fix: validate FFI round-trip lifetimes

DjDeveloperr · DjDeveloperr · commit 916b4552a8fc · 2026-06-01T22:52:07.000-04:00
diff --git a/NativeScript/ffi/shared/bridge/Callbacks.mm b/NativeScript/ffi/shared/bridge/Callbacks.mm
@@ -390,7 +390,8 @@ Function persistentEngineFunction(Runtime& runtime, const Function& function) {
                        Function function, bool block,
                        NativeApiCallbackThreadPolicy threadPolicy =
                            NativeApiCallbackThreadPolicy::Default,
-                       bool bindThis = false)
+                       bool bindThis = false,
+                       uintptr_t roundTripValidationKey = 0)
       : runtimeOwner_(retainNativeApiRuntime(runtime)),
         runtime_(runtimeOwner_.get()),
         bridge_(std::move(bridge)),
@@ -399,7 +400,8 @@ Function persistentEngineFunction(Runtime& runtime, const Function& function) {
             persistentEngineFunction(runtime, function))),
         block_(block),
         threadPolicy_(threadPolicy),
-        bindThis_(bindThis) {
+        bindThis_(bindThis),
+        roundTripValidationKey_(roundTripValidationKey) {
     closure_ = static_cast<ffi_closure*>(
         ffi_closure_alloc(sizeof(ffi_closure), &executable_));
     if (closure_ == nullptr || executable_ == nullptr ||
@@ -482,7 +484,8 @@ void retainBlockCopy(const void* blockPointer) {
     if (bridge_ != nullptr && runtime_ != nullptr && function_ != nullptr &&
         blockPointer != nullptr) {
       bridge_->rememberRoundTripValue(*runtime_, blockPointer,
-                                      Value(*runtime_, *function_));
+                                      Value(*runtime_, *function_), false,
+                                      roundTripValidationKey_);
     }
     std::lock_guard<std::mutex> lock(retainedBlockCopiesMutex_);
     retainedBlockCopies_.push_back({blockPointer, std::move(self)});
@@ -895,6 +898,7 @@ void storeReturnValue(const Value& result, void* ret) {
   NativeApiCallbackThreadPolicy threadPolicy_ =
       NativeApiCallbackThreadPolicy::Default;
   bool bindThis_ = false;
+  uintptr_t roundTripValidationKey_ = 0;
   ffi_closure* closure_ = nullptr;
   void* executable_ = nullptr;
   std::string blockSignature_;
@@ -2122,9 +2126,11 @@ throw JSError(
 
   auto signature =
       std::make_shared<NativeApiSignature>(std::move(*parsed));
+  uintptr_t roundTripValidationKey =
+      NativeApiBridge::callbackRoundTripValidationKey(type);
   auto callback = std::make_shared<NativeApiCallback>(
       runtime, bridge, std::move(signature), std::move(function), block,
-      threadPolicy);
+      threadPolicy, false, roundTripValidationKey);
   if (block) {
     callback->retainInitialBlockLifetime(callback);
   } else {
diff --git a/NativeScript/ffi/shared/bridge/HostObjects.mm b/NativeScript/ffi/shared/bridge/HostObjects.mm
@@ -646,6 +646,7 @@ Array runtimeMembersArray(Runtime& runtime, Class cls, bool staticMembers) {
     if (object_ != nil && !ownsObject_) {
       [object_ retain];
       ownsObject_ = true;
+      wrapperRetainedObject_ = true;
     }
   }
 
@@ -685,6 +686,7 @@ void disownObject(id expected) {
         bridge_->forgetObjectExpandos(expected);
       }
       ownsObject_ = false;
+      wrapperRetainedObject_ = false;
       object_ = nil;
       if (lifetimeState_ != nullptr) {
         lifetimeState_->clear();
@@ -749,6 +751,7 @@ throw JSError(runtime,
         // returning `this` still have a valid native object.
         object_ = resultObject;
         ownsObject_ = true;
+        wrapperRetainedObject_ = true;
         if (lifetimeState_ != nullptr) {
           lifetimeState_->setObject(object_);
         }
@@ -803,6 +806,7 @@ throw JSError(runtime,
         // returning `this` still have a valid native object.
         object_ = resultObject;
         ownsObject_ = true;
+        wrapperRetainedObject_ = true;
         if (lifetimeState_ != nullptr) {
           lifetimeState_->setObject(object_);
         }
@@ -1183,25 +1187,29 @@ Value get(Runtime& runtime, const PropNameID& name) override {
 
