react-native-tvos 0.87.1-0 → 0.88.0-0rc2

package/ReactCommon/react/renderer/scheduler/Scheduler.h

@@ -7,6 +7,8 @@
 
 #pragma once
 
+#include <react/cxxstableapi/FrameworksGuard.h>
+
 #include <atomic>
 #include <memory>
 #include <vector>
@@ -124,11 +126,6 @@ class Scheduler final : public UIManagerDelegate {
   friend class SurfaceHandler;
 
   SchedulerDelegate *delegate_;
-  // Invalidation token captured by-value into lambdas deferred via
-  // runtimeScheduler_->scheduleRenderingUpdate. Set to true on delegate
-  // change or Scheduler destruction so a lambda that outlives its captured
-  // raw delegate pointer can no-op instead of dereferencing dangling memory.
-  std::shared_ptr<std::atomic<bool>> delegateInvalidated_;
   SharedComponentDescriptorRegistry componentDescriptorRegistry_;
   RuntimeExecutor runtimeExecutor_;
   std::shared_ptr<UIManager> uiManager_;

package/ReactCommon/react/renderer/scheduler/SchedulerDelegate.h

@@ -7,6 +7,8 @@
 
 #pragma once
 
+#include <react/cxxstableapi/FrameworksGuard.h>
+
 #include <memory>
 
 #include <react/renderer/core/ReactPrimitives.h>

package/ReactCommon/react/renderer/scheduler/SchedulerToolbox.h

@@ -7,6 +7,8 @@
 
 #pragma once
 
+#include <react/cxxstableapi/FrameworksGuard.h>
+
 #include <memory>
 
 #include <ReactCommon/RuntimeExecutor.h>

package/ReactCommon/react/renderer/scheduler/SurfaceHandler.cpp

@@ -64,8 +64,8 @@ void SurfaceHandler::start() const noexcept {
   if (!parameters.moduleName.empty()) {
     link_.uiManager->startSurface(
         std::move(shadowTree),
-        parameters.moduleName,
-        parameters.props,
+        std::move(parameters.moduleName),
+        std::move(parameters.props),
         parameters_.displayMode);
   } else {
     link_.uiManager->startEmptySurface(std::move(shadowTree));
@@ -118,8 +118,8 @@ void SurfaceHandler::setDisplayMode(DisplayMode displayMode) const noexcept {
 
     link_.uiManager->setSurfaceProps(
         parameters.surfaceId,
-        parameters.moduleName,
-        parameters.props,
+        std::move(parameters.moduleName),
+        std::move(parameters.props),
         parameters.displayMode);
 
     applyDisplayMode(displayMode);
@@ -164,8 +164,8 @@ void SurfaceHandler::setProps(const folly::dynamic& props) const noexcept {
     if (link_.status == Status::Running) {
       link_.uiManager->setSurfaceProps(
           parameters.surfaceId,
-          parameters.moduleName,
-          parameters.props,
+          std::move(parameters.moduleName),
+          std::move(parameters.props),
           parameters.displayMode);
     }
   }

package/ReactCommon/react/renderer/scheduler/SurfaceHandler.h

@@ -7,6 +7,8 @@
 
 #pragma once
 
+#include <react/cxxstableapi/FrameworksGuard.h>
+
 #include <memory>
 #include <shared_mutex>
 

package/ReactCommon/react/renderer/scheduler/SurfaceManager.h

@@ -7,6 +7,8 @@
 
 #pragma once
 
+#include <react/cxxstableapi/FrameworksGuard.h>
+
 #include <mutex>
 #include <optional>
 #include <shared_mutex>

package/ReactCommon/react/renderer/scheduler/tests/SchedulerDelegateInvalidationTest.cpp

@@ -12,8 +12,9 @@
 // uiManagerDidDispatchCommand). The lambda captures the delegate by raw
 // pointer; if the delegate is destroyed (as part of an instance teardown
 // triggered by an uncaught fatal error) before the lambda runs, the
-// dereference is a use-after-free unless the invalidation-token guard in
-// Scheduler::setDelegate is enabled at queue time.
+// dereference is a use-after-free. What closes the race is
+// RuntimeScheduler_Modern::handleTaskError, which clears the pending
+// rendering updates before the host error handler drops the delegate.
 //
 // The test drives the *real* Scheduler::uiManagerDidFinishTransaction so the
 // rendering-update lambda is enqueued via the regular code path into a real
@@ -196,37 +197,16 @@ class TestExecutorQueue {
   std::queue<std::function<void()>> queue_;
 };
 
-// Feature flags relevant to this test:
-//   - enableSchedulerDelegateInvalidation: the token guard under test.
-//   - enableRuntimeSchedulerQueueClearingOnError: a RuntimeScheduler_Modern
-//     fallback that drops queued work before host error handling tears down the
-//     delegate.
-//   - enableBridgelessArchitecture: forced ON so the Scheduler picks
-//     RuntimeScheduler_Modern. Modern queues rendering updates in
-//     pendingRenderingUpdates_ and drains them at end-of-tick, which is the
-//     ordering required to expose the race. RuntimeScheduler_Legacy runs
-//     scheduleRenderingUpdate inline, collapsing the window we want to test.
+// enableBridgelessArchitecture is forced ON so the Scheduler picks
+// RuntimeScheduler_Modern. Modern queues rendering updates in
+// pendingRenderingUpdates_ and drains them at end-of-tick, which is the
+// ordering required to expose the race. RuntimeScheduler_Legacy runs
+// scheduleRenderingUpdate inline, collapsing the window we want to test.
 class TestFeatureFlags : public ReactNativeFeatureFlagsDefaults {
  public:
-  explicit TestFeatureFlags(
-      bool guardEnabled,
-      bool queueClearingOnErrorEnabled = false)
-      : guardEnabled_(guardEnabled),
-        queueClearingOnErrorEnabled_(queueClearingOnErrorEnabled) {}
-
   bool enableBridgelessArchitecture() override {
     return true;
   }
-  bool enableRuntimeSchedulerQueueClearingOnError() override {
-    return queueClearingOnErrorEnabled_;
-  }
-  bool enableSchedulerDelegateInvalidation() override {
-    return guardEnabled_;
-  }
-
- private:
-  bool guardEnabled_;
-  bool queueClearingOnErrorEnabled_;
 };
 
 // Builds a ComponentRegistryFactory with just the descriptors needed for the
@@ -253,10 +233,8 @@ ComponentRegistryFactory makeComponentRegistryFactory() {
 // a real Scheduler and drive uiManagerDidFinishTransaction end-to-end.
 class SchedulerDelegateInvalidationTest : public ::testing::Test {
  protected:
-  void setUp(bool guardEnabled, bool queueClearingOnErrorEnabled = false) {
-    ReactNativeFeatureFlags::override(
-        std::make_unique<TestFeatureFlags>(
-            guardEnabled, queueClearingOnErrorEnabled));
+  void setUp() {
+    ReactNativeFeatureFlags::override(std::make_unique<TestFeatureFlags>());
 
     runtime_ = facebook::hermes::makeHermesRuntime(
         ::hermes::vm::RuntimeConfig::Builder()
@@ -445,7 +423,7 @@ class SchedulerDelegateInvalidationTest : public ::testing::Test {
 TEST_F(
     SchedulerDelegateInvalidationTest,
     Sanity_LambdaRunsOnNextTickWhenDelegateAlive) {
-  setUp(/*guardEnabled=*/true);
+  setUp();
 
   scheduler_->uiManagerDidFinishTransaction(
       coordinator_, /*mountSynchronously=*/false);
@@ -463,7 +441,7 @@ TEST_F(
 }
 
 // ---------------------------------------------------------------------------
-// Test 2 — JS-throw-initiated teardown, guard ENABLED.
+// Test 2 — JS-throw-initiated teardown.
 //
 // Cascade replicated in C++:
 //   (a) earlier transaction enqueued a rendering-update lambda into
@@ -473,13 +451,12 @@ TEST_F(
 //       host-driven instance teardown by dropping the delegate
 //   (d) the next tick drains the previously-queued rendering update
 //
-// With the guard ON, step (c) flipped the invalidation token; the pending
-// lambda observes that and returns before touching the freed delegate. Safe.
+// RuntimeScheduler_Modern clears pendingRenderingUpdates_ in handleTaskError
+// before running onTaskError, so by (d) there is no stale delegate lambda
+// left to drain. The post-error task is dropped by the same clearing.
 // ---------------------------------------------------------------------------
-TEST_F(
-    SchedulerDelegateInvalidationTest,
-    GuardEnabled_JSThrowInitiatedTeardownIsSafe) {
-  setUp(/*guardEnabled=*/true);
+TEST_F(SchedulerDelegateInvalidationTest, JSThrowInitiatedTeardownIsSafe) {
+  setUp();
 
