Skip to content

Commit 6bc6dd5

Browse files
javachefacebook-github-bot
authored andcommitted
Fix stack-use-after-return in TaskDispatchThread Android ctor
Summary: Under `dev_clang_asan`, `bloks_runtimeTestsAndroid` crashes at startup with `__asan_report_load4` inside `ThreadScope::WithClassLoader`. The Android branch of the `TaskDispatchThread` constructor captures the `priorityOffset` parameter by reference into the `std::thread` lambda; the constructor returns immediately, so by the time the thread runs and reads `priorityOffset` inside `setpriority(...)` the stack slot is gone. Non-asan builds tolerate the racy read; asan catches it deterministically. Capture `priorityOffset` (and `this`) by value on both the outer thread lambda and the inner `WithClassLoader` lambda. Changelog: [Internal] Differential Revision: D113046624
1 parent 0a1a06c commit 6bc6dd5

1 file changed

Lines changed: 6 additions & 3 deletions

File tree

packages/react-native/ReactCxxPlatform/react/threading/TaskDispatchThread.cpp

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,12 @@ TaskDispatchThread::TaskDispatchThread(
2727
int priorityOffset) noexcept
2828
: threadName_(threadName) {
2929
#ifdef ANDROID
30-
// Attaches the thread to JVM just in case anything calls out to Java
31-
thread_ = std::thread([&]() {
32-
facebook::jni::ThreadScope::WithClassLoader([&]() {
30+
// Attaches the thread to JVM just in case anything calls out to Java.
31+
// Capture priorityOffset by value: it is a constructor parameter whose
32+
// storage dies when the constructor returns, and the thread body reads it
33+
// asynchronously.
34+
thread_ = std::thread([this, priorityOffset]() {
35+
facebook::jni::ThreadScope::WithClassLoader([this, priorityOffset]() {
3336
int result = setpriority(
3437
PRIO_PROCESS,
3538
static_cast<pid_t>(::syscall(SYS_gettid)),

0 commit comments

Comments
 (0)