             id object = self->object_;
             bool ownsObject = self->ownsObject_;
+            bool wrapperRetainedObject = self->wrapperRetainedObject_;
             if (self->bridge_ != nullptr) {
               self->bridge_->forgetRoundTripValue(runtime, object);
               self->bridge_->forgetObjectExpandos(object);
             }
             self->object_ = nil;
             self->ownsObject_ = false;
+            self->wrapperRetainedObject_ = false;
             if (self->lifetimeState_ != nullptr) {
               self->lifetimeState_->clear();
             }
             self->consumed_ = true;
+            const bool releasePreviousOwnership =
+                ownsObject && (!retained || wrapperRetainedObject);
             try {
               Value result =
                   makeNativeObjectValue(runtime, self->bridge_, object, retained);
-              if (!retained && ownsObject) {
+              if (releasePreviousOwnership) {
                 [object release];
               }
               return result;
             } catch (...) {
-              if (!retained && ownsObject) {
+              if (releasePreviousOwnership) {
                 [object release];
               }
               throw;
@@ -1517,6 +1525,7 @@ throw JSError(
   std::shared_ptr<NativeApiBridge> bridge_;
   id object_ = nil;
   bool ownsObject_ = false;
+  bool wrapperRetainedObject_ = false;
   bool consumed_ = false;
   std::shared_ptr<NativeApiObjectLifetimeState> lifetimeState_;
 };
@@ -1865,6 +1874,15 @@ Value makeNativeObjectValue(Runtime& runtime,
   if (!prototypeValue.isObject()) {
     prototypeValue = bridge->findClassPrototype(runtime, object_getClass(object));
   }
+  if (!prototypeValue.isObject()) {
+    Value classWrapper = makeNativeClassValue(
+        runtime, bridge,
+        nativeApiSymbolForRuntimeClass(bridge, object_getClass(object)));
+    if (classWrapper.isObject()) {
+      prototypeValue =
+          classWrapper.asObject(runtime).getProperty(runtime, "prototype");
+    }
+  }
   if (prototypeValue.isObject()) {
     Object prototype = prototypeValue.asObject(runtime);
     SetNativeApiObjectPrototype(runtime, result, prototype);
diff --git a/NativeScript/ffi/shared/bridge/ObjCBridge.mm b/NativeScript/ffi/shared/bridge/ObjCBridge.mm
@@ -565,7 +565,7 @@ inline uintptr_t normalizeRuntimePointer(uintptr_t pointer) {
     std::shared_ptr<Value> value;
     bool stringLikeNative = false;
     bool persistBeyondFrame = true;
-    uintptr_t objectClassKey = 0;
+    uintptr_t validationKey = 0;
   };
   using NativeApiRoundTripReleaseList =
       std::vector<NativeApiRoundTripValue>;
@@ -657,9 +657,20 @@ explicit NativeApiBridge(const NativeApiConfig& config)
     return it != functionSymbolsByName_.end() ? &it->second : nullptr;
   }
 
+  static uintptr_t callbackRoundTripValidationKey(
+      const NativeApiType& type) {
+    if (type.signatureOffset == 0 ||
+        type.signatureOffset == MD_SECTION_OFFSET_NULL) {
+      return 0;
+    }
+    return (static_cast<uintptr_t>(type.signatureOffset) << 8) |
+           (static_cast<uintptr_t>(type.kind) & 0xff);
+  }
+
   void rememberRoundTripValue(Runtime& runtime, const void* native,
                               const Value& value,
-                              bool stringLikeNative = false) {
+                              bool stringLikeNative = false,
+                              uintptr_t validationKey = 0) {
     if (native == nullptr) {
       return;
     }
@@ -672,7 +683,7 @@ void rememberRoundTripValue(Runtime& runtime, const void* native,
           roundTripValues_, key,
           NativeApiRoundTripValue{
               std::make_shared<Value>(runtime, value), stringLikeNative, true,
-              0},
+              validationKey},
           releaseAfterUnlock);
       roundTripValuesGeneration_.fetch_add(1, std::memory_order_release);
     }
@@ -685,7 +696,7 @@ void rememberScopedRoundTripValue(Runtime& runtime, const void* native,
                                     const Value& value,
                                     bool stringLikeNative = false,
                                     bool persistBeyondFrame = true) {
-    rememberScopedRoundTripValueWithClassKey(
+    rememberScopedRoundTripValueWithValidationKey(
         runtime, native, value, stringLikeNative, persistBeyondFrame,
         nativeObjectClassKey(native));
   }
@@ -694,26 +705,26 @@ void rememberScopedRawRoundTripValue(Runtime& runtime, const void* native,
                                        const Value& value,
                                        bool stringLikeNative = false,
                                        bool persistBeyondFrame = true) {
-    rememberScopedRoundTripValueWithClassKey(runtime, native, value,
-                                             stringLikeNative,
-                                             persistBeyondFrame, 0);
+    rememberScopedRoundTripValueWithValidationKey(runtime, native, value,
+                                                  stringLikeNative,
+                                                  persistBeyondFrame, 0);
   }
 