   // (a) Pre-throw transaction: lambda lands in pendingRenderingUpdates_.
   scheduler_->uiManagerDidFinishTransaction(
@@ -489,105 +466,75 @@ TEST_F(
   // (b) Schedule a JS task that throws uncaught. Draining the executor queue
   // runs the task; the throw flows through to onTaskError → teardown.
   scheduleJSThrowingTask();
+  schedulePostErrorTask();
   executorQueue_->flush();
 
   // Sanity: the simulated fatal cascade fired and the delegate is gone.
   EXPECT_TRUE(jsThrowObserved_);
   EXPECT_EQ(scheduler_->getDelegate(), nullptr);
+  EXPECT_FALSE(postErrorTaskRan_);
 
-  // (d) Drain the pending rendering update. Guard is on → lambda no-ops.
+  // (d) Drain the rendering-update queue — already emptied by the clearing.
   runOneEventLoopTick();
 
   SUCCEED();
 }
 
 // ---------------------------------------------------------------------------
-// Test 3 — JS-throw-initiated teardown, guard DISABLED but runtime-scheduler
-// queue clearing ENABLED.
+// Test 3 — The window that remains open: a delegate detached with no error
+// involved.
 //
-// Same cascade as Test 2 but with the scheduler invalidation guard OFF. The
-// runtime scheduler clears pendingRenderingUpdates_ before onTaskError tears
-// down the delegate, so the later tick has no stale delegate lambda to drain.
+// handleTaskError clears pendingRenderingUpdates_ before the host error
+// handler runs, so an error-driven teardown is safe (Test 2). A plain
+// setDelegate swap never reaches handleTaskError, so the lambda enqueued in
+// (a) still calls through the raw pointer it captured when the queue drains
+// in (c). Had the host also destroyed the delegate — as an instance teardown
+// does — that call would be a use-after-free.
+//
+// The delegate is deliberately kept alive here rather than destroyed under an
+// EXPECT_DEATH. Asserting on the crash asks undefined behaviour to reliably
+// terminate the process, which it does not: the death-test form of this test
+// (and its two predecessors) passed on the fbcode host but flaked above 88%
+// on the Android instrumentation runner, reporting "failed to die" until
+// trunk auto-disabled them. Observing the stale call directly pins the same
+// open window deterministically.
 // ---------------------------------------------------------------------------
 TEST_F(
     SchedulerDelegateInvalidationTest,
-    GuardDisabled_QueueClearingOnError_JSThrowInitiatedTeardownIsSafe) {
-  setUp(
-      /*guardEnabled=*/false,
-      /*queueClearingOnErrorEnabled=*/true);
+    DelegateDetachedWithoutError_PendingRenderingUpdateCallsStaleDelegate) {
+  setUp();
 
+  // (a) Enqueue a rendering-update lambda capturing delegate_ raw.
   scheduler_->uiManagerDidFinishTransaction(
       coordinator_, /*mountSynchronously=*/false);
   EXPECT_EQ(delegate_->shouldRenderTransactionsCount(), 0);
 
-  scheduleJSThrowingTask();
-  schedulePostErrorTask();
-  executorQueue_->flush();
-  EXPECT_TRUE(jsThrowObserved_);
+  // (b) Host swaps the delegate out. No JS throw, so nothing clears the
+  // rendering-update queue.
+  scheduler_->setDelegate(nullptr);
   EXPECT_EQ(scheduler_->getDelegate(), nullptr);
-  EXPECT_FALSE(postErrorTaskRan_);
 
+  // (c) Drain — the lambda calls through its captured pointer even though the
+  // scheduler itself no longer has a delegate.
   runOneEventLoopTick();
-
-  SUCCEED();
-}
-
-// ---------------------------------------------------------------------------
-// Test 4 — JS-throw-initiated teardown, guard DISABLED.
-//
-// Same cascade as Test 2 but with the guard OFF. The previously-enqueued
-// lambda has no working token check, so when the rendering-update drain
-// runs after teardown it dereferences the destroyed delegate.
-//
-// EXPECT_DEATH catches the abort: either RecordingDelegate's magic-sentinel
-// ASSERT_EQ inside schedulerShouldRenderTransactions trips, or ASan reports
-// heap-use-after-free on the vptr load before our assertion runs.
-// ---------------------------------------------------------------------------
-#if GTEST_HAS_DEATH_TEST
-TEST_F(
-    SchedulerDelegateInvalidationTest,
-    GuardDisabled_JSThrowInitiatedTeardownIsUAF) {
-  EXPECT_DEATH(
-      {
-        setUp(/*guardEnabled=*/false);
-
-        // (a) Pre-throw transaction: lambda lands in
-        // pendingRenderingUpdates_.
-        scheduler_->uiManagerDidFinishTransaction(
-            coordinator_, /*mountSynchronously=*/false);
-
-        // (b) Uncaught JS throw → onTaskError → teardown drops the delegate.
-        // (c) Note: with guard DISABLED, setDelegate(nullptr) does NOT flip
-        // the invalidation token — Scheduler::setDelegate gates that branch
-        // on the feature flag — so the pending lambda has no signal that
-        // the delegate is going away.
-        scheduleJSThrowingTask();
-        executorQueue_->flush();
-
-        // (d) Drain the pending rendering update. The lambda dereferences
-        // the destroyed delegate → UAF.
-        runOneEventLoopTick();
-      },
-      "");
+  EXPECT_EQ(delegate_->shouldRenderTransactionsCount(), 1);
 }
-#endif
 
 // ---------------------------------------------------------------------------
-// Test 5 — Same race as Test 2, but enqueued via the second lambda site:
+// Test 4 — Same race as Test 2, but enqueued via the second lambda site:
 // Scheduler::uiManagerDidDispatchCommand. This is the path the in-app
 // reproduction observed (a `scrollTo` command issued from a tap, queued
-// just before the cascade fatal). With the guard ON the lambda observes
-// the invalidation token and no-ops.
+// just before the cascade fatal).
 // ---------------------------------------------------------------------------
 TEST_F(
     SchedulerDelegateInvalidationTest,
-    GuardEnabled_DispatchCommandLambda_JSThrowInitiatedTeardownIsSafe) {
-  setUp(/*guardEnabled=*/true);
+    DispatchCommandLambda_JSThrowInitiatedTeardownIsSafe) {
+  setUp();
   ASSERT_NE(rootShadowNode_, nullptr);
 
   // (a) Pre-throw command: enqueues a rendering-update lambda inside
   // Scheduler::uiManagerDidDispatchCommand that captures the delegate by
-  // raw pointer and the invalidation token by shared_ptr.
+  // raw pointer.
   scheduler_->uiManagerDidDispatchCommand(
       rootShadowNode_, "scrollTo", folly::dynamic::array());
   EXPECT_EQ(delegate_->didDispatchCommandCount(), 0);
@@ -598,41 +545,14 @@ TEST_F(
   EXPECT_TRUE(jsThrowObserved_);
   EXPECT_EQ(scheduler_->getDelegate(), nullptr);
 
-  // (c) Drain the pending rendering update. Guard ON → lambda no-ops.
+  // (c) Drain the rendering-update queue — already emptied by the clearing.
   runOneEventLoopTick();
 
   SUCCEED();
 }
 
 // ---------------------------------------------------------------------------
-// Test 6 — Same race as Test 3, but enqueued via
-// Scheduler::uiManagerDidDispatchCommand. Guard OFF → lambda dereferences
-// the destroyed delegate → UAF caught by the magic sentinel inside
-// schedulerDidDispatchCommand or by ASan on the vptr load.
-// ---------------------------------------------------------------------------
-#if GTEST_HAS_DEATH_TEST
-TEST_F(
-    SchedulerDelegateInvalidationTest,
-    GuardDisabled_DispatchCommandLambda_JSThrowInitiatedTeardownIsUAF) {
-  EXPECT_DEATH(
-      {
-        setUp(/*guardEnabled=*/false);
-        ASSERT_NE(rootShadowNode_, nullptr);
-
-        scheduler_->uiManagerDidDispatchCommand(
-            rootShadowNode_, "scrollTo", folly::dynamic::array());
-
-        scheduleJSThrowingTask();
-        executorQueue_->flush();
-
-        runOneEventLoopTick();
-      },
-      "");
-}
-#endif
-
-// ---------------------------------------------------------------------------
-// Test 7 — Architectural assertion: surface-shutdown alone does NOT drain
+// Test 5 — Architectural assertion: surface-shutdown alone does NOT drain
 // pendingRenderingUpdates_ in RuntimeScheduler_Modern.
 //
 // This is the explicit refutation of the implicit reading "if the host just
@@ -640,13 +560,13 @@ TEST_F(
 // race wouldn't be reachable." It would not — surface-shutdown clears the
 // per-surface UIManager pointer but doesn't touch the runtime scheduler's
 // pending-rendering-updates queue. The lambda still runs and still calls
-// the delegate. Only the invalidation-token guard (or, longer-term, a
-// runtime-scheduler-level shutdown signal) closes this race.
+// the delegate. Only an error-driven queue clear, or a longer-term
+// runtime-scheduler-level shutdown signal, closes this race.
 // ---------------------------------------------------------------------------
 TEST_F(
     SchedulerDelegateInvalidationTest,
     UnregisterSurface_DoesNotDrainPendingRenderingUpdates) {
-  setUp(/*guardEnabled=*/true);
+  setUp();
 
   // (a) Enqueue a rendering-update lambda for the registered surface.
   scheduler_->uiManagerDidFinishTransaction(

package/ReactCommon/react/renderer/telemetry/CMakeLists.txt

@@ -17,6 +17,7 @@ target_link_libraries(react_renderer_telemetry
         folly_runtime
         glog
         glog_init
+        react_cxxstableapi
         react_debug
         react_renderer_core
         react_renderer_debug

package/ReactCommon/react/renderer/telemetry/SurfaceTelemetry.h

@@ -7,6 +7,8 @@
 
 #pragma once
 
+#include <react/cxxstableapi/FrameworksGuard.h>
+
 #include <vector>
 
 #include <react/renderer/telemetry/TransactionTelemetry.h>

package/ReactCommon/react/renderer/telemetry/TransactionTelemetry.h

@@ -7,6 +7,8 @@
 
 #pragma once
 
+#include <react/cxxstableapi/FrameworksGuard.h>
+
 #include <chrono>
 #include <cstdint>
 #include <functional>

package/ReactCommon/react/renderer/textlayoutmanager/TextMeasureCache.h

@@ -125,6 +125,7 @@ inline bool areTextAttributesEquivalentLayoutWise(const TextAttributes &lhs, con
              lhs.fontWeight,
              lhs.fontStyle,
              lhs.fontVariant,
+             lhs.fontVariationSettings,
              lhs.allowFontScaling,
              lhs.dynamicTypeRamp,
              lhs.alignment) ==
@@ -133,6 +134,7 @@ inline bool areTextAttributesEquivalentLayoutWise(const TextAttributes &lhs, con
              rhs.fontWeight,
              rhs.fontStyle,
              rhs.fontVariant,
+             rhs.fontVariationSettings,
              rhs.allowFontScaling,
              rhs.dynamicTypeRamp,
              rhs.alignment) &&
@@ -145,19 +147,28 @@ inline size_t textAttributesHashLayoutWise(const TextAttributes &textAttributes)
 {
   // Taking into account the same props as
   // `areTextAttributesEquivalentLayoutWise` mentions.
-  return facebook::react::hash_combine(
+  // The optionals are folded into one presence mask rather than being chained individually, so
+  // that the properties a given text run does not set stay off the hash's dependency chain. This
+  // is the hot path: it runs on every measurement-cache probe.
+  size_t seed = 0;
+  facebook::react::hash_combine(
+      seed,
       textAttributes.fontFamily,
       textAttributes.fontSize,
       textAttributes.fontSizeMultiplier,
+      textAttributes.maxFontSizeMultiplier,
+      textAttributes.letterSpacing,
+      textAttributes.lineHeight);
+  facebook::react::hash_combine_optionals(
+      seed,
       textAttributes.fontWeight,
       textAttributes.fontStyle,
       textAttributes.fontVariant,
+      textAttributes.fontVariationSettings,
       textAttributes.allowFontScaling,
-      textAttributes.maxFontSizeMultiplier,
       textAttributes.dynamicTypeRamp,
-      textAttributes.letterSpacing,
-      textAttributes.lineHeight,
       textAttributes.alignment);
+  return seed;
 }
 
