[tomekzaw]

Summary:

For a synchronous method that returns an object or an array, JavaTurboModule casts the result to NativeMap or NativeArray and reads its C++ part. A module can return any WritableMap/WritableArray, for example a JavaOnlyMap or JavaOnlyArray. JNI then reads an unrelated field of that object as the native pointer, and the app crashes on the JS thread with a SIGSEGV in NativeMap::consume().

This casts the result with dynamic_ref_cast instead of static_ref_cast, so a result that isn't a native map or array throws a ClassCastException, which becomes a JS error.

Changelog:

[ANDROID] [FIXED] - Throw a JS error instead of crashing when a synchronous TurboModule method returns a map or array that isn't a native one

Test Plan:

Release RNTester (./gradlew :packages:rn-tester:android:app:assembleRelease -PreactNativeArchitectures=arm64-v8a) with these temporary, uncommitted changes:

• SampleTurboModule.getObject returns JavaOnlyMap.of("a", 1.0) and getArray returns JavaOnlyArray.of("a") when given a marker argument.
• A Playground screen that calls them.
• R8 turned off, because SampleTurboModule can't initialize in a minified build, which is a separate issue.

On a Galaxy A16 (Android 16):

Call	main	This PR
getObject returning a JavaOnlyMap	SIGSEGV: #00 NativeMap::consume(), #01 JavaTurboModule::invokeJavaMethod	JS error: java.lang.ClassCastException: Tried to cast from class com.facebook.react.bridge.JavaOnlyMap to com/facebook/react/bridge/NativeMap.
getArray returning a JavaOnlyArray	SIGSEGV on the JS thread	JS error: java.lang.ClassCastException: Tried to cast from class com.facebook.react.bridge.JavaOnlyArray to com/facebook/react/bridge/NativeArray.
getObject({a: 1, b: 'two'}), getArray([1, 'two', {three: 3}]), getConstants()	Return the expected values	Same values

Not run: an automated test. JavaTurboModule has no host-side tests, and Fantom doesn't load Java modules.

🤖 Generated with Claude Code

[javache]

If we want to type-check this unconditionally, we should use dynamic_ref_cast instead. Alternatively, we could only do the type-check in debug?

[tomekzaw]

Switched to dynamic_ref_cast in 1cbf1b1. The crash happens in release builds, so I kept the check unconditional. Rechecked on a Galaxy A16: a JavaOnlyMap/JavaOnlyArray result now throws a ClassCastException as a JS error.