-  void rememberScopedRoundTripValueWithClassKey(Runtime& runtime,
-                                                const void* native,
-                                                const Value& value,
-                                                bool stringLikeNative,
-                                                bool persistBeyondFrame,
-                                                uintptr_t objectClassKey) {
+  void rememberScopedRoundTripValueWithValidationKey(Runtime& runtime,
+                                                     const void* native,
+                                                     const Value& value,
+                                                     bool stringLikeNative,
+                                                     bool persistBeyondFrame,
+                                                     uintptr_t validationKey) {
     if (native == nullptr) {
       return;
     }
     uintptr_t key =
         normalizeRuntimePointer(reinterpret_cast<uintptr_t>(native));
     NativeApiRoundTripValue entry{
         std::make_shared<Value>(runtime, value), stringLikeNative,
-        persistBeyondFrame, objectClassKey};
-      NativeApiRoundTripReleaseList releaseAfterUnlock;
+        persistBeyondFrame, validationKey};
+    NativeApiRoundTripReleaseList releaseAfterUnlock;
     {
       std::lock_guard<std::mutex> lock(roundTripValuesMutex_);
       auto framesIt =
@@ -732,7 +743,8 @@ void rememberScopedRoundTripValueWithClassKey(Runtime& runtime,
 
   Value findRoundTripValue(Runtime& runtime, const void* native,
                            bool* stringLikeNative = nullptr,
-                           bool nativeIsObject = false) {
+                           bool nativeIsObject = false,
+                           uintptr_t validationKey = 0) {
     if (stringLikeNative != nullptr) {
       *stringLikeNative = false;
     }
@@ -741,13 +753,18 @@ Value findRoundTripValue(Runtime& runtime, const void* native,
     }
     uintptr_t key =
         normalizeRuntimePointer(reinterpret_cast<uintptr_t>(native));
+    const uintptr_t expectedValidationKey =
+        validationKey != 0
+            ? validationKey
+            : (nativeIsObject ? nativeObjectClassKey(native) : 0);
     struct RoundTripCacheEntry {
       const NativeApiBridge* bridge = nullptr;
       uintptr_t key = 0;
       uint64_t generation = 0;
       std::weak_ptr<Value> value;
       bool miss = false;
       bool stringLikeNative = false;
+      uintptr_t validationKey = 0;
     };
     static thread_local RoundTripCacheEntry cache[4];
     const uint64_t generation =
@@ -757,6 +774,9 @@ Value findRoundTripValue(Runtime& runtime, const void* native,
       RoundTripCacheEntry& entry = cache[(firstSlot + i) & 3];
       if (entry.bridge == this && entry.key == key &&
           entry.generation == generation) {
+        if (entry.validationKey != expectedValidationKey) {
+          break;
+        }
         if (entry.miss) {
           return Value::undefined();
         }
@@ -782,11 +802,8 @@ Value findRoundTripValue(Runtime& runtime, const void* native,
         if (it == map.end() || it->second.value == nullptr) {
           return nullptr;
         }
-        if (it->second.objectClassKey != 0) {
-          if (!nativeIsObject ||
-              it->second.objectClassKey != nativeObjectClassKey(native)) {
-            return nullptr;
-          }
+        if (it->second.validationKey != expectedValidationKey) {
+          return nullptr;
         }
         return &it->second;
       };
@@ -809,14 +826,15 @@ Value findRoundTripValue(Runtime& runtime, const void* native,
