react-native-tvos 0.86.0-2 → 0.87.0-0

package/ReactCommon/react/renderer/scheduler/tests/SchedulerDelegateInvalidationTest.cpp

@@ -0,0 +1,671 @@
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+// Standalone reproduction of the use-after-free race between Scheduler
+// teardown and pending rendering-update lambdas previously enqueued via
+// runtimeScheduler_->scheduleRenderingUpdate inside
+// Scheduler::uiManagerDidFinishTransaction (and its sibling
+// uiManagerDidDispatchCommand). The lambda captures the delegate by raw
+// pointer; if the delegate is destroyed (as part of an instance teardown
+// triggered by an uncaught fatal error) before the lambda runs, the
+// dereference is a use-after-free unless the invalidation-token guard in
+// Scheduler::setDelegate is enabled at queue time.
+//
+// The test drives the *real* Scheduler::uiManagerDidFinishTransaction so the
+// rendering-update lambda is enqueued via the regular code path into a real
+// RuntimeScheduler's pending-rendering-updates queue. The teardown is
+// initiated by an uncaught JSI host-function throw routed through
+// RuntimeScheduler's onTaskError callback (the test's analog of the host
+// fatal handler), then we trigger an event loop tick to drain the queue.
+//
+// Fantom is intentionally not used here: it shares the global runtime VM
+// across tests, which would interfere with this test's contract that no
+// further JS executes after a fatal-driven instance teardown.
+
+#include <gtest/gtest.h>
+#include <hermes/hermes.h>
+#include <jsi/jsi.h>
+
+#include <ReactCommon/RuntimeExecutor.h>
+#include <react/featureflags/ReactNativeFeatureFlags.h>
+#include <react/featureflags/ReactNativeFeatureFlagsDefaults.h>
+#include <react/renderer/componentregistry/ComponentDescriptorProviderRegistry.h>
+#include <react/renderer/components/root/RootComponentDescriptor.h>
+#include <react/renderer/components/root/RootProps.h>
+#include <react/renderer/components/view/ViewComponentDescriptor.h>
+#include <react/renderer/core/EventBeat.h>
+#include <react/renderer/core/EventDispatcher.h>
+#include <react/renderer/element/ComponentBuilder.h>
+#include <react/renderer/element/Element.h>
+#include <react/renderer/element/testUtils.h>
+#include <react/renderer/mounting/MountingCoordinator.h>
+#include <react/renderer/mounting/ShadowTreeRevision.h>
+#include <react/renderer/runtimescheduler/RuntimeScheduler.h>
+#include <react/renderer/scheduler/Scheduler.h>
+#include <react/renderer/scheduler/SchedulerDelegate.h>
+#include <react/renderer/scheduler/SchedulerToolbox.h>
+#include <react/renderer/scheduler/SurfaceHandler.h>
+#include <react/renderer/telemetry/TransactionTelemetry.h>
+#include <react/renderer/uimanager/primitives.h>
+#include <react/utils/ContextContainer.h>
+
+#include <folly/dynamic.h>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <queue>
+#include <utility>
+
+namespace facebook::react {
+
+namespace {
+
+// Magic sentinels embedded in RecordingDelegate to detect post-destruction
+// access without requiring AddressSanitizer. The destructor flips kAlive ->
+// kDestroyed as its first action; if a captured raw pointer is dereferenced
+// after the destructor ran, the next read of aliveMagic_ will either see
+// kDestroyed (best case) or whatever stomped the slab on heap reuse — both
+// will fail the ASSERT_EQ check inside the recording delegate's methods.
+constexpr uint64_t kAlive = 0xA11FED01A11FED01ULL;
+constexpr uint64_t kDestroyed = 0xDEADBEEFDEADBEEFULL;
+
+// Minimal SchedulerDelegate that records calls and, more importantly, guards
+// every method body with a magic-sentinel check so a use-after-free shows up
+// as an explicit gtest failure (or, when the binary runs under ASan, the
+// sanitizer trips on the vptr load before our check even runs). aliveMagic_
+// is intentionally the first member so it sits at a predictable offset for
+// debugger / ASan inspection.
+class RecordingDelegate : public SchedulerDelegate {
+ public:
+  RecordingDelegate() = default;
+
+  ~RecordingDelegate() noexcept override {
+    aliveMagic_ = kDestroyed;
+  }
+
+  void schedulerDidFinishTransaction(
+      const std::shared_ptr<const MountingCoordinator>& /*unused*/) override {
+    ASSERT_EQ(aliveMagic_, kAlive)
+        << "schedulerDidFinishTransaction invoked after delegate destruction";
+    ++didFinishTransactionCount_;
+  }
+
+  void schedulerShouldRenderTransactions(
+      const std::shared_ptr<const MountingCoordinator>& /*unused*/) override {
+    // This is the call the rendering-update lambda makes inside
+    // Scheduler::uiManagerDidFinishTransaction. Reaching this method with
+    // the magic sentinel flipped means the lambda raced past delegate
+    // destruction — the use-after-free this test is designed to detect.
+    ASSERT_EQ(aliveMagic_, kAlive)
+        << "schedulerShouldRenderTransactions invoked after delegate "
+        << "destruction (use-after-free)";
+    ++shouldRenderTransactionsCount_;
+  }
+
+  void schedulerShouldMergeReactRevision(SurfaceId /*unused*/) override {}
+  void schedulerDidRequestPreliminaryViewAllocation(
+      const ShadowNode& /*unused*/) override {}
+  void schedulerDidDispatchCommand(
+      const ShadowView& /*unused*/,
+      const std::string& commandName,
+      const folly::dynamic& /*unused*/) override {
+    // Mirrors the schedulerShouldRenderTransactions guard above. This is the
+    // call the rendering-update lambda enqueued by
+    // Scheduler::uiManagerDidDispatchCommand makes (e.g. for `scrollTo`).
+    ASSERT_EQ(aliveMagic_, kAlive)
+        << "schedulerDidDispatchCommand invoked after delegate destruction "
+        << "(commandName=" << commandName << ")";
+    ++didDispatchCommandCount_;
+  }
+  void schedulerDidSendAccessibilityEvent(
+      const ShadowView& /*unused*/,
+      const std::string& /*unused*/) override {}
+  void schedulerDidSetIsJSResponder(
+      const ShadowView& /*unused*/,
+      bool /*unused*/,
+      bool /*unused*/) override {}
+  void schedulerShouldSynchronouslyUpdateViewOnUIThread(
+      Tag /*unused*/,
+      const folly::dynamic& /*unused*/) override {}
+  void schedulerDidUpdateShadowTree(
+      const std::unordered_map<Tag, folly::dynamic>& /*unused*/) override {}
+  void schedulerDidCaptureViewSnapshot(Tag /*unused*/, SurfaceId /*unused*/)
+      override {}
+  void schedulerDidSetViewSnapshot(
+      Tag /*unused*/,
+      Tag /*unused*/,
+      SurfaceId /*unused*/) override {}
+  void schedulerDidClearPendingSnapshots() override {}
+
+  int didFinishTransactionCount() const {
+    return didFinishTransactionCount_;
+  }
+  int shouldRenderTransactionsCount() const {
+    return shouldRenderTransactionsCount_;
+  }
+  int didDispatchCommandCount() const {
+    return didDispatchCommandCount_;
+  }
+
+ private:
+  uint64_t aliveMagic_{kAlive};
+  int didFinishTransactionCount_{0};
+  int shouldRenderTransactionsCount_{0};
+  int didDispatchCommandCount_{0};
+};
+
+// EventBeat stub. Scheduler instantiates one through the toolbox factory but
+// our test never drives any platform-side beat, so the default request() and
+// induce() implementations (which assume a scheduler-backed beat) are fine.
+class StubEventBeat : public EventBeat {
+ public:
+  StubEventBeat(
+      std::shared_ptr<OwnerBox> ownerBox,
+      RuntimeScheduler& runtimeScheduler)
+      : EventBeat(std::move(ownerBox), runtimeScheduler) {}
+};
+
+// A FIFO of work items installed as the runtime executor. The test drains it
+// explicitly via tick()/flush() so the JS thread's progress is fully under
+// test control relative to teardown. This keeps the cascade ordering
+// deterministic across runs.
+class TestExecutorQueue {
+ public:
+  void enqueue(std::function<void()> work) {
+    queue_.push(std::move(work));
+  }
+  void tick() {
+    if (queue_.empty()) {
+      return;
+    }
+    auto work = std::move(queue_.front());
+    queue_.pop();
+    work();
+  }
+  void flush() {
+    while (!queue_.empty()) {
+      tick();
+    }
+  }
+
+ private:
+  std::queue<std::function<void()>> queue_;
+};
+
+// Feature flags relevant to this test:
+//   - enableSchedulerDelegateInvalidation: the token guard under test.
+//   - enableRuntimeSchedulerQueueClearingOnError: a RuntimeScheduler_Modern
+//     fallback that drops queued work before host error handling tears down the
+//     delegate.
+//   - enableBridgelessArchitecture: forced ON so the Scheduler picks
+//     RuntimeScheduler_Modern. Modern queues rendering updates in
+//     pendingRenderingUpdates_ and drains them at end-of-tick, which is the
+//     ordering required to expose the race. RuntimeScheduler_Legacy runs
+//     scheduleRenderingUpdate inline, collapsing the window we want to test.
+class TestFeatureFlags : public ReactNativeFeatureFlagsDefaults {
+ public:
+  explicit TestFeatureFlags(
+      bool guardEnabled,
+      bool queueClearingOnErrorEnabled = false)
+      : guardEnabled_(guardEnabled),
+        queueClearingOnErrorEnabled_(queueClearingOnErrorEnabled) {}
+
+  bool enableBridgelessArchitecture() override {
+    return true;
+  }
+  bool enableRuntimeSchedulerQueueClearingOnError() override {
+    return queueClearingOnErrorEnabled_;
+  }
+  bool enableSchedulerDelegateInvalidation() override {
+    return guardEnabled_;
+  }
+
+ private:
+  bool guardEnabled_;
+  bool queueClearingOnErrorEnabled_;
+};
+
+// Builds a ComponentRegistryFactory with just the descriptors needed for the
+// test's shadow tree (Root + View). Matches the signature SchedulerToolbox
+// expects.
+ComponentRegistryFactory makeComponentRegistryFactory() {
+  return [](const EventDispatcher::Weak& eventDispatcher,
+            const std::shared_ptr<const ContextContainer>& contextContainer)
+             -> SharedComponentDescriptorRegistry {
+    ComponentDescriptorProviderRegistry providerRegistry{};
+    providerRegistry.add(
+        concreteComponentDescriptorProvider<RootComponentDescriptor>());
+    providerRegistry.add(
+        concreteComponentDescriptorProvider<ViewComponentDescriptor>());
+    return providerRegistry.createComponentDescriptorRegistry(
+        ComponentDescriptorParameters{
+            .eventDispatcher = eventDispatcher,
+            .contextContainer = contextContainer,
+            .flavor = nullptr});
+  };
+}
+
+// Test fixture: stands up the minimum infrastructure required to construct
+// a real Scheduler and drive uiManagerDidFinishTransaction end-to-end.
+class SchedulerDelegateInvalidationTest : public ::testing::Test {
+ protected:
+  void setUp(bool guardEnabled, bool queueClearingOnErrorEnabled = false) {
+    ReactNativeFeatureFlags::override(
+        std::make_unique<TestFeatureFlags>(
+            guardEnabled, queueClearingOnErrorEnabled));
+
+    runtime_ = facebook::hermes::makeHermesRuntime(
+        ::hermes::vm::RuntimeConfig::Builder()
+            .withMicrotaskQueue(true)
+            .build());
+    executorQueue_ = std::make_unique<TestExecutorQueue>();
+
+    RuntimeExecutor runtimeExecutor =
+        [this](
+            std::function<void(facebook::jsi::Runtime & runtime)>&& callback) {
+          executorQueue_->enqueue(
+              [this, callback = std::move(callback)]() mutable {
+                callback(*runtime_);
+              });
+        };
+
+    // onTaskError stands in for a host-side fatal handler that initiates an
+    // instance teardown. When a JS task throws (uncaught at the JSI host
+    // boundary), RuntimeScheduler routes the error here; the test fixture
+    // treats that as a fatal and tears down the instance in the same order
+    // a host-side invalidate path would:
+    //   1. unregister all surfaces (clears their per-surface UIManager
+    //      pointer; a real host would also stop running surfaces first),
+    //   2. clear the scheduler delegate (setDelegate(nullptr)),
+    //   3. drop the surface presenter that backed the delegate.
+    //
+    // Note: step 1 does NOT drain RuntimeScheduler_Modern's
+    // pendingRenderingUpdates_. That's exactly the point of the test —
+    // surface-level shutdown can't reach the lambda race; the race lives in
+    // the runtime scheduler's queue and is only closed by the invalidation
+    // token guard added in Scheduler::setDelegate or by runtime-scheduler-level
+    // queue clearing on error.
+    auto onTaskError = [this](
+                           jsi::Runtime& /*runtime*/, jsi::JSError& /*error*/) {
+      jsThrowObserved_ = true;
+      if (scheduler_ && surfaceHandler_ &&
+          surfaceHandler_->getStatus() !=
+              SurfaceHandler::Status::Unregistered) {
+        scheduler_->unregisterSurface(*surfaceHandler_);
+      }
+      if (scheduler_) {
+        scheduler_->setDelegate(nullptr);
+      }
+      delegate_.reset();
+    };
+
+    runtimeScheduler_ = std::make_shared<RuntimeScheduler>(
+        runtimeExecutor,
+        []() { return HighResTimeStamp::now(); },
+        std::move(onTaskError));
+
+    contextContainer_ = std::make_shared<ContextContainer>();
+    contextContainer_->insert(
+        RuntimeSchedulerKey,
+        std::weak_ptr<RuntimeScheduler>(runtimeScheduler_));
+
+    SchedulerToolbox toolbox{};
+    toolbox.contextContainer = contextContainer_;
+    toolbox.runtimeExecutor = runtimeExecutor;
+    toolbox.componentRegistryFactory = makeComponentRegistryFactory();
+    toolbox.eventBeatFactory =
+        [this](std::shared_ptr<EventBeat::OwnerBox> ownerBox) {
+          return std::make_unique<StubEventBeat>(
+              std::move(ownerBox), *runtimeScheduler_);
+        };
+
+    delegate_ = std::make_unique<RecordingDelegate>();
+    scheduler_ = std::make_unique<Scheduler>(
+        toolbox, /*animationDelegate=*/nullptr, delegate_.get());
+
+    // Register a surface with the scheduler so the teardown path mirrors
+    // production cascade ordering (per-surface unregister BEFORE delegate
+    // drop). The handler is intentionally not started — we never run the
+    // surface through the UIManager, since the test feeds a coordinator
+    // directly to uiManagerDidFinishTransaction. SurfaceHandler must reach
+    // Status::Unregistered before destruction, so TearDown also handles
+    // the case where onTaskError didn't run.
+    surfaceHandler_ = std::make_unique<SurfaceHandler>(
+        /*moduleName=*/"", /*surfaceId=*/11);
+    scheduler_->registerSurface(*surfaceHandler_);
+
+    coordinator_ = makeCoordinator(/*surfaceId=*/11);
+  }
+
+  void TearDown() override {
+    if (surfaceHandler_ && scheduler_ &&
+        surfaceHandler_->getStatus() != SurfaceHandler::Status::Unregistered) {
+      scheduler_->unregisterSurface(*surfaceHandler_);
+    }
+    surfaceHandler_.reset();
+    scheduler_.reset();
+    delegate_.reset();
+    coordinator_.reset();
+    rootShadowNode_.reset();
+    runtimeScheduler_.reset();
+    contextContainer_.reset();
+    executorQueue_.reset();
+    runtime_.reset();
+    ReactNativeFeatureFlags::dangerouslyReset();
+  }
+
+  // Builds a real RootShadowNode at the given surfaceId and wraps it in a
+  // ShadowTreeRevision + MountingCoordinator. This is what
+  // Scheduler::uiManagerDidFinishTransaction reads getSurfaceId() from at
+  // queue time. Saves the rootShadowNode in the fixture so dispatch-command
+  // tests can pass it to Scheduler::uiManagerDidDispatchCommand.
+  std::shared_ptr<MountingCoordinator> makeCoordinator(SurfaceId surfaceId) {
+    auto builder = simpleComponentBuilder(contextContainer_);
+    std::shared_ptr<RootShadowNode> rootShadowNode;
+    auto element = Element<RootShadowNode>()
+                       .reference(rootShadowNode)
+                       .surfaceId(surfaceId)
+                       .tag(1)
+                       .props([] {
+                         auto props = std::make_shared<RootProps>();
+                         return props;
+                       });
+    builder.build(element);
+    rootShadowNode_ = rootShadowNode;
+
+    ShadowTreeRevision revision{
+        .rootShadowNode = rootShadowNode, .number = 1, .telemetry = {}};
+    return std::make_shared<MountingCoordinator>(revision);
+  }
+
+  // Drives one event-loop tick by scheduling a no-op task and processing the
+  // resulting executor queue entries. The end-of-tick drain in
+  // RuntimeScheduler_Modern flushes pendingRenderingUpdates_, where the
+  // lambda enqueued by uiManagerDidFinishTransaction lives.
+  void runOneEventLoopTick() {
+    runtimeScheduler_->scheduleWork(
+        [](jsi::Runtime& /*unused*/) { /* no-op */ });
+    executorQueue_->flush();
+  }
+
+  // Schedules a JS task whose host function throws an uncaught Error. When
+  // the task runs and the throw escapes the host-function boundary,
+  // RuntimeScheduler routes it through the onTaskError callback installed
+  // in setUp(), which in turn simulates a host-driven instance-teardown
+  // cascade by dropping the delegate.
+  void scheduleJSThrowingTask() {
+    auto throwingHostFn = jsi::Function::createFromHostFunction(
+        *runtime_,
+        jsi::PropNameID::forUtf8(*runtime_, "throwUncaught"),
+        0,
+        [](jsi::Runtime& runtime,
+           const jsi::Value& /*unused*/,
+           const jsi::Value* /*args*/,
+           size_t /*count*/) -> jsi::Value {
+          // Simulates an uncaught JS error at the JSI host-function boundary
+          // — the same shape as the "Exception in HostFunction" surfaces
+          // that propagate to a host-side fatal handler in production.
+          throw jsi::JSError(runtime, "simulated uncaught fatal");
+        });
+    runtimeScheduler_->scheduleTask(
+        SchedulerPriority::NormalPriority, std::move(throwingHostFn));
+  }
+
+  void schedulePostErrorTask() {
+    runtimeScheduler_->scheduleTask(
+        SchedulerPriority::NormalPriority,
+        [this](jsi::Runtime& /*runtime*/) { postErrorTaskRan_ = true; });
+  }
+
+  std::unique_ptr<facebook::hermes::HermesRuntime> runtime_;
+  std::unique_ptr<TestExecutorQueue> executorQueue_;
+  std::shared_ptr<RuntimeScheduler> runtimeScheduler_;
+  std::shared_ptr<ContextContainer> contextContainer_;
+  std::unique_ptr<RecordingDelegate> delegate_;
+  std::unique_ptr<Scheduler> scheduler_;
+  std::unique_ptr<SurfaceHandler> surfaceHandler_;
+  std::shared_ptr<MountingCoordinator> coordinator_;
+  std::shared_ptr<RootShadowNode> rootShadowNode_;
+  bool jsThrowObserved_{false};
+  bool postErrorTaskRan_{false};
+};
+
+} // namespace
+
+// ---------------------------------------------------------------------------
+// Test 1 — Sanity: with the delegate alive, uiManagerDidFinishTransaction
+// enqueues a lambda that calls schedulerShouldRenderTransactions on the
+// next event loop tick. Establishes the baseline behavior that the next
+// two tests perturb.
+// ---------------------------------------------------------------------------
+TEST_F(
+    SchedulerDelegateInvalidationTest,
+    Sanity_LambdaRunsOnNextTickWhenDelegateAlive) {
+  setUp(/*guardEnabled=*/true);
+
+  scheduler_->uiManagerDidFinishTransaction(
+      coordinator_, /*mountSynchronously=*/false);
+
+  // Synchronously, schedulerDidFinishTransaction was called once
+  // (Scheduler.cpp dispatches it unconditionally, before the
+  // scheduleRenderingUpdate enqueue). schedulerShouldRenderTransactions
+  // has NOT been called yet — that one sits in the rendering-update queue.
+  EXPECT_EQ(delegate_->didFinishTransactionCount(), 1);
+  EXPECT_EQ(delegate_->shouldRenderTransactionsCount(), 0);
+
+  runOneEventLoopTick();
+
+  EXPECT_EQ(delegate_->shouldRenderTransactionsCount(), 1);
+}
+
+// ---------------------------------------------------------------------------
+// Test 2 — JS-throw-initiated teardown, guard ENABLED.
+//
+// Cascade replicated in C++:
+//   (a) earlier transaction enqueued a rendering-update lambda into
+//       pendingRenderingUpdates_ via Scheduler::uiManagerDidFinishTransaction
+//   (b) JS throws — uncaught at the JSI host-function boundary
+//   (c) RuntimeScheduler routes the error to onTaskError, which simulates a
+//       host-driven instance teardown by dropping the delegate
+//   (d) the next tick drains the previously-queued rendering update
+//
+// With the guard ON, step (c) flipped the invalidation token; the pending
+// lambda observes that and returns before touching the freed delegate. Safe.
+// ---------------------------------------------------------------------------
+TEST_F(
+    SchedulerDelegateInvalidationTest,
+    GuardEnabled_JSThrowInitiatedTeardownIsSafe) {
+  setUp(/*guardEnabled=*/true);
+
+  // (a) Pre-throw transaction: lambda lands in pendingRenderingUpdates_.
+  scheduler_->uiManagerDidFinishTransaction(
+      coordinator_, /*mountSynchronously=*/false);
+  EXPECT_EQ(delegate_->shouldRenderTransactionsCount(), 0);
+
+  // (b) Schedule a JS task that throws uncaught. Draining the executor queue
+  // runs the task; the throw flows through to onTaskError → teardown.
+  scheduleJSThrowingTask();
+  executorQueue_->flush();
+
+  // Sanity: the simulated fatal cascade fired and the delegate is gone.
+  EXPECT_TRUE(jsThrowObserved_);
+  EXPECT_EQ(scheduler_->getDelegate(), nullptr);
+
+  // (d) Drain the pending rendering update. Guard is on → lambda no-ops.
+  runOneEventLoopTick();
+
+  SUCCEED();
+}
+
+// ---------------------------------------------------------------------------
+// Test 3 — JS-throw-initiated teardown, guard DISABLED but runtime-scheduler
+// queue clearing ENABLED.
