Skip to content

fix(ffi/objc): map metadata classes from frameworks loaded after init - #114

Open
NathanWalker wants to merge 481 commits into
android-react-nativefrom
fix/objc-lazy-framework-class-lookup
Open

NathanWalker wants to merge 481 commits into
android-react-nativefrom
fix/objc-lazy-framework-class-lookup

Conversation

@NathanWalker

Copy link
Copy Markdown
Contributor

Split out of #103 (part 5), reworked to keep lookups off the hot path as requested in review.

Summary

When class globals are registered, objc_getClass returns nil for classes in frameworks that aren't loaded yet (e.g. ScreenCaptureKit's SCWindow in a plain Node process). Those classes never entered mdClassesByPointer, so an SCWindow instance wrapped as NSObject with every property undefined.

 class not found by objc_getClass at registration
-  never mapped -> instances wrap as the nearest mapped superclass
+  kept in a pending list (name points into metadata, no copy)
+  objc_addLoadImageFunc bumps a process-wide generation counter
+  on a map miss, pending names are re-resolved once per new generation
  • Hits stay one mdClassesByPointer.find(cls).
  • Misses (e.g. __NSCFString at each superclass level) cost an empty check plus one atomic load and compare. No string allocation and no name lookup, unlike fix(ffi/objc): forward off-thread method and function callbacks to the JS thread #103's version.
  • Re-resolving runs once per burst of image loads, on the next miss. In a plain Node process, 2088 classes map at startup and 3115 stay pending. Importing ScreenCaptureKit (54 images) triggered one pass that mapped 59 classes in about 1.1 ms. No further passes ran while wrapping 255 SCWindows.
  • Threading: the image callback runs on the loading thread under the ObjC runtime lock and only bumps the atomic. All map and pending-list work happens on the bridge state's JS thread, so no lock is needed. The callback holds no per-state pointer, so teardown needs nothing, which matters because image callbacks can't be unregistered.
  • objc_addLoadImageFunc is available from macOS 10.15 / iOS 13, at or below the deployment targets.

Evidence

Node v26.10.0, plain Node-API build, macOS 26.6.2 (arm64):

Check Base This PR
SCShareableContent windows, SCWindow touched only via windows.objectAtIndex(0) NSObject, windowID/title/owningApplication all undefined SCWindow, real windowID and owningApplication
ScreenCaptureKit loaded with objc.import after init; valueForKey("defaultConfiguration") on the shared picker (untyped id) NSObject, properties undefined SCContentSharingPickerConfiguration, real property values
  • MACOS_TEST_FFI_BACKEND=napi npm run test:macos: tests=716, failures=0, errors=0, skipped=17
  • npm run test:macos: tests=716, failures=0, errors=0, skipped=10

Merge Danger

Door: two-way

Blast Radius: object wrapping in the Objective-C napi bridge. Instances of classes from frameworks loaded after init now wrap as their real class instead of a superclass.

ammarahm-ed and others added 30 commits August 14, 2026 06:16
When a java object is finally freed in Java, we notify the JS side to free the JS counterpart. At this time, the Java object is held weakly in Java too using a WeakReference. While the Java object is weakly held, the WeakReference is strongly kept in a HashMap never getting removed. In this PR we release the WeakReferences too on GC event ensuring that all memory is reclaimed.
ammarahm-ed and others added 26 commits September 19, 2026 11:51
Expo installs global.expo as a non-writable property, so exposing the
expo.* Java package under that name threw from CreateTopLevelNamespaces
on Hermes. Fall back to the $-prefixed name already used for packages
that collide with JS keywords.
The react-native target builds the Android tools jars, which compile
against jars stored in Git LFS under platforms/android/test-app/**/libs.
Without lfs on the Apple job's checkout, those resolve to pointer files
and compileKotlin fails with "zip END header not found".
…when it matches its last one

Fabric keeps _props across prepareForRecycle while the container is
cleared, so diffing against _props skipped setNativeViewHandle when a
recycled host was mounted with the handle it last showed, leaving it
empty. Diff against the oldProps argument instead, which is null on a
fresh mount.
fix(react-native/ios): attach a recycled NativeScriptUIView's handle when it matches its last one
The property-getter, round-trip and expando lookup caches identified a
bridge by its address. After a JS reload a new bridge can be allocated
where a destroyed one lived and match its entries: the getter cache then
returned a raw pointer into the freed bridge (EXC_BAD_ACCESS in
preparedObjCInvocationIsInit on the next launch), and cached misses
could hide values that exist.
…act-native.json (#85)

The config plugin and nativescript-rn configure replaced the whole
reactNative.metadata block, so every prebuild or configure run deleted
a hand-written metadata.android.include. That list is what keeps
classes, including autolinked module packages, in filtered Android
release metadata.

Merge into the existing metadata instead, accept metadata.android.include
in the plugin options, and write the file on Android-only prebuilds too.
* fix(react-native): explain a missing native module at import

Keep failing at import when NativeScriptNativeApi is not in the app
binary, but with an error that says the package cannot run in Expo Go
and that a build made before the package was added must be rebuilt,
instead of React Native's generic TurboModuleRegistry invariant.

Drop isAvailable() and the Android-specific init() path.
* fix(android): use $name when a Java package's global name is taken

Check whether the global already has the package's name and, if it
does, expose the package as `$name`, logging a warning. Both the jsi
and napi trees now do the same check, so an existing global is never
overwritten and no engine-specific read-only handling is needed.
With globals enabled, every key of every enum object became a global,
including short member names such as Center, Fill and CloudKit's Zone.
Libraries that feature-detect a global by name were misled: Angular's
zoneless scheduler checks typeof Zone and crashed at bootstrap.

