From acbbe68455b53704feff32e7bf18c580354db2fa Mon Sep 17 00:00:00 2001 From: Gang Zhao Date: Fri, 16 Oct 2026 11:23:46 -0700 Subject: [PATCH] Fix: JSI Value::toString() should check the result type Summary: `global.String` could be overridden. We always need to check the return type before casting to `jsi::String`. Changelog: [Internal] Differential Revision: D125707029 --- packages/react-native/ReactCommon/jsi/jsi/jsi.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/react-native/ReactCommon/jsi/jsi/jsi.cpp b/packages/react-native/ReactCommon/jsi/jsi/jsi.cpp index d09cc485cdea..d3e83214d87a 100644 --- a/packages/react-native/ReactCommon/jsi/jsi/jsi.cpp +++ b/packages/react-native/ReactCommon/jsi/jsi/jsi.cpp @@ -923,7 +923,8 @@ String Value::asString(IRuntime& rt) && { String Value::toString(IRuntime& runtime) const { Function toString = runtime.global().getPropertyAsFunction(runtime, "String"); - return toString.call(runtime, *this).getString(runtime); + Value result = toString.call(runtime, *this); + return result.asString(runtime); } uint64_t BigInt::asUint64(IRuntime& runtime) const {