Skip to content

[iOS] Prebuilt React-Core Release artifacts are built with NSAssertions enabled — RCTAssert failures become fatal NSRangeException crashes in production #57454

Description

@gimi-anders

Description

The prebuilt React Native Core Release artifacts published to Maven Central are built without NS_BLOCK_ASSERTIONS, so every RCTAssert in the framework is compiled in and live in production apps. When React Native is built from source, the standard Release configuration (ENABLE_NS_ASSERTIONS = NO) strips these asserts, so they are no-ops in production.

This has two consequences:

  1. Assert conditions that are benign in a source Release build become fatal in a prebuilt Release build. Example: in RCTViewComponentView unmountChildComponentView:index:, the index parameter is used only inside RCTAssert. With asserts stripped, a stale/mismatched index is harmless — the method just calls removeFromSuperview on the correct child. With asserts live, the same situation crashes the app.

  2. The crash is worse than an assertion failure. The assert at RCTViewComponentView.mm (v0.85.3, L154–L177) eagerly evaluates its message arguments, including [[self.currentContainerView.subviews objectAtIndex:index] tag]. When the assert condition fails because index is out of bounds, formatting the message itself throws NSRangeException — the app dies while trying to report the assert.

We hit this in production: the first release of our app on prebuilt React Native Core (RN 0.85.3) started crashing with NSRangeException in unmountChildComponentView:index: on a screen that structurally remounts children of a legacy interop view (react-native-linear-gradient 2.8.3) inside an animation loop. Our previous release (RN 0.83.9, built from source) had zero crashes on the identical screen code. iOS only, observed on iOS 18 and iOS 26.

Steps to reproduce

No app is needed — the defect is verifiable directly on the published artifacts:

# RN 0.85.3 release artifact
curl -sL https://repo1.maven.org/maven2/com/facebook/react/react-native-artifacts/0.85.3/react-native-artifacts-0.85.3-reactnative-core-release.tar.gz | tar -xz
strings React.xcframework/ios-arm64/React.framework/React | grep "Attempt to unmount"

Output (these strings only exist in the binary if the RCTAssert call sites were compiled in):

Attempt to unmount a view which is mounted inside different view. (parent: %@, child: %@, index: %@)
Attempt to unmount a view which has a different index. (parent: %@, child: %@, index: %@, actual index: %@, tag at index: %@)

The same check on the 0.86.0 release artifact (react-native-artifacts-0.86.0-reactnative-core-release.tar.gz) shows the same result, so the current stable is equally affected.

For comparison, a source-built Release archive of the same RN version does not contain these strings (asserts stripped by ENABLE_NS_ASSERTIONS = NO).

Production stack trace

NSRangeException: *** -[__NSSingleObjectArrayI objectAtIndex:]: index 1 beyond bounds [0 .. 0]
  CoreFoundation   __exceptionPreprocess
  libobjc.A        objc_exception_throw
  CoreFoundation   -[__NSSingleObjectArrayI objectAtIndex:]
  React            -[RCTViewComponentView unmountChildComponentView:index:]
  React            -[RCTMountingManager performTransaction:] (block)
  React            facebook::react::TelemetryController::pullTransaction
  React            -[RCTMountingManager performTransaction:]
  React            -[RCTMountingManager initiateTransaction:]
  libdispatch      _dispatch_main_queue_drain
  ...

Additional observation

Reproducing the same UI flow on a source-built Debug binary (where assertions are also enabled) does not trip the assert, while the prebuilt binary does. We have not isolated why, but it suggests the prebuilt binary may also differ behaviorally from a source build of the same version (build-time flags?). The primary, easily verifiable defect remains the assertions in the Release artifact.

Workaround

RCT_USE_PREBUILT_RNCORE=0 (build React Native Core from source). Verified: the crash disappears and Release builds strip the asserts as before.

Suggested fix

  1. Build the -release prebuilt artifacts with ENABLE_NS_ASSERTIONS = NO / NS_BLOCK_ASSERTIONS defined, matching what a source Release build produces.
  2. Independently: make the assert message at RCTViewComponentView.mm bounds-safe (it currently indexes out of bounds while formatting the message for the exact condition it is asserting against).