 inline bool areAttributedStringFragmentsEquivalentLayoutWise(

package/ReactCommon/react/renderer/textlayoutmanager/TextMeasurementRounding.h

@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+#pragma once
+
+#include <cmath>
+
+#include <react/renderer/graphics/Size.h>
+
+namespace facebook::react {
+
+/*
+ * Rounds a raw text measurement up to the device pixel grid.
+ *
+ * A small epsilon is added to each dimension before ceil, so a value that sits
+ * effectively on a physical-pixel boundary gains one extra physical pixel
+ * instead of being rounded down. This works around precision loss when a
+ * measurement is converted from double to float and then rounded to the pixel
+ * grid in Yoga: without it, such a value can round down and clip the final line
+ * (height) or trailing glyph (width) of text. Dimensions that already have
+ * sub-pixel headroom are unaffected. See facebook/react-native issue #53450;
+ * this mirrors the legacy architecture fix in D7074168, which applied the same
+ * epsilon to both dimensions.
+ *
+ * This helper lives in its own header only so the unit test in
+ * `textlayoutmanager:tests` can exercise it directly. In production it is used
+ * only by RCTTextLayoutManager.mm, and the `internal_` prefix keeps it out of
+ * the public C++ API snapshot.
+ */
+inline Size internal_roundTextMeasurementToPixelGrid(Size size, Float pointScaleFactor)
+{
+  constexpr auto kEpsilon = static_cast<Float>(0.001);
+  return Size{
+      .width = std::ceil((size.width + kEpsilon) * pointScaleFactor) / pointScaleFactor,
+      .height = std::ceil((size.height + kEpsilon) * pointScaleFactor) / pointScaleFactor,
+  };
+}
+
+} // namespace facebook::react

package/ReactCommon/react/renderer/textlayoutmanager/platform/android/react/renderer/textlayoutmanager/TextLayoutManager.cpp

@@ -11,7 +11,7 @@
 #include <react/common/mapbuffer/JReadableMapBuffer.h>
 #include <react/debug/react_native_assert.h>
 #include <react/featureflags/ReactNativeFeatureFlags.h>
-#include <react/jni/ReadableNativeMap.h>
+#include <react/jni/NativeArray.h>
 #include <react/renderer/attributedstring/conversions.h>
 #include <react/renderer/core/conversions.h>
 #include <react/renderer/mapbuffer/MapBuffer.h>

package/ReactCommon/react/renderer/textlayoutmanager/platform/ios/react/renderer/textlayoutmanager/RCTAttributedTextUtils.mm

@@ -18,10 +18,11 @@
 
 using namespace facebook::react;
 
-inline static TextAlignment RCTResolveTextAlignment(TextAlignment textAlignment, LayoutDirection layoutDirection)
+inline static TextAlignment RCTResolveTextAlignment(TextAlignment textAlignment, bool isRTL)
 {
-  const bool isRTL = layoutDirection == LayoutDirection::RightToLeft;
   switch (textAlignment) {
+    case TextAlignment::Natural:
+      return isRTL ? TextAlignment::Right : TextAlignment::Left;
     case TextAlignment::Start:
       return isRTL ? TextAlignment::Right : TextAlignment::Left;
     case TextAlignment::End:
@@ -153,6 +154,10 @@ inline static UIFont *RCTEffectiveFontFromTextAttributes(const TextAttributes &t
   fontProperties.weight = textAttributes.fontWeight.has_value()
       ? RCTUIFontWeightFromInteger((NSInteger)textAttributes.fontWeight.value())
       : NAN;
+  if (textAttributes.fontVariationSettings.has_value()) {
+    NSString *variationSettings = [NSString stringWithUTF8String:textAttributes.fontVariationSettings->c_str()];
+    fontProperties.variations = RCTParseFontVariationSettings(variationSettings);
+  }
   fontProperties.sizeMultiplier = RCTEffectiveFontSizeMultiplierFromTextAttributes(textAttributes);
 
