fix: guard JS callbacks during subclass init

Author: DjDeveloperr

NativeScript/ffi/shared/bridge/Callbacks.mm

@@ -1450,6 +1450,10 @@ bool shouldSkipMethodCallback(void* args[], void* ret) {
       return false;
     }
 
+    if (shouldSkipConstructingMethodCallback(args, ret)) {
+      return true;
+    }
+
     id receiver = objectForMethodPolicyTarget(
         args, NativeApiMethodCallbackPolicy::Target{});
     for (const auto& key :
@@ -1470,6 +1474,23 @@ bool shouldSkipMethodCallback(void* args[], void* ret) {
     return true;
   }
 
+  bool shouldSkipConstructingMethodCallback(void* args[], void* ret) {
+    if (!bindThis_ || args == nullptr || signature_ == nullptr ||
+        signature_->selectorName.rfind("init", 0) == 0) {
+      return false;
+    }
+
+    id receiver = *static_cast<id*>(args[0]);
+    if (receiver == nil ||
+        objc_getAssociatedObject(
+            receiver, sel_registerName("__nativeApiConstructionState")) == nil) {
+      return false;
+    }
+
+    zeroReturnValue(ret);
+    return true;
+  }
+
   void invokeMethodSuper(void* ret, void* args[]) const {
     if (!bindThis_ || args == nullptr || signature_ == nullptr ||
         methodBaseClass_ == Nil) {

NativeScript/ffi/shared/bridge/HostObject.mm

@@ -324,6 +324,28 @@ throw JSError(runtime,
             return Value::undefined();
           });
     }
+    if (property == "__setObjectConstructionState") {
+      return Function::createFromHostFunction(
+          runtime, PropNameID::forAscii(runtime, "__setObjectConstructionState"),
+          2,
+          [](Runtime& runtime, const Value&, const Value* args,
+             size_t count) -> Value {
+            if (count < 1) {
+              return Value::undefined();
+            }
+            id object = NativeApiObjectHostObject::nativeObjectFromValue(
+                runtime, args[0]);
+            if (object == nil) {
+              return Value::undefined();
+            }
+            bool constructing =
+                count >= 2 && args[1].isBool() && args[1].getBool();
+            objc_setAssociatedObject(
+                object, sel_registerName("__nativeApiConstructionState"),
+                constructing ? @YES : nil, OBJC_ASSOCIATION_RETAIN_NONATOMIC);
+            return Value::undefined();
+          });
+    }
     if (property == "CC_SHA256") {
       auto bridge = bridge_;
       return Function::createFromHostFunction(
@@ -533,6 +555,7 @@ throw JSError(runtime,
     addPropertyName(runtime, names, "__makeSelectorGroupFunction");
     addPropertyName(runtime, names, "__rememberClassWrapper");
     addPropertyName(runtime, names, "__rememberObjectClassWrapper");
+    addPropertyName(runtime, names, "__setObjectConstructionState");
     addPropertyName(runtime, names, "getFunction");
     addPropertyName(runtime, names, "getConstant");
     addPropertyName(runtime, names, "getEnum");

NativeScript/ffi/shared/bridge/Install.mm

@@ -635,7 +635,16 @@ function shouldUseAllocInitConstructor(constructable, wrapper) {
     }
   }
 
-  function constructNativeInstance(nativeClass, args, rememberInstance) {
+  function setObjectConstructionState(instance, constructing) {
+    try {
+      if (api && typeof api.__setObjectConstructionState === 'function') {
+        api.__setObjectConstructionState(instance, !!constructing);
+      }
+    } catch (_) {
+    }
+  }
+
+  function constructNativeInstance(nativeClass, args, rememberInstance, markConstructing) {
     if (args.length === 1 &&
         args[0] &&
         typeof args[0] === 'object' &&
@@ -674,13 +683,16 @@ function constructNativeInstance(nativeClass, args, rememberInstance) {
     if (typeof rememberInstance === 'function') {
       instance = rememberInstance(instance);
     }
-    if (initializer.selectorName === 'init') {
-      if (typeof instance.init !== 'function') {
-        throw new Error('No initializer found that matches constructor invocation.');
-      }
-      return instance.init();
+    if (markConstructing) {
+      setObjectConstructionState(instance, true);
     }
     try {
+      if (initializer.selectorName === 'init') {
+        if (typeof instance.init !== 'function') {
+          throw new Error('No initializer found that matches constructor invocation.');
+        }
+        return instance.init();
+      }
       if (initializer.name && typeof instance[initializer.name] === 'function') {
         return instance[initializer.name](...actualArgs);
       }
@@ -694,6 +706,10 @@ function constructNativeInstance(nativeClass, args, rememberInstance) {
         throw new Error('No initializer found that matches constructor invocation.');
       }
       throw error;
+    } finally {
+      if (markConstructing) {
+        setObjectConstructionState(instance, false);
+      }
     }
   }
 
@@ -795,7 +811,12 @@ function wrapNativeClass(nativeClass) {
       }
       if (args.length > 0 ||
           shouldUseAllocInitConstructor(constructable, wrapper)) {
-        return rememberInstanceClass(constructNativeInstance(nativeClass, args, rememberInstanceClass));
+        return rememberInstanceClass(constructNativeInstance(
+          nativeClass,
+          args,
+          rememberInstanceClass,
+          shouldUseAllocInitConstructor(constructable, wrapper)
+        ));
       }
       if (typeof nativeClass.new !== 'function') {
         throw new Error('Native class cannot be initialized');

PROGRESS.md

@@ -17,6 +17,45 @@ TypeScript/UI worklets.
 
 ## Latest Update - 2026-06-30
 
+### 2026-06-30 01:13 EDT - guard JS callbacks during subclass construction
+
+- Scope check:
+  - This remains runtime stabilization on the RN-module branch split from
+    `refactor`. The change is a generic NativeScript JS-subclass construction
+    policy, not an RNS workaround and not direct-engine backend refactor work.
+  - Simulator-only rule remains active; no physical devices were used.
+- CI finding:
+  - GitHub Actions run `28420460035` on `59a756f4` kept setup, dependency
+    install, FFI boundary check, V8 download, libffi build, metadata
+    generation, NativeScript build, CLI build, and macOS tests green.
+  - iOS simulator still timed out at `ApiTests.js NSMutableArrayMethods`.
+  - The remaining failure is now narrowed to pre/post-init JS-backed subclass
+    callback behavior on iOS, not macOS wrapper identity.
+- Change:
+  - Added a host API that marks native objects as being inside JS-subclass
+    alloc/init construction.
+  - The install-time alloc/init constructor path marks only JS-extended
+    constructors that opt into remembered alloc/init construction, then clears
+    the marker in a `finally` block.
+  - Objective-C method callbacks now zero-return non-`init` JS overrides while
+    that receiver is still constructing, avoiding Foundation probes running JS
+    subclass methods before JS state exists.
+  - Source coverage guards the tracked runtime bridge and the RN mirror.
+- Verification:
+  - Focused construction guard test passed:
+    `node packages/react-native/test/runtime-instance-selector-base-dispatch.test.js`.
+  - Runtime RN JS tests passed:
+    `for f in packages/react-native/test/*.test.js; do node "$f" || exit 1; done`.
+  - `git diff --check` passed.
+  - `npm run check:ffi-boundaries` passed.
+  - `npm run build:macos-cli` passed.
+- Still next:
+  - Commit/push this construction-state callback guard and watch fresh PR CI for
+    the iOS simulator `ApiTests.js NSMutableArrayMethods` result.
+  - If iOS still hangs, add a tightly scoped diagnostic to distinguish
+    construction-time probing from fast-enumeration wrapper/state loss, then
+    remove it before landing.
+
 ### 2026-06-30 00:32 EDT - preserved init receivers use native-object round-trip keys
 
 - Scope check:

packages/react-native/test/runtime-instance-selector-base-dispatch.test.js

@@ -30,14 +30,47 @@ for (const relativePath of [
     source.match(/Object\.defineProperty\([^,]+, '__nativeApiUseAllocInitConstructor'/g) || [];
   assert(
     source.includes("function shouldUseAllocInitConstructor(constructable, wrapper)") &&
+      source.includes("function setObjectConstructionState(instance, constructing)") &&
+      source.includes("api.__setObjectConstructionState(instance, !!constructing)") &&
       source.includes("target.__nativeApiUseAllocInitConstructor") &&
       source.includes("args.length > 0 ||") &&
       source.includes("shouldUseAllocInitConstructor(constructable, wrapper)") &&
+      source.includes("setObjectConstructionState(instance, true)") &&
+      source.includes("setObjectConstructionState(instance, false)") &&
       allocInitFlagDefinitions.length >= 2,
     `${relativePath}: JS-extended native classes should use alloc/init construction so receivers are remembered before init dispatch`,
   );
 }
 
+for (const relativePath of [
+  "NativeScript/ffi/shared/bridge/HostObject.mm",
+  "packages/react-native/native-api/ffi/shared/bridge/HostObject.mm",
+]) {
+  const source = fs.readFileSync(path.join(repoRoot, relativePath), "utf8");
+
+  assert(
+    source.includes("__setObjectConstructionState") &&
+      source.includes('sel_registerName("__nativeApiConstructionState")') &&
+      source.includes("constructing ? @YES : nil"),
+    `${relativePath}: bridge API should mark native objects during JS-subclass construction`,
+  );
+}
+
+for (const relativePath of [
+  "NativeScript/ffi/shared/bridge/Callbacks.mm",
+  "packages/react-native/native-api/ffi/shared/bridge/Callbacks.mm",
+]) {
+  const source = fs.readFileSync(path.join(repoRoot, relativePath), "utf8");
+
+  assert(
+    source.includes("shouldSkipConstructingMethodCallback(args, ret)") &&
+      source.includes('signature_->selectorName.rfind("init", 0) == 0') &&
+      source.includes('sel_registerName("__nativeApiConstructionState")') &&
+      source.includes("zeroReturnValue(ret);"),
+    `${relativePath}: Objective-C callbacks should zero-return non-init JS overrides while the receiver is still constructing`,
+  );
+}
+
 for (const relativePath of [
   "NativeScript/ffi/shared/bridge/ClassBuilder.mm",
   "packages/react-native/native-api/ffi/shared/bridge/ClassBuilder.mm",