React Native Version

0.85.3 (artifact defect also verified on 0.86.0)

Affected Platforms

Runtime: iOS. New Architecture (Fabric).

Output of npx react-native info

System:
  OS: macOS 26.5.1
  CPU: (12) arm64 Apple M2 Pro
Binaries:
  Node: 24.14.0
  Yarn: 4.16.0
  npm: 11.9.0
  Watchman: 2025.06.30.00
SDKs:
  iOS SDK: 26.5
Xcode: 26.6/17F113
Ruby: 3.3.10
react-native: 0.85.3
Hermes: enabled
New Architecture: enabled

Reproducer

Not applicable — the defect is in the published build artifacts themselves; the shell commands under "Steps to reproduce" demonstrate it without an app.

Activity

  1. react-native-bot commented on Jul 7, 2026

    @react-native-bot
    Collaborator

    Warning

    Missing reproducer: We could not detect a reproducible example in your issue report. Reproducers are mandatory and we can accept only one of those as a valid reproducer:


    You can read more about about it on our website: How to report a bug.

  2. gimi-anders commented on Jul 7, 2026

    @gimi-anders
    ContributorAuthor

    Warning

    Missing reproducer: We could not detect a reproducible example in your issue report. Reproducers are mandatory and we can accept only one of those as a valid reproducer:

    You can read more about about it on our website: How to report a bug.

    Not applicable — the defect is in the published build artifacts themselves; the shell commands under "Steps to reproduce" demonstrate it without an app.

  3. dongdongbh commented on Aug 8, 2026

    @dongdongbh
    Contributor

    Independent hit on this, with a trigger that has nothing to do with legacy interop — which may help with the Needs: Repro label.

    RN 0.81.5 via Expo SDK 54, new architecture, App Store builds. Five crash reports across two app versions, three device models (iPhone 13 / 15 Pro / 17), iOS 26.5.2 and 26.6. Symbolicated against react-native-artifacts-0.81.5-reactnative-core-dSYM-release, every one lands on the same line — the message argument, never the guarded condition:

    *** -[__NSArrayM objectAtIndex:]: index 13 beyond bounds [0 .. 8]
      -[RCTViewComponentView unmountChildComponentView:index:]  (RCTViewComponentView.mm:163)
      RCTPerformMountInstructions(...)                          (RCTMountingManager.mm:97)
      -[RCTMountingManager performTransaction:]                 (RCTMountingManager.mm:258)
      -[RCTMountingManager initiateTransaction:]                (RCTMountingManager.mm:247)
    

    Three additions to what you already have:

    The artifact defect goes back further than 0.85. Same check you documented, on 0.81.5:

    $ strings React.xcframework/ios-arm64/React.framework/React | grep "Attempt to unmount"
    Attempt to unmount a view which is mounted inside different view. (parent: %@, child: %@, index: %@)
    Attempt to unmount a view which has a different index. (parent: %@, child: %@, index: %@, actual index: %@, tag at index: %@)
    

    No animation loop and no interop layer here. Plain Fabric views under react-navigation + react-native-screens, removeClippedSubviews explicitly false everywhere, no Reanimated layout animations. Four of the five fire from an ordinary initiateTransaction: on the main queue. The fifth is a pure teardown path with no user interaction at all — -[UIApplication _terminateWithStatus:] → -[RCTSurfacePresenter suspend] → _stopAllSurfacesWithScheduler: → -[RCTFabricSurface stop] → ShadowTree::commitEmptyTree(), i.e. unmount-everything at app exit. Whatever produces the index mismatch, it is reachable without any third-party view manager in the path.

    Symbolication note for anyone else landing here: the dSYM is published alongside the artifact as react-native-artifacts-<version>-reactnative-core-dSYM-release.tar.gz, and its __TEXT VMA base is 0 — feed llvm-symbolizer the raw crash offset, not 0x100000000 + offset, or every frame comes back ??.

    Opened #57865 for suggestion 2 (bounds-safe message). Suggestion 1 is the one that actually matters for apps on prebuilt artifacts, since it takes the whole assert out of production — but the message bug is worth closing regardless, because it turns any failed assert on this path into a crash rather than a log line even in debug.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Needs: AttentionIssues where the author has responded to feedback.Needs: ReproThis issue could be improved with a clear list of steps to reproduce the issue.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions