fix: backport RN scheduler delegate UAF guard by KJ21-ENG · Pull Request #93878 · Expensify/App

KJ21-ENG · 2026-06-17T20:19:29Z

Explanation of Change

Backports the upstream React Native scheduler delegate invalidation guard from RN 0.86 into the RN 0.83.1 patch layer.

RN 0.83.1 schedules deferred Fabric rendering-update lambdas that capture the raw SchedulerDelegate*. During HybridApp lifecycle churn, the delegate can be torn down before RuntimeScheduler_Modern drains the queued rendering update, so this patch adds a per-delegate invalidation token and makes already-queued lambdas no-op before dereferencing a stale delegate.

The guard is intentionally unconditional in this backport. Upstream RN gates it behind enableSchedulerDelegateInvalidation(), but this branch does not backport RN's feature-flag plumbing and follows the approved proposal's unconditional option because calling a destroyed delegate is never valid.

Fixed Issues

$ #92412
PROPOSAL: #92412 (comment)

Tests

Build and run the iOS HybridApp from this branch.
Sign in to a test account.
From Expensify Classic, open New Expensify.
Navigate between several chats/reports and scroll quickly.
Background the app for a few seconds, then foreground it.
Switch back to Expensify Classic.
Repeat the Classic -> New Expensify -> Classic transition several times.
Verify the app does not crash, especially with RuntimeScheduler_Modern::runEventLoopTick.

Verify that no errors appear in the JS console

Offline tests

N/A. This is a native React Native scheduler lifetime patch and does not change app network/offline behavior.

QA Steps

On iOS Native HybridApp, sign in to a test account.
From Expensify Classic, open New Expensify.
Navigate between chats/reports, scroll quickly, and background/foreground the app.
Switch back to Expensify Classic.
Repeat the Classic -> New Expensify -> Classic transition several times.
Verify the app does not crash.

Verify that no errors appear in the JS console

PR Author Checklist

Screenshots/Videos

Android: Native

N/A. This PR does not change the UI.

Android: mWeb Chrome

N/A. This PR does not change the UI.

iOS: Native

ezyZip.58.mp4

iOS: mWeb Safari

N/A. This PR does not change the UI.

MacOS: Chrome / Safari

N/A. This PR does not change the UI.

github-actions · 2026-06-17T20:19:46Z

⚠️ This PR is possibly changing native code and/or updating libraries, it may cause problems with HybridApp. Please check if any patch updates are required in the HybridApp repo and run an AdHoc build to verify that HybridApp will not break. Ask Contributor Plus for help if you are not sure how to handle this. ⚠️

melvin-bot · 2026-06-18T07:05:19Z

@mkhutornyi Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

KJ21-ENG · 2026-06-19T19:01:35Z

@mkhutornyi Kind ping here. Thanks!

KJ21-ENG · 2026-06-22T09:54:49Z

@mkhutornyi Kind ping here, Thanks!

mkhutornyi

Run python3 /Users/kushjariwla/.codex/skills/expensify-app-targeted-checks/scripts/touched_files.py --base upstream/main

Verify the only touched files are patches/react-native/details.md and patches/react-native/react-native+0.83.1+040+fix-runtime-scheduler-delegate-uaf-APP-25V.patch

Run npx prettier --write patches/react-native/details.md

Run git diff --check

Run git diff --check upstream/main

Apply patches/react-native/react-native+0.83.1+040+fix-runtime-scheduler-delegate-uaf-APP-25V.patch with patch --dry-run against fresh RN v0.83.1 Scheduler.cpp and Scheduler.h sources

Verify the patch applies cleanly to both RN scheduler files

Please avoid this kind of tests steps in future PRs. It should be real test scenario users can follow.

Screenshots/Videos

iOS: Native
N/A. This PR does not change the UI.

iOS test is needed.

KJ21-ENG · 2026-06-25T06:55:22Z

Please avoid this kind of tests steps in future PRs. It should be real test scenario users can follow.

Understood. Actually, up until now, I was putting the test scenarios in the QA steps and the literal tests that were run under 'Tests'. Now I understand how it should be done. Updated PR body for same. Thanks!

iOS test is needed.