         entry = findEntry(recentRoundTripValues_);
       }
       if (entry == nullptr) {
-        cache[firstSlot] =
-            RoundTripCacheEntry{this, key, generation, {}, true, false};
+        cache[firstSlot] = RoundTripCacheEntry{
+            this, key, generation, {}, true, false, expectedValidationKey};
         return Value::undefined();
       }
       storedValue = entry->value;
       cachedStringLike = entry->stringLikeNative;
       cache[firstSlot] = RoundTripCacheEntry{
-          this, key, generation, storedValue, false, cachedStringLike};
+          this, key, generation, storedValue, false, cachedStringLike,
+          entry->validationKey};
     }
     if (stringLikeNative != nullptr) {
       *stringLikeNative = cachedStringLike;
diff --git a/NativeScript/ffi/shared/bridge/TypeConv.mm b/NativeScript/ffi/shared/bridge/TypeConv.mm
@@ -842,12 +842,16 @@ throw JSError(
               createEngineCallback(runtime, bridge, type, object.asFunction(runtime),
                                 type.kind == metagen::mdTypeBlock, threadPolicy);
           void* pointer = callback->functionPointer();
+          uintptr_t roundTripValidationKey =
+              NativeApiBridge::callbackRoundTripValidationKey(type);
           if (type.kind == metagen::mdTypeBlock) {
             frame.addObject(static_cast<id>(pointer));
             frame.addLifetime(callback);
-            bridge->rememberRoundTripValue(runtime, pointer, value);
+            bridge->rememberRoundTripValue(runtime, pointer, value, false,
+                                           roundTripValidationKey);
           } else {
-            bridge->rememberRoundTripValue(runtime, pointer, value);
+            bridge->rememberRoundTripValue(runtime, pointer, value, false,
+                                           roundTripValidationKey);
           }
           try {
             object.setProperty(runtime, "__nativeApiPointerObject",
@@ -1077,7 +1081,9 @@ throw JSError(runtime,
       if (pointer == nullptr) {
         return Value::null();
       }
-      Value roundTrip = bridge->findRoundTripValue(runtime, pointer);
+      Value roundTrip = bridge->findRoundTripValue(
+          runtime, pointer, nullptr, false,
+          NativeApiBridge::callbackRoundTripValidationKey(type));
       if (!roundTrip.isUndefined()) {
         return roundTrip;
       }
diff --git a/test/runtime/fixtures/Api/TNSReturnsRetained.h b/test/runtime/fixtures/Api/TNSReturnsRetained.h
@@ -1,14 +1,14 @@
 id functionReturnsNSRetained() NS_RETURNS_RETAINED;
-id functionReturnsCFRetained() CF_RETURNS_RETAINED;
+id functionReturnsCFRetained() CF_RETURNS_RETAINED NS_RETURNS_RETAINED;
 
 CF_IMPLICIT_BRIDGING_ENABLED
 CFTypeRef functionImplicitCreate();
 CF_IMPLICIT_BRIDGING_DISABLED
 
-id functionExplicitCreateNSObject();
+id functionExplicitCreateNSObject() NS_RETURNS_RETAINED;
 
 @interface TNSReturnsRetained : NSObject
 + (id)methodReturnsNSRetained NS_RETURNS_RETAINED;
-+ (id)methodReturnsCFRetained CF_RETURNS_RETAINED;
++ (id)methodReturnsCFRetained CF_RETURNS_RETAINED NS_RETURNS_RETAINED;
 + (id)newNSObjectMethod;
 @end
diff --git a/test/runtime/runner/app/tests/ApiTests.js b/test/runtime/runner/app/tests/ApiTests.js
@@ -795,8 +795,7 @@ describe(module.id, function () {
         expect(functionImplicitCreate().retainCount()).toBe(1);
 
         var obj = functionExplicitCreateNSObject();
-        expect(obj.retainCount()).toBe(2);
-        CFRelease(obj);
+        expect(obj.retainCount()).toBe(1);
 
         expect(TNSReturnsRetained.methodReturnsNSRetained().retainCount()).toBe(1);
         expect(TNSReturnsRetained.methodReturnsCFRetained().retainCount()).toBe(1);
