativeState`, which
+    // owns the per-runtime JS counterparts, so a single lookup serves both. Prefer the native object's
+    // own back-pointer and fall back to the id table for objects whose back-pointer was cleared.
+    let nativeState = nativeObject.nativeState ?? state.withLock { state in
       return state.pairs[nativeObject.sharedObjectId]
     }
-    return pair?.javaScript.lock()
+    return nativeState?.javaScriptObject(in: runtime)
   }
 
   /**

package/ios/Core/Views/SwiftUI/ExpoSwiftUI.swift

@@ -19,6 +19,18 @@ extension ExpoSwiftUI {
     func forceResignFirstResponder()
   }
 
+  /**
+   Protocol for virtual views that can resign the first responder anywhere within their subtree,
+   not just on the view itself. Unlike `FocusableView`, this walks nested children so a focused
+   field wrapped in a container (e.g. a `TextField` inside an `HStack` or `LabeledContent`) is
+   also blurred on unmount, which `FocusableView` alone would miss.
+   See https://github.com/expo/expo/issues/47682
+   */
+  internal protocol FocusableViewContainer {
+    @MainActor
+    func resignFirstResponderInSubtree()
+  }
+
   /**
    Protocol for wrapper views (e.g., UIBaseView) that wrap an inner view.
    Used by DynamicSwiftUIViewType to resolve the underlying view through wrapper layers.

package/ios/Core/Views/SwiftUI/SwiftUIVirtualView.swift

@@ -123,7 +123,7 @@ extension ExpoSwiftUI {
     }
 
     override func removeFromSuperview() {
-      virtualViewRemoveFromSuperview(contentView: contentView)
+      resignFirstResponderInSubtree()
       super.removeFromSuperview()
     }
 
@@ -146,6 +146,12 @@ extension ExpoSwiftUI {
   }
 }
 
+extension ExpoSwiftUI.SwiftUIVirtualView: ExpoSwiftUI.FocusableViewContainer {
+  func resignFirstResponderInSubtree() {
+    virtualViewResignFirstResponderInSubtree(contentView: contentView, children: props.children)
+  }
+}
+
 // MARK: - ViewWrapper (Production)
 
 extension ExpoSwiftUI.SwiftUIVirtualView: @MainActor ExpoSwiftUI.ViewWrapper {
@@ -283,7 +289,7 @@ extension ExpoSwiftUI {
     }
 
     override func removeFromSuperview() {
-      virtualViewRemoveFromSuperview(contentView: contentView)
+      resignFirstResponderInSubtree()
       super.removeFromSuperview()
     }
 
@@ -306,6 +312,12 @@ extension ExpoSwiftUI {
   }
 }
 
+extension ExpoSwiftUI.SwiftUIVirtualViewDev: ExpoSwiftUI.FocusableViewContainer {
+  func resignFirstResponderInSubtree() {
+    virtualViewResignFirstResponderInSubtree(contentView: contentView, children: props.children)
+  }
+}
+
 // MARK: - ViewWrapper (Dev)
 
 extension ExpoSwiftUI.SwiftUIVirtualViewDev: @MainActor ExpoSwiftUI.ViewWrapper {
@@ -375,10 +387,14 @@ private func virtualViewUnmountChild<Props: ExpoSwiftUI.ViewProps>(_ childCompon
   }
 }
 
-private func virtualViewRemoveFromSuperview<ContentView: SwiftUI.View>(contentView: ContentView) {
-  // When the view is unmounted, the focus on TextFieldView stays active and it causes a crash, so we blur it here
-  // UIView does something similar to resign the first responder in removeFromSuperview, so we do the same for our virtual view
+@MainActor
+private func virtualViewResignFirstResponderInSubtree<ContentView: SwiftUI.View>(
+  contentView: ContentView, children: [any ExpoSwiftUI.AnyChild]?) {
+  // Mirror UIView.removeFromSuperview, which resigns the first responder for a view and its subviews;
+  // a field left first responder during SwiftUI's teardown crashes. Recurse into children so one
+  // nested in a container (HStack, LabeledContent, …) is resigned too. https://github.com/expo/expo/issues/47682
   if let focusableView = contentView as? any ExpoSwiftUI.FocusableView {
     focusableView.forceResignFirstResponder()
   }
+  children?.forEach { ($0 as? any ExpoSwiftUI.FocusableViewContainer)?.resignFirstResponderInSubtree() }
 }

package/ios/JS/EXReactSchedulerDispatch.h

@@ -4,24 +4,55 @@
 
 #ifdef __cplusplus
 
+#include <memory>
+
+namespace facebook::react {
+class RuntimeScheduler;
+} // namespace facebook::react
+
 namespace expo {
 
 /**
- Trampoline that `ExpoModulesJSI` calls to dispatch work onto the JS thread.
- Casts the `nativeScheduler` pointer back to a `react::RuntimeScheduler *` and
- calls `scheduleTask` on it. The signature matches `expo::RuntimeScheduler::ScheduleFn`
- declared in the xcframework's `RuntimeScheduler.h`.
+ Creates an opaque handle for `dispatchOnReactScheduler` that references the given React
+ runtime scheduler weakly. Returns `nullptr` when the scheduler is `nullptr` (e.g. no
+ `RuntimeSchedulerBinding` was installed).
+
+ The handle is never freed by design. Dispatch calls are bounded only by the lifetime of the
+ `JavaScriptRuntime` wrapper, which any escaped closure can extend past every point at which
+ the handle could be safely deleted. Each runtime creation therefore leaks the handle and,
+ because React Native allocates the scheduler with `std::make_shared`, the weak reference
+ also keeps the scheduler's storage from being reclaimed after its destruction. That cost
+ is small and bounded, unlike the use-after-free it prevents.
+ */
+void *createReactSchedulerHandle(const std::shared_ptr<facebook::react::RuntimeScheduler> &scheduler);
+
+/**
+ Trampoline that `ExpoModulesJSI` calls to dispatch work onto the JS thread. Locks the
+ scheduler weakly referenced by the handle (created with `createReactSchedulerHandle`) and
+ calls `scheduleTask` on it. The React instance owns the scheduler and destroys it on
+ teardown (e.g. reload) while native code may still dispatch through a retained
+ `JavaScriptRuntime`, so when the scheduler is gone (or the handle is `nullptr` because
+ no scheduler existed at creation) the task is dropped instead of dereferencing freed
+ memory. The signature matches `expo::RuntimeScheduler::ScheduleFn` declared in the
+ xcframework's `RuntimeScheduler.h`.
+
+ A narrow edge remains: when the lock races the React instance's final release, this
+ thread becomes the scheduler's last owner and runs its destructor once `scheduleTask`
+ returns, off the JS thread and potentially after the runtime is gone, destroying
+ still-queued tasks that may hold JSI values. React Native's own
+ `RuntimeSchedulerCallInvoker` locks the same weak reference to schedule work, so this
+ matches upstream behavior.
 
  Lives in ExpoModulesCore (rather than in the xcframework) so that
  ExpoModulesJSI.framework's prebuilt binary doesn't need to link against
- React-runtimescheduler — important for source-built RN, where those symbols
+ React-runtimescheduler. That matters for source-built RN, where those symbols
  are hidden after link and unreachable via -undefined dynamic_lookup.
 
  Hosts that initialize their own runtime (e.g. ExpoReactNativeFactory, Expo Go)
  pass `&expo::dispatchOnReactScheduler` as the `dispatch` argument to
- `AppContext.setRuntime`.
+ `AppContext.setRuntime`, with the handle as the `scheduler` argument.
  */
-void dispatchOnReactScheduler(void *nativeScheduler, int priority, void (^callback)()) noexcept;
+void dispatchOnReactScheduler(void *schedulerHandle, int priority, void (^callback)()) noexcept;
 
 } // namespace expo
 

package/ios/JS/EXReactSchedulerDispatch.mm

@@ -6,9 +6,36 @@
 
 namespace expo {
 
-void dispatchOnReactScheduler(void *nativeScheduler, int priority, void (^callback)()) noexcept
+namespace {
+
+struct SchedulerHandle {
+  std::weak_ptr<facebook::react::RuntimeScheduler> scheduler;
+};
+
+} // namespace
+
+void *createReactSchedulerHandle(const std::shared_ptr<facebook::react::RuntimeScheduler> &scheduler)
+{
+  if (!scheduler) {
+    return nullptr;
+  }
+  return new SchedulerHandle{scheduler};
+}
+
+void dispatchOnReactScheduler(void *schedulerHandle, int priority, void (^callback)()) noexcept
 {
-  auto *scheduler = static_cast<facebook::react::RuntimeScheduler *>(nativeScheduler);
+  auto *handle = static_cast<SchedulerHandle *>(schedulerHandle);
+  if (handle == nullptr) {
+    // `createReactSchedulerHandle` returns null when there was no scheduler to reference.
+    // Drop the task so callers don't have to guard the handle/dispatch pair themselves.
+    return;
+  }
+  // Locking either keeps the scheduler alive for the duration of `scheduleTask` or reports
+  // that the React instance already destroyed it, in which case the task is dropped.
+  auto scheduler = handle->scheduler.lock();
+  if (!scheduler) {
+    return;
+  }
   scheduler->scheduleTask(
     static_cast<facebook::react::SchedulerPriority>(priority),
     [callback](facebook::jsi::Runtime &) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-modules-core",
-  "version": "57.0.2",
+  "version": "57.0.4",
   "description": "The core of Expo Modules architecture",
   "main": "src/index.ts",
   "types": "build/index.d.ts",
@@ -46,8 +46,8 @@
     "preset": "expo-module-scripts"
   },
   "dependencies": {
-    "@expo/expo-modules-macros-plugin": "0.3.0",
-    "expo-modules-jsi": "~57.0.0",
+    "@expo/expo-modules-macros-plugin": "0.6.1",
+    "expo-modules-jsi": "~57.0.2",
     "invariant": "^2.2.4"
   },
   "peerDependencies": {
@@ -66,7 +66,7 @@
     "@types/invariant": "^2.2.33",
     "expo-module-scripts": "56.0.3"
   },
-  "gitHead": "5104cb89c3938bc9653e0cbad43da3a43a2e77a7",
+  "gitHead": "70af1caf83d8a324b46e02e18cd5c8c4e310da20",
   "scripts": {
     "build": "expo-module build",
     "clean": "expo-module clean",