Repository navigation
Fix race in UiThreadUtil main handler lazy initialization - #58963
Closed
locnp-active wants to merge 1 commit into
Closed
locnp-active wants to merge 1 commit into
locnp-active wants to merge 1 commit into
Conversation
|
Hi @locnp-active! Thank you for your pull request and welcome to our community. Action RequiredIn order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you. ProcessIn order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA. Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks! |
meta-cla
Bot
added
the
CLA Signed
|
Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks! |
facebook-github-tools
Bot
added
the
Shared with Meta
Contributor
|
Why are you sending this PR? is there an observed crash that is actually happening?
I'm wondering if this is actually happening or not |
Contributor
Author
Yes, this is observed in production. Across several of our Android apps it's a fatal crash with this exact signature: ~20 reports from May to Oct 2026, starting after we moved from RN 0.79 to 0.83.2, and still present on 0.86.0. All devices are arm64 (Pixel 8a/10a/10 Pro, Galaxy S25, Moto G64y), Android 15–17. It shows up through two call paths, both at cold start while 1. Headless JS (FCM background message) on the main thread (4 of 5 sampled events) At the same moment, another thread is already past So the main thread sees 2. I don't have a deterministic local repro; this is from production crash reports only. Full stack trace of a representative event (RN 0.83.2, app identifiers redacted) |
|
@cortinico has imported this pull request. If you are a Meta employee, you can view this in D126040472. |
cortinico
requested changes
Oct 19, 2026
|
@cortinico merged this pull request in 65b3e64. |
Collaborator
|
This pull request was successfully merged by @locnp-active in 65b3e64 When will my fix make it into a release? | How to file a pick request? |
Contributor
Author
|
Thanks @cortinico and @javache for the review! Really appreciate you applying the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary:
UiThreadUtilkeeps its main-threadHandlerin a property delegated tolazy(LazyThreadSafetyMode.NONE):NONEcreates anUnsafeLazyImpl, whose getter is:mainHandleris first read by whichever thread first callsrunOnUiThread(),getUiThreadHandler()orremoveOnUiThread().isOnUiThread()and theassert*helpers only useLooper, so the main thread calling them does not initialize it. In practice the first reads usually come from background threads posting to the UI thread, such as the JS thread, the native modules thread, or a library's executor. When two of them make their first call at the same time:_value === UNINITIALIZED_VALUEand starts the initializer.UNINITIALIZED_VALUE, because A has not written_valueyet._valueand setsinitializer = null.initializer!!()and throwsNullPointerException.The same NPE can happen without the two calls overlapping in time.
_valueandinitializerare plain fields, so on a weakly ordered CPU (ARM) another thread can observeinitializer == nullbefore it observes the new_value.The exception is thrown from the accessor Kotlin generates for the delegated property, so crash reports show the top frame as
com.facebook.react.bridge.UiThreadUtil.getMainHandler. Only the first access in a process can race, so the crash is rare but fatal and usually happens during startup.This was introduced in #50536 (1033584), which migrated
UiThreadUtilto Kotlin. The Java implementation used double-checked locking on avolatilefield. A reviewer suggested plainby lazy { }, which is synchronized by default, but the merged code usesLazyThreadSafetyMode.NONE. Every release from 0.80 to 0.88.0-rc.4 includes it.This PR switches the property to
LazyThreadSafetyMode.SYNCHRONIZED, restoring the guarantee of the Java implementation. The lock is only taken until the value is initialized. After that, reads are a single volatile read, so therunOnUiThreadhot path is effectively unchanged.Changelog:
[ANDROID] [FIXED] - Fix crash in
UiThreadUtilwhen the main handler is first accessed from multiple threads at onceTest Plan:
The race only happens on the first access in a process and cannot be reproduced reliably in a unit test. It can be confirmed by:
UnsafeLazyImpl(NONE) is documented as unsafe for multi-threaded access.SynchronizedLazyImpl(SYNCHRONIZED) guarantees a single initialization and safe publication.UiThreadUtil.<clinit>creates the lazy withLazyThreadSafetyMode.NONE. With this change it usesSYNCHRONIZED.