@mkhutornyi Actually i do not have access to hybrid app, i can test from an iOS HybridApp ad-hoc test build for this PR with FORCE_NATIVE_BUILD=true.

mkhutornyi · 2026-06-25T06:57:27Z

@mkhutornyi Actually i do not have access to hybrid app, i can test from an iOS HybridApp ad-hoc test build for this PR with FORCE_NATIVE_BUILD=true.

yes, standalone app test is fine for you

KJ21-ENG · 2026-06-25T09:09:34Z

Done, Thanks!

mkhutornyi · 2026-06-26T15:04:27Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Android: mWeb Chrome

iOS: HybridApp

ios.mov

iOS: mWeb Safari

MacOS: Chrome / Safari

mkhutornyi · 2026-06-26T15:04:44Z

@codex review

mkhutornyi · 2026-06-26T15:04:47Z

@MelvinBot review

chatgpt-codex-connector · 2026-06-26T15:09:39Z

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: ae8fdd4969

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

KJ21-ENG · 2026-06-29T11:23:57Z

@mountiny Kind ping here. Thanks!

mountiny

@jakubstec for visibility we will need to address this in future rn updates

github-actions · 2026-06-29T12:11:04Z

🚧 mountiny has triggered a test Expensify/App build. You can view the workflow run here.

OSBotify · 2026-06-29T12:14:47Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

github-actions · 2026-06-29T12:36:00Z

🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
Built from App PR #93878.

Android 🤖	iOS 🍎
https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-android-Adhoc-5882f45ca35-1253c6b-03812fa21478563588a0320a24d60b12d923b6f1/index.html	https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-ios-device-AdHoc-5882f45-1253c6b-ae449ddcdd217d885a35439fb290e896d9da704c/index.html

Web 🕸️
https://93878.pr-testing.expensify.com

👀 View the workflow run that generated this build 👀

OSBotify · 2026-06-29T12:47:18Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.4.22-1 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	cancelled 🔪
🍎 iOS 🍎	cancelled 🔪

OSBotify · 2026-06-29T19:36:57Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.4.24-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	failure ❌

OSBotify · 2026-06-30T11:49:50Z

🚀 Deployed to production by https://github.com/cristipaval in version: 9.4.24-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	failure ❌

Bundle Size Analysis (Sentry):

Android

OSBotify · 2026-06-30T12:32:48Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.4.24-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	failure ❌

war-in · 2026-07-17T12:09:49Z

+- Reason: Fixes a fatal iOS HybridApp crash (APP-25V) where `RuntimeScheduler_Modern::runEventLoopTick` can drain deferred Fabric rendering updates after the captured `SchedulerDelegate` has been torn down. RN 0.83.1 queues `Scheduler::uiManagerDidFinishTransaction` and `Scheduler::uiManagerDidDispatchCommand` callbacks with lambdas that capture the raw `delegate_` pointer by value. During OldDot↔NewDot lifecycle churn, the delegate can be replaced or destroyed before the scheduled rendering update runs, causing `EXC_BAD_ACCESS` when the lambda dereferences stale native memory. This patch backports the upstream RN scheduler-delegate invalidation guard by adding a per-delegate `shared_ptr<atomic<bool>>` token, invalidating the old token on delegate changes and Scheduler destruction, and making already-queued lambdas no-op before touching a stale delegate.
+- Upstream PR/issue: https://github.com/facebook/react-native/pull/56680 / https://github.com/facebook/react-native/commit/aadbe965792bd900ca70412d6704b76e339d1aca
+- E/App issue: https://github.com/Expensify/App/issues/92412
+- PR introducing patch: 🛑


Please follow the PATCHES.md guide when adding a new patch 🙏

Ideally, every patch should have a PR introducing patch field filled out, so it's easier to find a PR that introduced it. It's way easier to verify if such patch is still necessary or not after some time. Thanks!

cc @KJ21-ENG @mkhutornyi

@KJ21-ENG Can you please create a follow up pr for this? thanks!

Sorry for missing that

Np, I'm just making sure the new patches are at least linked to the PRs. Also, this is not a big deal because the patch will be removed in the next RN bump, but let's update it for clarity

@KJ21-ENG Can you please create a follow up pr for this? thanks!

Sorry for missing that

On it.

Follow-up PR created: #96445

cc: @mkhutornyi @mountiny

melvin-bot Bot assigned KJ21-ENG Jun 17, 2026

Fix RN scheduler delegate UAF

28138a4

KJ21-ENG force-pushed the KJ21-ENG/92412-runtime-scheduler-uaf-fix branch from e403fd3 to 28138a4 Compare June 18, 2026 06:19

Fix RN scheduler patch whitespace

ae8fdd4

KJ21-ENG changed the title ~~[WIP] fix: backport RN scheduler delegate UAF guard~~ fix: backport RN scheduler delegate UAF guard Jun 18, 2026

KJ21-ENG marked this pull request as ready for review June 18, 2026 07:05

KJ21-ENG requested a review from a team as a code owner June 18, 2026 07:05

melvin-bot Bot requested a review from mkhutornyi June 18, 2026 07:05

melvin-bot Bot removed the request for review from a team June 18, 2026 07:05

mkhutornyi suggested changes Jun 24, 2026

View reviewed changes

KJ21-ENG requested a review from mkhutornyi June 25, 2026 09:09

mkhutornyi approved these changes Jun 26, 2026

View reviewed changes

melvin-bot Bot requested a review from mountiny June 26, 2026 15:46

mountiny approved these changes Jun 29, 2026

View reviewed changes

mountiny merged commit 5882f45 into Expensify:main Jun 29, 2026
29 of 83 checks passed

github-actions Bot mentioned this pull request Jun 29, 2026

Investigate workflow job failing on main: build (New Expensify Dev, DebugDevelopment, false) #94831

Closed

OSBotify mentioned this pull request Jun 29, 2026

Deploy Checklist: New Expensify 2026-06-29 #94832

Closed

36 tasks

melvin-bot Bot mentioned this pull request Jun 30, 2026

[Due for payment 2026-07-07] [$250] [Sentry: APP-25V] HybridApp iOS EXC_BAD_ACCESS in RuntimeScheduler_Modern::runEventLoopTick #92412

Open

war-in reviewed Jul 17, 2026

View reviewed changes

KJ21-ENG mentioned this pull request Jul 18, 2026

docs: link scheduler delegate patch to PR #93878 #96445

Open

40 tasks

Uh oh!

Conversation

KJ21-ENG commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

melvin-bot Bot commented Jun 18, 2026

Uh oh!

KJ21-ENG commented Jun 19, 2026

Uh oh!

KJ21-ENG commented Jun 22, 2026

Uh oh!

mkhutornyi left a comment

Choose a reason for hiding this comment

Screenshots/Videos

Uh oh!

KJ21-ENG commented Jun 25, 2026

Uh oh!

mkhutornyi commented Jun 25, 2026

Uh oh!

KJ21-ENG commented Jun 25, 2026

Uh oh!

mkhutornyi commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Screenshots/Videos

Uh oh!

mkhutornyi commented Jun 26, 2026

Uh oh!

mkhutornyi commented Jun 26, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 26, 2026

Uh oh!

KJ21-ENG commented Jun 29, 2026

Uh oh!

mountiny left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

OSBotify commented Jun 29, 2026

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

OSBotify commented Jun 29, 2026

Uh oh!

OSBotify commented Jun 29, 2026

Uh oh!

OSBotify commented Jun 30, 2026

Uh oh!

OSBotify commented Jun 30, 2026

Uh oh!

war-in Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mountiny Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

war-in Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

KJ21-ENG Jul 18, 2026

Choose a reason for hiding this comment

Uh oh!

KJ21-ENG Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

KJ21-ENG commented Jun 17, 2026 •

edited

Loading

mkhutornyi commented Jun 26, 2026 •

edited

Loading

war-in Jul 17, 2026 •

edited

Loading

KJ21-ENG Jul 18, 2026 •

edited

Loading