The metadata only stored the shortened member names, so the bridge could
not tell which alias was the real C constant. Metadata format v2 records,
per enum, the prefix and suffix the generator stripped from its members,
and flags members whose stored name is already the full C name. The
reader rebuilds every member's exact C name from that; v1 metadata still
loads but yields no C names.

A shared alias builder (ffi/objc/shared/EnumMemberAliases.h) tags the C
name among each member's aliases and is used by both the JSI bridge and
the Node-API tree. The bridge exposes getEnumGlobalNames(enumName), and
the shared global installer and installGlobals() in
@nativescript/react-native define only those names. The Node-API tree
defines only C names as globals. Short names and other conveniences stay
on the enum object, which also gains the C name as a key, so constants
like MKMapTypeStandard and CKErrorZoneBusy now resolve.
* refactor(android): detach through the worker teardown path

Narrows the reload fix to what React Native needs: the module tracks its
own install, invalidate() detaches, and detaching reuses the teardown a
worker already goes through.

- Runtime.detach() is detachRuntime() (formerly detachWorkerRuntime) plus
  Runtime::DisposeRuntime (formerly DisposeWorkerRuntime), now built in
  the host-runtime flavour too. The separate Runtime::Detach is gone.
- ~Runtime still resets the main-runtime statics, and BuildMetadata still
  builds the tree once.

Dropped, to land separately or not at all: throwing on a failed post to
the JS thread, the GcListener delivery lock and the notifyGc change, the
orphaned-object map, the LRU cache clear, the global-ref delete in
~Runtime, MethodCallbackData ownership, and their napi mirrors.

* refactor(android): name napi's runtime teardown DisposeRuntime too
A GC batch could reach a worker runtime while it was being disposed:
the GC thread took the runtime from the subscriber map, the worker
thread unsubscribed and disposed its native Runtime, and the GC thread
then entered notifyGc for it and crashed (SIGSEGV on the GC thread).

Each subscriber now carries its own lock. A batch is delivered while
holding that lock, and only if the subscriber is still subscribed;
unsubscribe() removes the subscriber, then takes its lock to mark it
unsubscribed. Once unsubscribe() returns, no GC thread is inside that
runtime's notifyGc and none will enter it.

The memory monitor's notifyGc() takes the same per-runtime lock instead
of the listener-wide one, and unsubscribe() no longer takes the
listener-wide lock, so subscribing or unsubscribing one runtime never
waits on a GC delivery into another.
… dispose (#92)

Disposing a runtime (a worker, or a React Native guest runtime) left three
things behind:

- ObjectManager's LRU cache of Java objects: ~LRUCache drops its map without
  calling the evict callback, so every cached weak global ref stayed in the
  process-wide weak reference table. Add LRUCache::clear(), which evicts each
  entry, and call it from ObjectManager's dispose.
- The JNI global ref ~Runtime holds on the Java com.tns.Runtime.
- MethodCallbackData for static methods, extension-only methods and methods
  added from a skipped base class. CtorFuncCache only owns the instance
  method data, so these were never deleted (about 180 per worker that touches
  a handful of classes). MetadataNodeCache now owns them and deletes them in
  onDisposeEnv/onDisposeRuntime.

Applied to both the napi and jsi trees. Split out of #89.
…destroying (#95)

DestroyRuntime set is_destroying before flushing the finalizer queue.
HostObjectProxyPostFinalizer treats is_destroying as "leave the target
handle", a rule carried over from napi, where js_free_napi_env frees
leftover refs. engine:: handles have no such owner, so every queued proxy
cleanup leaked its JS wrapper, and on QuickJS JS_FreeRuntime aborted on
list_empty(&rt->gc_obj_list).

The queue is normally drained on the next looper tick. A worker that calls
close() from onmessage quits its looper first, which drops that tick, so any
proxy collected during the handler was still queued at dispose. terminate()
from the parent arrives after the tick has run.

Flush the queue first, while the runtime is not yet marked destroying.

Fixes #94
s_type_long_operations_cache is process-wide, but each runtime inserts
its entry on init and erases it on dispose from its own thread. Make it a
tns::ConcurrentMap, as MetadataNode's per-runtime cache already is, in
both the napi and jsi trees.

Fixes #93
…bal (#83)

Without strictGlobal the Worklets plugin captures every name a worklet
does not declare into its closure, read on the JS thread when the module
is evaluated, where NativeScript's classes do not exist: a module-level
worklet naming UILabel failed at startup with
"ReferenceError: Property 'UILabel' doesn't exist".

The config plugin and configure CLI now write
['react-native-worklets/plugin', { strictGlobal: true }] and
['babel-preset-expo', { worklets: false }] (so the preset adds no second
copy), upgrade bare entries in an existing config, and warn when an
entry with options lacks strictGlobal. The Babel setup also runs on
Android-only prebuilds.
Metadata classes whose image is not loaded when the class globals are registered (e.g. ScreenCaptureKit's SCWindow in a plain Node process) never entered mdClassesByPointer, so their instances were wrapped as NSObject.

Keep those classes in a pending list and bump a process-wide generation counter from an objc_addLoadImageFunc callback. On a mdClassesByPointer miss, the pending list is re-resolved on the JS thread only if an image has loaded since the last pass, so hits stay a single map lookup and misses add one atomic load.
@coderabbitai

coderabbitai Bot commented Nov 7, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 474158d1-193a-40d7-b77d-7249f7379036

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants