react-native-windows 0.73.10 → 0.74.0-preview.1

package/Shared/HermesSamplingProfiler.h

@@ -4,8 +4,8 @@
 #pragma once
 
 #include <ReactHost/React.h>
+#include <winrt/Windows.Foundation.h>
 #include <atomic>
-#include <future>
 #include <string>
 
 namespace Microsoft::ReactNative {
@@ -13,13 +13,14 @@ namespace Microsoft::ReactNative {
 class HermesSamplingProfiler final {
  public:
   static winrt::fire_and_forget Start(Mso::CntPtr<Mso::React::IReactContext> const &reactContext) noexcept;
-  static std::future<std::string> Stop(Mso::CntPtr<Mso::React::IReactContext> const &reactContext) noexcept;
-  static std::string GetLastTraceFilePath() noexcept;
+  static winrt::Windows::Foundation::IAsyncOperation<winrt::hstring> Stop(
+      Mso::CntPtr<Mso::React::IReactContext> const &reactContext) noexcept;
+  static winrt::hstring GetLastTraceFilePath() noexcept;
   static bool IsStarted() noexcept;
 
  private:
   static std::atomic_bool s_isStarted;
-  static std::string s_lastTraceFilePath;
+  static winrt::hstring s_lastTraceFilePath;
 };
 
 } // namespace Microsoft::ReactNative

package/Shared/IDevSupportManager.h

@@ -3,8 +3,7 @@
 
 #pragma once
 
-#include "DevServerHelper.h"
-
+#include <cxxreact/JSExecutor.h>
 #include <functional>
 #include <memory>
 #include <string>
@@ -12,6 +11,9 @@
 namespace facebook {
 namespace react {
 
+using JSECreator =
+    std::function<std::unique_ptr<JSExecutor>(std::shared_ptr<ExecutorDelegate>, std::shared_ptr<MessageQueueThread>)>;
+
 struct DevSettings;
 
 struct IDevSupportManager {

package/Shared/InstanceManager.cpp

@@ -11,18 +11,17 @@
 
 #include <cxxreact/Instance.h>
 
-namespace facebook {
-namespace react {
-
-namespace {
+namespace Microsoft::ReactNative {
 
-const std::shared_ptr<IDevSupportManager> &GetSharedDevManager() noexcept {
-  static std::shared_ptr<IDevSupportManager> s_devManager(CreateDevSupportManager());
+const std::shared_ptr<facebook::react::IDevSupportManager> &GetSharedDevManager() noexcept {
+  static std::shared_ptr<facebook::react::IDevSupportManager> s_devManager(facebook::react::CreateDevSupportManager());
 
   return s_devManager;
 }
+} // namespace Microsoft::ReactNative
 
-} // namespace
+namespace facebook {
+namespace react {
 
 std::shared_ptr<InstanceWrapper> CreateReactInstance(
     std::shared_ptr<Instance> &&instance,
@@ -41,12 +40,13 @@ std::shared_ptr<InstanceWrapper> CreateReactInstance(
       std::move(jsBundleBasePath),
       std::move(cxxModules),
       std::move(turboModuleRegistry),
-      nullptr,
+      nullptr, // longLivedObjectCollection
+      nullptr, // PropertyBag
       std::move(callback),
       std::move(jsQueue),
       std::move(nativeQueue),
       std::move(devSettings),
-      GetSharedDevManager());
+      ::Microsoft::ReactNative::GetSharedDevManager());
 
   return inner;
 }
@@ -59,6 +59,7 @@ std::shared_ptr<InstanceWrapper> CreateReactInstance(
         &&cxxModules,
     std::shared_ptr<TurboModuleRegistry> turboModuleRegistry,
     std::shared_ptr<facebook::react::LongLivedObjectCollection> longLivedObjectCollection,
+    const winrt::Microsoft::ReactNative::IReactPropertyBag &propertyBag,
     std::unique_ptr<InstanceCallback> &&callback,
     std::shared_ptr<MessageQueueThread> jsQueue,
     std::shared_ptr<MessageQueueThread> nativeQueue,
@@ -70,11 +71,12 @@ std::shared_ptr<InstanceWrapper> CreateReactInstance(
       std::move(cxxModules),
       std::move(turboModuleRegistry),
       std::move(longLivedObjectCollection),
+      propertyBag,
       std::move(callback),
       std::move(jsQueue),
       std::move(nativeQueue),
       std::move(devSettings),
-      GetSharedDevManager());
+      ::Microsoft::ReactNative::GetSharedDevManager());
 
   return inner;
 }
@@ -102,7 +104,7 @@ std::shared_ptr<InstanceWrapper> CreateReactInstance(
       std::move(jsQueue),
       std::move(nativeQueue),
       std::move(devSettings),
-      GetSharedDevManager());
+      ::Microsoft::ReactNative::GetSharedDevManager());
 
   return inner;
 }

package/Shared/InstanceManager.h

@@ -12,15 +12,14 @@
 #include <string>
 #include <vector>
 #include "DevSettings.h"
+#include "IDevSupportManager.h"
 #include "IReactRootView.h"
 
 namespace folly {
 struct dynamic;
 }
 
-namespace facebook {
-
-namespace react {
+namespace facebook::react {
 
 class Instance;
 struct InstanceCallback;
@@ -28,6 +27,7 @@ class MessageQueueThread;
 class ModuleRegistry;
 class IUIManager;
 class TurboModuleRegistry;
+class RuntimeScheduler;
 
 struct InstanceWrapper {
   virtual const std::shared_ptr<Instance> &GetInstance() const noexcept = 0;
@@ -52,19 +52,6 @@ std::shared_ptr<InstanceWrapper> CreateReactInstance(
     std::shared_ptr<MessageQueueThread> nativeQueue,
     std::shared_ptr<DevSettings> devSettings) noexcept;
 
-std::shared_ptr<InstanceWrapper> CreateReactInstance(
-    std::shared_ptr<Instance> &&instance,
-    std::string &&jsBundleRelativePath,
-    std::vector<
-        std::tuple<std::string, facebook::xplat::module::CxxModule::Provider, std::shared_ptr<MessageQueueThread>>>
-        &&cxxModules,
-    std::shared_ptr<TurboModuleRegistry> turboModuleRegistry,
-    std::shared_ptr<facebook::react::LongLivedObjectCollection> longLivedObjectCollection,
-    std::unique_ptr<InstanceCallback> &&callback,
-    std::shared_ptr<MessageQueueThread> jsQueue,
-    std::shared_ptr<MessageQueueThread> nativeQueue,
-    std::shared_ptr<DevSettings> devSettings) noexcept;
-
 std::shared_ptr<InstanceWrapper> CreateReactInstance(
     std::shared_ptr<Instance> &&instance,
     std::string &&jsBundleBasePath,
@@ -78,5 +65,8 @@ std::shared_ptr<InstanceWrapper> CreateReactInstance(
     std::shared_ptr<MessageQueueThread> nativeQueue,
     std::shared_ptr<DevSettings> devSettings) noexcept;
 
-} // namespace react
-} // namespace facebook
+} // namespace facebook::react
+
+namespace Microsoft::ReactNative {
+const std::shared_ptr<facebook::react::IDevSupportManager> &GetSharedDevManager() noexcept;
+}

package/Shared/JSI/ChakraRuntime.cpp

@@ -9,6 +9,7 @@
 
 #include <cxxreact/MessageQueueThread.h>
 
+#include <strsafe.h>
 #include <cstring>
 #include <limits>
 #include <mutex>
@@ -84,6 +85,7 @@ void ChakraRuntime::Init() noexcept {
   m_propertyId.enumerable = JsRefHolder{GetPropertyIdFromName(L"enumerable")};
   m_propertyId.get = JsRefHolder{GetPropertyIdFromName(L"get")};
   m_propertyId.getOwnPropertyDescriptor = JsRefHolder{GetPropertyIdFromName(L"getOwnPropertyDescriptor")};
+  m_propertyId.has = JsRefHolder{GetPropertyIdFromName(L"has")};
   m_propertyId.hostFunctionSymbol = JsRefHolder{GetPropertyIdFromSymbol(L"hostFunctionSymbol")};
   m_propertyId.hostObjectSymbol = JsRefHolder{GetPropertyIdFromSymbol(L"hostObjectSymbol")};
   m_propertyId.length = JsRefHolder{GetPropertyIdFromName(L"length")};
@@ -97,9 +99,22 @@ void ChakraRuntime::Init() noexcept {
   m_propertyId.writable = JsRefHolder{GetPropertyIdFromName(L"writable")};
 