+//
+// Same cascade as Test 2 but with the scheduler invalidation guard OFF. The
+// runtime scheduler clears pendingRenderingUpdates_ before onTaskError tears
+// down the delegate, so the later tick has no stale delegate lambda to drain.
+// ---------------------------------------------------------------------------
+TEST_F(
+    SchedulerDelegateInvalidationTest,
+    GuardDisabled_QueueClearingOnError_JSThrowInitiatedTeardownIsSafe) {
+  setUp(
+      /*guardEnabled=*/false,
+      /*queueClearingOnErrorEnabled=*/true);
+
+  scheduler_->uiManagerDidFinishTransaction(
+      coordinator_, /*mountSynchronously=*/false);
+  EXPECT_EQ(delegate_->shouldRenderTransactionsCount(), 0);
+
+  scheduleJSThrowingTask();
+  schedulePostErrorTask();
+  executorQueue_->flush();
+  EXPECT_TRUE(jsThrowObserved_);
+  EXPECT_EQ(scheduler_->getDelegate(), nullptr);
+  EXPECT_FALSE(postErrorTaskRan_);
+
+  runOneEventLoopTick();
+
+  SUCCEED();
+}
+
+// ---------------------------------------------------------------------------
+// Test 4 — JS-throw-initiated teardown, guard DISABLED.
+//
+// Same cascade as Test 2 but with the guard OFF. The previously-enqueued
+// lambda has no working token check, so when the rendering-update drain
+// runs after teardown it dereferences the destroyed delegate.
+//
+// EXPECT_DEATH catches the abort: either RecordingDelegate's magic-sentinel
+// ASSERT_EQ inside schedulerShouldRenderTransactions trips, or ASan reports
+// heap-use-after-free on the vptr load before our assertion runs.
+// ---------------------------------------------------------------------------
+#if GTEST_HAS_DEATH_TEST
+TEST_F(
+    SchedulerDelegateInvalidationTest,
+    GuardDisabled_JSThrowInitiatedTeardownIsUAF) {
+  EXPECT_DEATH(
+      {
+        setUp(/*guardEnabled=*/false);
+
+        // (a) Pre-throw transaction: lambda lands in
+        // pendingRenderingUpdates_.
+        scheduler_->uiManagerDidFinishTransaction(
+            coordinator_, /*mountSynchronously=*/false);
+
+        // (b) Uncaught JS throw → onTaskError → teardown drops the delegate.
+        // (c) Note: with guard DISABLED, setDelegate(nullptr) does NOT flip
+        // the invalidation token — Scheduler::setDelegate gates that branch
+        // on the feature flag — so the pending lambda has no signal that
+        // the delegate is going away.
+        scheduleJSThrowingTask();
+        executorQueue_->flush();
+
+        // (d) Drain the pending rendering update. The lambda dereferences
+        // the destroyed delegate → UAF.
+        runOneEventLoopTick();
+      },
+      "");
+}
+#endif
+
+// ---------------------------------------------------------------------------
+// Test 5 — Same race as Test 2, but enqueued via the second lambda site:
+// Scheduler::uiManagerDidDispatchCommand. This is the path the in-app
+// reproduction observed (a `scrollTo` command issued from a tap, queued
+// just before the cascade fatal). With the guard ON the lambda observes
+// the invalidation token and no-ops.
+// ---------------------------------------------------------------------------
+TEST_F(
+    SchedulerDelegateInvalidationTest,
+    GuardEnabled_DispatchCommandLambda_JSThrowInitiatedTeardownIsSafe) {
+  setUp(/*guardEnabled=*/true);
+  ASSERT_NE(rootShadowNode_, nullptr);
+
+  // (a) Pre-throw command: enqueues a rendering-update lambda inside
+  // Scheduler::uiManagerDidDispatchCommand that captures the delegate by
+  // raw pointer and the invalidation token by shared_ptr.
+  scheduler_->uiManagerDidDispatchCommand(
+      rootShadowNode_, "scrollTo", folly::dynamic::array());
+  EXPECT_EQ(delegate_->didDispatchCommandCount(), 0);
+
+  // (b) Uncaught JS throw → onTaskError → unregister surface → drop delegate.
+  scheduleJSThrowingTask();
+  executorQueue_->flush();
+  EXPECT_TRUE(jsThrowObserved_);
+  EXPECT_EQ(scheduler_->getDelegate(), nullptr);
+
+  // (c) Drain the pending rendering update. Guard ON → lambda no-ops.
+  runOneEventLoopTick();
+
+  SUCCEED();
+}
+
+// ---------------------------------------------------------------------------
+// Test 6 — Same race as Test 3, but enqueued via
+// Scheduler::uiManagerDidDispatchCommand. Guard OFF → lambda dereferences
+// the destroyed delegate → UAF caught by the magic sentinel inside
+// schedulerDidDispatchCommand or by ASan on the vptr load.
+// ---------------------------------------------------------------------------
+#if GTEST_HAS_DEATH_TEST
+TEST_F(
+    SchedulerDelegateInvalidationTest,
+    GuardDisabled_DispatchCommandLambda_JSThrowInitiatedTeardownIsUAF) {
+  EXPECT_DEATH(
+      {
+        setUp(/*guardEnabled=*/false);
+        ASSERT_NE(rootShadowNode_, nullptr);
+
+        scheduler_->uiManagerDidDispatchCommand(
+            rootShadowNode_, "scrollTo", folly::dynamic::array());
+
+        scheduleJSThrowingTask();
+        executorQueue_->flush();
+
+        runOneEventLoopTick();
+      },
+      "");
+}
+#endif
+
+// ---------------------------------------------------------------------------
+// Test 7 — Architectural assertion: surface-shutdown alone does NOT drain
+// pendingRenderingUpdates_ in RuntimeScheduler_Modern.
+//
+// This is the explicit refutation of the implicit reading "if the host just
+// stops/unregisters all surfaces before dropping the delegate, the lambda
+// race wouldn't be reachable." It would not — surface-shutdown clears the
+// per-surface UIManager pointer but doesn't touch the runtime scheduler's
+// pending-rendering-updates queue. The lambda still runs and still calls
+// the delegate. Only the invalidation-token guard (or, longer-term, a
+// runtime-scheduler-level shutdown signal) closes this race.
+// ---------------------------------------------------------------------------
+TEST_F(
+    SchedulerDelegateInvalidationTest,
+    UnregisterSurface_DoesNotDrainPendingRenderingUpdates) {
+  setUp(/*guardEnabled=*/true);
+
+  // (a) Enqueue a rendering-update lambda for the registered surface.
+  scheduler_->uiManagerDidFinishTransaction(
+      coordinator_, /*mountSynchronously=*/false);
+  EXPECT_EQ(delegate_->shouldRenderTransactionsCount(), 0);
+
+  // (b) Unregister the surface — the host's per-surface shutdown step.
+  // Crucially, no JS throw and no setDelegate(nullptr) here: the delegate
+  // remains alive, only the surface's UIManager pointer is cleared.
+  ASSERT_NE(scheduler_->getDelegate(), nullptr);
+  scheduler_->unregisterSurface(*surfaceHandler_);
+  EXPECT_EQ(surfaceHandler_->getStatus(), SurfaceHandler::Status::Unregistered);
+  EXPECT_NE(scheduler_->getDelegate(), nullptr);
+
+  // (c) Drain the rendering-update queue. The pending lambda was NOT
+  // affected by the surface unregister — it still runs and still calls the
+  // (still-alive) delegate.
+  runOneEventLoopTick();
+  EXPECT_EQ(delegate_->shouldRenderTransactionsCount(), 1);
+}
+
+} // namespace facebook::react