From 34af43e085526219c4455e0a0804d66cca747a2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tomasz=20=C5=BBelawski?= <tzelawski@gmail.com>
Date: Wed, 6 Aug 2025 20:50:18 +0200
Subject: [PATCH] fix: crash when copying TurboModules between runtimes

---
 .../react/nativemodule/core/ReactCommon/TurboModule.h       | 6 +++++-
 .../nativemodule/core/ReactCommon/TurboModuleBinding.cpp    | 3 +++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/packages/react-native/ReactCommon/react/nativemodule/core/ReactCommon/TurboModule.h b/packages/react-native/ReactCommon/react/nativemodule/core/ReactCommon/TurboModule.h
index fc622dfb5265..4a7073b40f87 100644
--- a/packages/react-native/ReactCommon/react/nativemodule/core/ReactCommon/TurboModule.h
+++ b/packages/react-native/ReactCommon/react/nativemodule/core/ReactCommon/TurboModule.h
@@ -7,6 +7,7 @@
 
 #pragma once
 
+#include <cstdint>
 #include <memory>
 #include <string>
 #include <unordered_map>
@@ -58,7 +59,7 @@ class JSI_EXPORT TurboModule : public jsi::HostObject {
     // If we have a JS wrapper, cache the result of this lookup
     // We don't cache misses, to allow for methodMap_ to dynamically be
     // extended
-    if (jsRepresentation_ && !prop.isUndefined()) {
+    if (jsRepresentation_ && reinterpret_cast<std::uintptr_t>(&runtime) == representationRuntimeAddress_ && !prop.isUndefined()) {
       jsRepresentation_->lock(runtime).asObject(runtime).setProperty(runtime, propName, prop);
     }
     return prop;
@@ -138,6 +139,9 @@ class JSI_EXPORT TurboModule : public jsi::HostObject {
  private:
   friend class TurboModuleBinding;
   std::unique_ptr<jsi::WeakObject> jsRepresentation_;
+  /** This address is used only for identifying the runtime associated with the
+   * JS representation. Do not dereference or use for any other purpose. */
+  std::uintptr_t representationRuntimeAddress_;
 };
 
 /**
diff --git a/packages/react-native/ReactCommon/react/nativemodule/core/ReactCommon/TurboModuleBinding.cpp b/packages/react-native/ReactCommon/react/nativemodule/core/ReactCommon/TurboModuleBinding.cpp
index 195811f9876c..dd92074afbcc 100644
--- a/packages/react-native/ReactCommon/react/nativemodule/core/ReactCommon/TurboModuleBinding.cpp
+++ b/packages/react-native/ReactCommon/react/nativemodule/core/ReactCommon/TurboModuleBinding.cpp
@@ -10,6 +10,7 @@
 #include <ReactCommon/TurboModuleWithJSIBindings.h>
 #include <cxxreact/TraceSection.h>
 #include <react/utils/jsi-utils.h>
+#include <cstdint>
 #include <stdexcept>
 #include <string>
 
@@ -177,6 +178,8 @@ jsi::Value TurboModuleBinding::getModule(
     jsi::Object jsRepresentation(runtime);
     weakJsRepresentation =
         std::make_unique<jsi::WeakObject>(runtime, jsRepresentation);
+    module->representationRuntimeAddress_ =
+        reinterpret_cast<std::uintptr_t>(&runtime);
 
     // Lazily populate the jsRepresentation, on property access.
     //