   m_undefinedValue = JsRefHolder{GetUndefinedValue()};
+
+  JsValueRef global = GetGlobalObject();
+  JsValueRef weakMapPropertyId = GetPropertyIdFromName(L"WeakMap");
+  JsValueRef weakMapConstructor = GetProperty(global, weakMapPropertyId);
+  JsValueRef weakMapPrototype = GetProperty(weakMapConstructor, m_propertyId.prototype);
+  m_weakMapGet = JsRefHolder{GetProperty(weakMapPrototype, m_propertyId.get)};
+  m_weakMapHas = JsRefHolder{GetProperty(weakMapPrototype, m_propertyId.has)};
+  m_weakMapSet = JsRefHolder{GetProperty(weakMapPrototype, m_propertyId.set)};
+  m_nativeStateMap = JsRefHolder{ConstructObject(weakMapConstructor, Span<JsValueRef>{m_undefinedValue})};
 }
 
 /*virtual*/ ChakraRuntime::~ChakraRuntime() noexcept {
+  m_nativeStateMap = {};
+  m_weakMapSet = {};
+  m_weakMapHas = {};
+  m_weakMapGet = {};
   m_undefinedValue = {};
   m_propertyId = {};
   m_proxyConstructor = {};
@@ -189,8 +204,8 @@ facebook::jsi::Value ChakraRuntime::evaluateJavaScript(
     auto genPreparedScript = generatePreparedScript(sourceURL, *sharedScriptBuffer);
     if (!genPreparedScript)
       std::terminate(); // Cache generation can't fail unless something really
-                        // wrong. but we should get rid of this abort before
-                        // shipping.
+    // wrong. but we should get rid of this abort before
+    // shipping.
 
     sharedPreparedScript = std::shared_ptr<const facebook::jsi::Buffer>(std::move(genPreparedScript));
     runtimeArgs().preparedScriptStore->persistPreparedScript(
@@ -345,16 +360,25 @@ facebook::jsi::String ChakraRuntime::bigintToString(const facebook::jsi::BigInt
   throw facebook::jsi::JSINativeException("Not implemented");
 }
 
-bool ChakraRuntime::hasNativeState(const facebook::jsi::Object &) {
-  throw facebook::jsi::JSINativeException("Not implemented");
+bool ChakraRuntime::hasNativeState(const facebook::jsi::Object &obj) {
+  return BooleanToBool(CallFunction(m_weakMapHas, {m_nativeStateMap, GetJsRef(obj)}));
 }
 
-std::shared_ptr<facebook::jsi::NativeState> ChakraRuntime::getNativeState(const facebook::jsi::Object &) {
-  throw facebook::jsi::JSINativeException("Not implemented");
+std::shared_ptr<facebook::jsi::NativeState> ChakraRuntime::getNativeState(const facebook::jsi::Object &obj) {
+  JsValueRef stateWrapper = CallFunction(m_weakMapGet, {m_nativeStateMap, GetJsRef(obj)});
+  if (GetValueType(stateWrapper) == JsValueType::JsObject) {
+    return *static_cast<std::shared_ptr<facebook::jsi::NativeState> *>(GetExternalData(stateWrapper));
+  } else {
+    return nullptr;
+  }
 }
 
-void ChakraRuntime::setNativeState(const facebook::jsi::Object &, std::shared_ptr<facebook::jsi::NativeState> state) {
-  throw facebook::jsi::JSINativeException("Not implemented");
+void ChakraRuntime::setNativeState(
+    const facebook::jsi::Object &obj,
+    std::shared_ptr<facebook::jsi::NativeState> state) {
+  JsValueRef stateWrapper =
+      CreateExternalObject(std::make_unique<std::shared_ptr<facebook::jsi::NativeState>>(std::move(state)));
+  CallFunction(m_weakMapSet, {m_nativeStateMap, GetJsRef(obj), stateWrapper});
 }
 
 facebook::jsi::ArrayBuffer ChakraRuntime::createArrayBuffer(std::shared_ptr<facebook::jsi::MutableBuffer> buffer) {
@@ -655,6 +679,10 @@ bool ChakraRuntime::instanceOf(const facebook::jsi::Object &obj, const facebook:
   return InstanceOf(GetJsRef(obj), GetJsRef(func));
 }
 
+void ChakraRuntime::setExternalMemoryPressure(const facebook::jsi::Object & /*obj*/, size_t /*amount*/) {
+  // TODO: implement
+}
+
 #pragma endregion Functions_inherited_from_Runtime
 
 // Sets variable in the constructor and then restores its value in the destructor.
@@ -698,8 +726,37 @@ void ChakraRuntime::RewriteErrorMessage(JsValueRef jsError) {
     JsGetAndClearException(&ignoreJSError);
   } else if (GetValueType(message) == JsValueType::JsString) {
     // JSI unit tests expect V8 or JSC like message for stack overflow.
-    if (StringToPointer(message) == L"Out of stack space") {
+    std::wstring_view errorMessage = StringToPointer(message);
+    if (errorMessage == L"Out of stack space") {
       SetProperty(jsError, m_propertyId.message, PointerToString(L"RangeError : Maximum call stack size exceeded"));
+    } else if (errorMessage == L"Syntax error") {
+      JsValueRef result;
+      JsPropertyIdRef property;
+
+      JsGetPropertyIdFromName(L"line", &property);
+      if (JsGetProperty(jsError, property, &result) != JsNoError) {
+        // If the 'line' property getter throws, clear the exception and ignore it.
+        JsValueRef ignoreJSError{JS_INVALID_REFERENCE};
+        JsGetAndClearException(&ignoreJSError);
+        return;
+      }
+
+      // Line numbers start from zero
+      const int32_t line = NumberToInt(result) + 1;
+      wchar_t buf[1024] = {};
+
+      JsGetPropertyIdFromName(L"column", &property);
+      if (JsGetProperty(jsError, property, &result) != JsNoError) {
+        // If the 'column' property getter throws, clear the exception and ignore it.
+        JsValueRef ignoreJSError{JS_INVALID_REFERENCE};
+        JsGetAndClearException(&ignoreJSError);
+        StringCchPrintf(buf, std::size(buf), L"Syntax error at line %i", line);
+      } else {
+        const int32_t column = NumberToInt(result);
+        StringCchPrintf(buf, std::size(buf), L"Syntax error at line %i column %i", line, column);
+      }
+
+      SetProperty(jsError, m_propertyId.message, PointerToString(buf));
     }
   }
 }

package/Shared/JSI/ChakraRuntime.h

@@ -153,6 +153,8 @@ class ChakraRuntime : public facebook::jsi::Runtime, public ChakraApi, ChakraApi
 
   bool instanceOf(const facebook::jsi::Object &obj, const facebook::jsi::Function &func) override;
 
+  void setExternalMemoryPressure(const facebook::jsi::Object &obj, size_t amount) override;
+
 #pragma endregion Functions_inherited_from_Runtime
 
  protected:
@@ -463,6 +465,7 @@ class ChakraRuntime : public facebook::jsi::Runtime, public ChakraApi, ChakraApi
     JsRefHolder enumerable;
     JsRefHolder get;
     JsRefHolder getOwnPropertyDescriptor;
+    JsRefHolder has;
     JsRefHolder hostFunctionSymbol;
     JsRefHolder hostObjectSymbol;
     JsRefHolder length;
@@ -480,6 +483,11 @@ class ChakraRuntime : public facebook::jsi::Runtime, public ChakraApi, ChakraApi
   JsRefHolder m_proxyConstructor;
   JsRefHolder m_hostObjectProxyHandler;
 