   return RCTFontWithFontProperties(fontProperties);
@@ -212,10 +217,10 @@ NSMutableDictionary<NSAttributedStringKey, id> *RCTNSTextAttributesFromTextAttri
   // Paragraph Style
   NSMutableParagraphStyle *paragraphStyle = [NSMutableParagraphStyle new];
   BOOL isParagraphStyleUsed = NO;
-  if (textAttributes.alignment.has_value()) {
-    TextAlignment textAlignment = RCTResolveTextAlignment(
-        textAttributes.alignment.value_or(TextAlignment::Natural),
-        textAttributes.layoutDirection.value_or(LayoutDirection::LeftToRight));
+  const bool isRTL = textAttributes.layoutDirection == LayoutDirection::RightToLeft;
+  if (textAttributes.alignment.has_value() || isRTL) {
+    TextAlignment textAlignment =
+        RCTResolveTextAlignment(textAttributes.alignment.value_or(TextAlignment::Natural), isRTL);
 
     paragraphStyle.alignment = RCTNSTextAlignmentFromTextAlignment(textAlignment);
     isParagraphStyleUsed = YES;
@@ -412,7 +417,10 @@ static NSMutableAttributedString *RCTNSAttributedStringFragmentFromFragment(
 
     return [[NSMutableAttributedString attributedStringWithAttachment:attachment] mutableCopy];
   } else {
-    NSString *string = [NSString stringWithUTF8String:fragment.string.c_str()];
+    NSString *decoded = [[NSString alloc] initWithBytes:fragment.string.data()
+                                                 length:fragment.string.size()
+                                               encoding:NSUTF8StringEncoding];
+    NSString *string = decoded != nil ? decoded : @"";
 
     if (fragment.textAttributes.textTransform.has_value()) {
       auto textTransform = fragment.textAttributes.textTransform.value();

package/ReactCommon/react/renderer/textlayoutmanager/platform/ios/react/renderer/textlayoutmanager/RCTFontProperties.h

@@ -52,6 +52,7 @@ struct RCTFontProperties {
   UIFontWeight weight = NAN;
   RCTFontStyle style = RCTFontStyleUndefined;
   RCTFontVariant variant = RCTFontVariantUndefined;
+  NSDictionary<NSNumber *, NSNumber *> *_Nullable variations = nil;
   CGFloat sizeMultiplier = NAN;
 };
 

package/ReactCommon/react/renderer/textlayoutmanager/platform/ios/react/renderer/textlayoutmanager/RCTFontUtils.h

@@ -5,6 +5,8 @@
  * LICENSE file in the root directory of this source tree.
  */
 
+#pragma once
+
 #import <React/RCTDefines.h>
 #import <UIKit/UIKit.h>
 #import <react/renderer/textlayoutmanager/RCTFontProperties.h>
@@ -19,6 +21,15 @@ using RCTDefaultFontResolver = UIFont *__nullable (^)(const RCTFontProperties &)
  */
 RCT_EXTERN void RCTSetDefaultFontResolver(RCTDefaultFontResolver handler);
 
+/**
+ * Parses comma-separated, quoted four-byte ASCII axis tags and finite numeric
+ * values into CoreText axis values. `normal`, an empty string, and invalid
+ * settings normalize to an empty dictionary. Because text inheritance is
+ * resolved before platform parsing, invalid child settings do not fall back to
+ * inherited settings.
+ */
+RCT_EXTERN NSDictionary<NSNumber *, NSNumber *> *RCTParseFontVariationSettings(NSString *variationSettings);
+
 /**
  * Returns UIFont instance corresponded to given font properties.
  */