+  JsRefHolder m_weakMapGet;
+  JsRefHolder m_weakMapHas;
+  JsRefHolder m_weakMapSet;
+  JsRefHolder m_nativeStateMap;
+
   static std::once_flag s_runtimeVersionInitFlag;
   static uint64_t s_runtimeVersion;
 

package/Shared/JSI/JSExecutorFactoryDelegate.h

@@ -0,0 +1,12 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#include <functional>
+#include <memory>
+
+namespace facebook::react {
+class CallInvoker;
+class JSExecutorFactory;
+using JSExecutorFactoryDelegate =
+    std::function<std::shared_ptr<JSExecutorFactory>(std::shared_ptr<CallInvoker> const &callInvoker)>;
+} // namespace facebook::react

package/Shared/JSI/JSExecutorFactorySettings.cpp

@@ -0,0 +1,30 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#include "JSExecutorFactorySettings.h"
+
+namespace Microsoft::JSI::JSExecutorFactorySettings {
+
+winrt::Microsoft::ReactNative::ReactPropertyId<
+    winrt::Microsoft::ReactNative::ReactNonAbiValue<facebook::react::JSExecutorFactoryDelegate>>
+JSExecutorFactoryDelegateProperty() noexcept {
+  winrt::Microsoft::ReactNative::ReactPropertyId<
+      winrt::Microsoft::ReactNative::ReactNonAbiValue<facebook::react::JSExecutorFactoryDelegate>>
+      propId{L"ReactNative.JSI", L"JSExecutorFactory"};
+  return propId;
+}
+void SetJSExecutorFactoryDelegate(
+    winrt::Microsoft::ReactNative::ReactPropertyBag properties,
+    facebook::react::JSExecutorFactoryDelegate const &value) noexcept {
+  properties.Set(JSExecutorFactoryDelegateProperty(), value);
+}
+
+const facebook::react::JSExecutorFactoryDelegate GetJSExecutorFactoryDelegate(
+    winrt::Microsoft::ReactNative::ReactPropertyBag properties) noexcept {
+  const auto jsExecutorFactoryDelegate = properties.Get(JSExecutorFactoryDelegateProperty());
+  if (!jsExecutorFactoryDelegate)
+    return nullptr;
+  return jsExecutorFactoryDelegate.Value();
+}
+
+} // namespace Microsoft::JSI::JSExecutorFactorySettings

package/Shared/JSI/JSExecutorFactorySettings.h

@@ -0,0 +1,21 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#pragma once
+
+#include "JSExecutorFactoryDelegate.h"
+#include "ReactPropertyBag.h"
+
+namespace facebook::react {
+class JSExecutorFactory;
+}
+
+namespace Microsoft::JSI::JSExecutorFactorySettings {
+
+void SetJSExecutorFactoryDelegate(
+    winrt::Microsoft::ReactNative::ReactPropertyBag properties,
+    facebook::react::JSExecutorFactoryDelegate const &value) noexcept;
+const facebook::react::JSExecutorFactoryDelegate GetJSExecutorFactoryDelegate(
+    winrt::Microsoft::ReactNative::ReactPropertyBag properties) noexcept;
+
+} // namespace Microsoft::JSI::JSExecutorFactorySettings

package/Shared/Modules/BlobModule.h

@@ -3,7 +3,7 @@
 
 #pragma once
 
-#include <NativeBlobModuleSpec.g.h>
+#include <codegen/NativeBlobModuleSpec.g.h>
 
 #include <Networking/IBlobResource.h>
 

package/Shared/Modules/FileReaderModule.h

@@ -3,7 +3,7 @@
 
 #pragma once
 
-#include <NativeFileReaderModuleSpec.g.h>
+#include <codegen/NativeFileReaderModuleSpec.g.h>
 
 #include <IFileReaderResource.h>
 #include <NativeModules.h>

package/Shared/Modules/HttpModule.h

@@ -3,7 +3,7 @@
 
 #pragma once
 
-#include <NativeNetworkingIOSSpec.g.h>
+#include <codegen/NativeNetworkingIOSSpec.g.h>
 #include <NativeModules.h>
 #include <Networking/IHttpResource.h>
 

package/Shared/Modules/WebSocketTurboModule.h

@@ -3,7 +3,7 @@
 
 #pragma once
 
-#include <NativeWebSocketModuleSpec.g.h>
+#include <codegen/NativeWebSocketModuleSpec.g.h>
 #include <Modules/IWebSocketModuleProxy.h>
 #include <NativeModules.h>
 #include <Networking/IWebSocketResource.h>

package/Shared/Networking/OriginPolicyHttpFilter.cpp

@@ -18,6 +18,7 @@
 #include <regex>
 
 using std::set;
+using std::string;
 using std::wstring;
 
 using winrt::hresult_error;
@@ -114,15 +115,6 @@ bool OriginPolicyHttpFilter::CaseInsensitiveComparer::operator()(const wstring &
 /*static*/ set<const wchar_t *, OriginPolicyHttpFilter::CaseInsensitiveComparer>
     OriginPolicyHttpFilter::s_corsForbiddenRequestHeaderNamePrefixes = {L"Proxy-", L"Sec-"};
 
-/*static*/ Uri OriginPolicyHttpFilter::s_origin{nullptr};
-
-/*static*/ void OriginPolicyHttpFilter::SetStaticOrigin(std::string &&url) {
-  if (!url.empty())
-    s_origin = Uri{to_hstring(url)};
-  else
-    s_origin = nullptr;
-}
-
 /*static*/ bool OriginPolicyHttpFilter::IsSameOrigin(Uri const &u1, Uri const &u2) noexcept {
   return (u1 && u2) && u1.SchemeName() == u2.SchemeName() && u1.Host() == u2.Host() && u1.Port() == u2.Port();
 }
@@ -387,10 +379,14 @@ bool OriginPolicyHttpFilter::CaseInsensitiveComparer::operator()(const wstring &
   }
 }
 
-OriginPolicyHttpFilter::OriginPolicyHttpFilter(IHttpFilter const &innerFilter) : m_innerFilter{innerFilter} {}
+OriginPolicyHttpFilter::OriginPolicyHttpFilter(string &&origin, IHttpFilter const &innerFilter)
+    : m_origin{nullptr}, m_innerFilter{innerFilter} {
+  if (!origin.empty())
+    m_origin = Uri{to_hstring(origin)};
+}
 
-OriginPolicyHttpFilter::OriginPolicyHttpFilter()
-    : OriginPolicyHttpFilter(winrt::Windows::Web::Http::Filters::HttpBaseProtocolFilter{}) {}
+OriginPolicyHttpFilter::OriginPolicyHttpFilter(string &&origin)
+    : OriginPolicyHttpFilter(std::move(origin), winrt::Windows::Web::Http::Filters::HttpBaseProtocolFilter{}) {}
 
 OriginPolicy OriginPolicyHttpFilter::ValidateRequest(HttpRequestMessage const &request) {
   auto effectiveOriginPolicy =
@@ -400,17 +396,17 @@ OriginPolicy OriginPolicyHttpFilter::ValidateRequest(HttpRequestMessage const &r
       return effectiveOriginPolicy;
 
     case OriginPolicy::SameOrigin:
-      if (!IsSameOrigin(s_origin, request.RequestUri()))
+      if (!IsSameOrigin(m_origin, request.RequestUri()))
         throw hresult_error{E_INVALIDARG, L"SOP (same-origin policy) is enforced"};
       break;
 
     case OriginPolicy::SimpleCrossOriginResourceSharing:
       // Check for disallowed mixed content
       if (GetRuntimeOptionBool("Http.BlockMixedContentSimpleCors") &&
-          s_origin.SchemeName() != request.RequestUri().SchemeName())
+          m_origin.SchemeName() != request.RequestUri().SchemeName())
         throw hresult_error{E_INVALIDARG, L"The origin and request URLs must have the same scheme"};
 
-      if (IsSameOrigin(s_origin, request.RequestUri()))
+      if (IsSameOrigin(m_origin, request.RequestUri()))
         // Same origin. Therefore, skip Cross-Origin handling.
         effectiveOriginPolicy = OriginPolicy::SameOrigin;
       else if (!IsSimpleCorsRequest(request))
@@ -426,7 +422,7 @@ OriginPolicy OriginPolicyHttpFilter::ValidateRequest(HttpRequestMessage const &r
       // Example: On the Edge browser, an XHR request with the "Host" header set gets rejected as unsafe.
       // https://fetch.spec.whatwg.org/#forbidden-header-name
 
-      if (s_origin.SchemeName() != request.RequestUri().SchemeName())
+      if (m_origin.SchemeName() != request.RequestUri().SchemeName())
         throw hresult_error{E_INVALIDARG, L"The origin and request URLs must have the same scheme"};
 
       if (!AreSafeRequestHeaders(request.Headers()))
@@ -435,7 +431,7 @@ OriginPolicy OriginPolicyHttpFilter::ValidateRequest(HttpRequestMessage const &r
       if (s_forbiddenMethods.find(request.Method().ToString().c_str()) != s_forbiddenMethods.cend())
         throw hresult_error{E_INVALIDARG, L"Request method not allowed in cross-origin resource sharing"};
 
-      if (IsSameOrigin(s_origin, request.RequestUri()))
+      if (IsSameOrigin(m_origin, request.RequestUri()))
         effectiveOriginPolicy = OriginPolicy::SameOrigin;
       else if (IsSimpleCorsRequest(request))
         effectiveOriginPolicy = OriginPolicy::SimpleCrossOriginResourceSharing;
@@ -472,7 +468,7 @@ void OriginPolicyHttpFilter::ValidateAllowOrigin(
   // 4.10.4 - Mismatched allow origin
   auto taintedOriginProp = props.TryLookup(L"TaintedOrigin");
   auto taintedOrigin = taintedOriginProp && winrt::unbox_value<bool>(taintedOriginProp);
-  auto origin = taintedOrigin ? nullptr : s_origin;
+  auto origin = taintedOrigin ? nullptr : m_origin;
   if (allowedOrigin.empty() || !IsSameOrigin(origin, Uri{allowedOrigin})) {
     hstring errorMessage;
     if (allowedOrigin.empty())
@@ -603,7 +599,7 @@ void OriginPolicyHttpFilter::ValidateResponse(HttpResponseMessage const &respons
       bool originAllowed = false;
       for (const auto &header : response.Headers()) {
         if (boost::iequals(header.Key(), L"Access-Control-Allow-Origin")) {
-          originAllowed |= L"*" == header.Value() || s_origin == Uri{header.Value()};
+          originAllowed |= L"*" == header.Value() || m_origin == Uri{header.Value()};
         }
       }
 
@@ -691,7 +687,7 @@ ResponseOperation OriginPolicyHttpFilter::SendPreflightAsync(HttpRequestMessage
   }
 
   preflightRequest.Headers().Insert(L"Access-Control-Request-Headers", headerNames);
-  preflightRequest.Headers().Insert(L"Origin", GetOrigin(s_origin));
+  preflightRequest.Headers().Insert(L"Origin", GetOrigin(m_origin));
   preflightRequest.Headers().Insert(L"Sec-Fetch-Mode", L"CORS");
 
   co_return {co_await m_innerFilter.SendRequestAsync(preflightRequest)};
@@ -708,7 +704,7 @@ bool OriginPolicyHttpFilter::OnRedirecting(
   // origin=http://a.com. Since the origin matches the URL, the request is authorized at http://a.com, but it actually
   // allows http://b.com to bypass the CORS check at http://a.com since the redirected URL is from http://b.com.
   if (!IsSameOrigin(response.Headers().Location(), request.RequestUri()) &&
-      !IsSameOrigin(s_origin, request.RequestUri())) {
+      !IsSameOrigin(m_origin, request.RequestUri())) {
     // By masking the origin field in the request header, we make it impossible for the server to set a single value for
     // the access-control-allow-origin header. It means, the only way to support redirect is that server allows access
     // from all sites through wildcard.
@@ -740,7 +736,7 @@ ResponseOperation OriginPolicyHttpFilter::SendRequestAsync(HttpRequestMessage co
   // Allow only HTTP or HTTPS schemes
   if (GetRuntimeOptionBool("Http.StrictScheme") && coRequest.RequestUri().SchemeName() != L"https" &&
       coRequest.RequestUri().SchemeName() != L"http")
-    throw hresult_error{E_INVALIDARG, L"Invalid URL scheme: [" + s_origin.SchemeName() + L"]"};
+    throw hresult_error{E_INVALIDARG, L"Invalid URL scheme: [" + m_origin.SchemeName() + L"]"};
 
   if (!GetRuntimeOptionBool("Http.OmitCredentials")) {
     coRequest.Properties().Lookup(L"RequestArgs").as<RequestArgs>()->WithCredentials = false;
@@ -777,7 +773,7 @@ ResponseOperation OriginPolicyHttpFilter::SendRequestAsync(HttpRequestMessage co
 
     if (originPolicy == OriginPolicy::SimpleCrossOriginResourceSharing ||
         originPolicy == OriginPolicy::CrossOriginResourceSharing) {
-      coRequest.Headers().Insert(L"Origin", GetOrigin(s_origin));
+      coRequest.Headers().Insert(L"Origin", GetOrigin(m_origin));
     }
 
     auto response = co_await m_innerFilter.SendRequestAsync(coRequest);

package/Shared/Networking/OriginPolicyHttpFilter.h

@@ -37,9 +37,6 @@ class OriginPolicyHttpFilter
   static std::set<const wchar_t *, CaseInsensitiveComparer> s_corsForbiddenRequestHeaderNamePrefixes;
   static std::set<const wchar_t *, CaseInsensitiveComparer> s_cookieSettingResponseHeaders;
 
-  // NOTE: Assumes static origin through owning client/resource/module/(React) instance's lifetime.
-  static winrt::Windows::Foundation::Uri s_origin;
-
   struct AccessControlValues {
     winrt::hstring AllowedOrigin;
     winrt::hstring AllowedCredentials;
@@ -49,11 +46,11 @@ class OriginPolicyHttpFilter
     size_t MaxAge;
   };
 
+  winrt::Windows::Foundation::Uri m_origin;
+
   winrt::Windows::Web::Http::Filters::IHttpFilter m_innerFilter;
 
  public:
-  static void SetStaticOrigin(std::string &&url);
-
   static bool IsSameOrigin(
       winrt::Windows::Foundation::Uri const &u1,
       winrt::Windows::Foundation::Uri const &u2) noexcept;
@@ -80,9 +77,9 @@ class OriginPolicyHttpFilter
       winrt::Windows::Web::Http::HttpResponseMessage const &response,
       bool removeAll);
 
-  OriginPolicyHttpFilter(winrt::Windows::Web::Http::Filters::IHttpFilter const &innerFilter);
+  OriginPolicyHttpFilter(std::string &&origin, winrt::Windows::Web::Http::Filters::IHttpFilter const &innerFilter);
 
-  OriginPolicyHttpFilter();
+  OriginPolicyHttpFilter(std::string &&origin);
 
   OriginPolicy ValidateRequest(winrt::Windows::Web::Http::HttpRequestMessage const &request);
 

package/Shared/Networking/WinRTHttpResource.cpp

@@ -641,8 +641,7 @@ void WinRTHttpResource::AddResponseHandler(shared_ptr<IResponseHandler> response
 
 #pragma region IHttpResource
 
-/*static*/ shared_ptr<IHttpResource> IHttpResource::Make(
-    winrt::Windows::Foundation::IInspectable const &inspectableProperties) noexcept {
+/*static*/ shared_ptr<IHttpResource> IHttpResource::Make(IInspectable const &inspectableProperties) noexcept {
   using namespace winrt::Microsoft::ReactNative;
   using winrt::Windows::Web::Http::HttpClient;
 
@@ -653,8 +652,7 @@ void WinRTHttpResource::AddResponseHandler(shared_ptr<IResponseHandler> response
     client = HttpClient{redirFilter};
   } else {
     auto globalOrigin = GetRuntimeOptionString("Http.GlobalOrigin");
-    OriginPolicyHttpFilter::SetStaticOrigin(std::move(globalOrigin));
-    auto opFilter = winrt::make<OriginPolicyHttpFilter>(redirFilter);
+    auto opFilter = winrt::make<OriginPolicyHttpFilter>(std::move(globalOrigin), redirFilter);
     redirFilter.as<RedirectHttpFilter>()->SetRedirectSource(opFilter.as<IRedirectEventSource>());
 
     client = HttpClient{opFilter};