fix(ios): make the unmountChildComponentView assert message bounds-safe (#57865)

Summary:
`-[RCTViewComponentView unmountChildComponentView:index:]` bounds-checks the `RCTAssert` *condition*, but the failure message it formats afterwards calls `-objectAtIndex:` on the same out-of-range `index`:

```objc
RCTAssert(
    (self.currentContainerView.subviews.count > index) &&              // guarded
        [self.currentContainerView.subviews objectAtIndex:index] == childComponentView,
    @"... tag at index: %@)", ...,
    @([[self.currentContainerView.subviews objectAtIndex:index] tag]));  // not guarded
```

So the exact situation the assert exists to report — a shadow-tree/native child-index mismatch — raises `NSRangeException` *while being reported*, instead of being reported.

That is normally invisible, because a source Release build strips `RCTAssert` and the mismatch is harmless: `index` is used only inside the asserts, and the real work, `[childComponentView removeFromSuperview]`, never needed it. But the prebuilt `React.framework` published to Maven Central is built with assertions enabled (#57454), so this is live in App Store builds — we hit it on RN 0.81.5 via Expo SDK 54, symbolicated against the published `reactnative-core-dSYM-release` artifact:

```
NSRangeException: *** -[__NSArrayM objectAtIndex:]: index 13 beyond bounds [0 .. 8]
  -[RCTViewComponentView unmountChildComponentView:index:]  (RCTViewComponentView.mm:163)
  RCTPerformMountInstructions(...)                          (RCTMountingManager.mm:97)
  -[RCTMountingManager performTransaction:]                 (RCTMountingManager.mm:258)
  -[RCTMountingManager initiateTransaction:]                (RCTMountingManager.mm:247)
```

This is the second of the two fixes suggested in #57454 and stands on its own for any build with assertions enabled.

The change also reads `self.currentContainerView` once instead of four times. That getter is not a plain accessor — it creates or tears down `_containerView` and reparents subviews — so re-invoking it inside an assert's arguments is worth avoiding regardless.

The hoisted locals and the assert sit inside `#ifndef NS_BLOCK_ASSERTIONS`, matching the existing guard at `RCTViewComponentView.mm:335`. Without it the locals are unused once assertions are compiled out, which is a `-Werror,-Wunused-variable` build failure, and the hoist would otherwise make that side-effecting getter run on every unmount in a Release build where it previously did not run at all. With the guard it is read once per unmount in Debug and not at all in Release.

## Changelog:

[IOS] [FIXED] - Report a `RCTViewComponentView` child-index mismatch instead of raising `NSRangeException` while formatting the assert message

Pull Request resolved: #57865

Test Plan:
I don't have a macOS build environment, so I have not compiled this — flagging that plainly. What backs the change:

- Five App Store crash reports (RN 0.81.5, iOS 26.5.2 / 26.6, three device models) all symbolicate to the message argument on this line, never to the guarded condition.
- `strings` on `react-native-artifacts-0.81.5-reactnative-core-release.tar.gz` shows both `Attempt to unmount…` format strings present, confirming the call sites are compiled into the release artifact — same check #57454 reports for 0.85.3 and 0.86.0, so the artifact defect reaches at least as far back as 0.81.
- Behaviour is unchanged whenever the assert passes; when it fails, the message now prints `out of bounds` in place of a tag that cannot be read.

Happy to rework this if you would rather the assert drop the `tag at index` field entirely, or if fixing the artifact build flags is considered sufficient on its own.

## Added on import: build, tests, and answers to the open questions

Compiled and tested, which the author could not do.

```
buck2 test fbsource//xplat/js/react-native-github:MountingTestsApple
→ Pass 19. Fail 0.
```

Adds `React/Tests/Mounting/RCTViewComponentViewUnmountTests.mm`, picked up by the existing `MountingTestsApple` glob. Restoring the pre-fix `RCTViewComponentView.mm` and re-running fails exactly the out-of-bounds case:

```
✗ RCTViewComponentViewUnmountTests/testUnmountWithOutOfBoundsIndexReportsRatherThanRaisingRangeException
Tests finished: Pass 18. Fail 1.
```

The second case, `testUnmountWithInBoundsMismatchStillReportsTagAtIndex`, passes against both old and new code on purpose: it pins that the in-bounds mismatch path still reports the real tag rather than the new `out of bounds` placeholder.

### Why the test is shaped the way it is

Two non-obvious constraints, both of which broke a more natural first attempt:

1. `RCT_NSASSERT` is defined as `RCT_DEBUG`, so in a debug build a failing `RCTAssert` calls the custom handler **and then** raises through `NSAssertionHandler`. Every failing assert throws, fixed or not, so `XCTAssertNoThrow` cannot be the assertion. The discriminator is that pre-fix the message arguments raise `NSRangeException` at the call site *before* `_RCTAssertFormat` runs, so the handler never fires at all. The test asserts the handler ran and that whatever escaped was not `NSRangeException`.
2. `RCTPerformBlockWithAssertFunction` calls `block()` between pushing and popping its handler with no `try`/`finally`, so an exception escaping the block leaks the handler into every later test in the process. The raise is therefore caught inside the block.

### Other checks

- `index` is `NSInteger` (`RCTComponentViewProtocol.h:64`), so the added `index >= 0` is meaningful rather than tautological. The previous `count > index` relied on a negative index promoting to a large `NSUInteger` and failing the unsigned comparison, which was correct by accident.
- The `NSNumber *` / `NSString *` ternary in the message compiles without warning.
- `arc lint -e extra` on the new test reports only a `NULLSAFECLANG` infrastructure failure that self-identifies as "not a code issue". The 55 pre-existing CLANGTIDY warnings in `RCTViewComponentView.mm` are untouched and are not attributed to this diff.

### NOTE: on the author's two questions

**Is fixing the artifact build flags sufficient on its own?** No. #57454 is the right root-cause fix and should still happen, but this change is worth having independently: the assert is broken *as an assert*. In any build where assertions are compiled in, including local Debug, the assert that exists to report an index mismatch raises while reporting it, so the diagnostic is unavailable exactly when it is needed. Fixing the artifact flags would hide that from production without repairing it.

**Should the `tag at index` field be dropped instead?** Recommend keeping it. It is the field that tells you which view actually occupies the slot, which is the useful part of the diagnostic, and the second test above locks in that it still appears when the index is in bounds.

### Release-build guard (added after the first sanity-check failure)

The first import version failed the sanity check with:

```
error: unused variable 'isIndexInBounds' [-Werror,-Wunused-variable]
```

`NS_BLOCK_ASSERTIONS` makes `RCTAssert` expand to `do {} while(false)`, so with assertions compiled out the hoisted locals have no remaining use. The hoisted lines and the assert are now wrapped in `#ifndef NS_BLOCK_ASSERTIONS`, which is the idiom this same file already uses at `RCTViewComponentView.mm:335` for a local pulled out of an assert.

That also restores a property the hoist had quietly removed. Before this diff the four `self.currentContainerView` reads sat inside the macro arguments and disappeared entirely in a Release build. Hoisting them out made the getter run on every unmount in Release, and that getter is not a plain accessor: it can allocate `_containerView`, reparent every subview into it and move `clipsToBounds` and `layer.mask`, or in the other branch tear the container down and nil it. With the guard the getter is read once per unmount in Debug and not at all in Release, which is better than both the original and the unguarded version.

Verified locally by defining `NS_BLOCK_ASSERTIONS` at the top of the file to simulate a Release build, against `RCTFabricComponentViewsBaseApple`, which is the target that owns this file:

| State | Result |
|---|---|
| Unguarded, assertions off | `error: unused variable 'isIndexInBounds'`, BUILD FAILED |
| Guarded, assertions off | exit 0 |
| Guarded, assertions on (debug) | Pass 19. Fail 0. |

Reviewed By: christophpurrer

Differential Revision: D115424016

Pulled By: fabriziocucci

fbshipit-source-id: b825f145c1867a230c0c6cd12a41950a83468ed2

Author: dongdongbh

packages/react-native/React/Fabric/Mounting/ComponentViews/View/RCTViewComponentView.mm

@@ -255,15 +255,18 @@ - (void)unmountChildComponentView:(UIView<RCTComponentViewProtocol> *)childCompo
         childComponentView,
         @(index),
         @([childComponentView.superview tag]));
+#ifndef NS_BLOCK_ASSERTIONS
+    NSArray<UIView *> *containerSubviews = self.currentContainerView.subviews;
+    BOOL isIndexInBounds = index >= 0 && (NSUInteger)index < containerSubviews.count;
     RCTAssert(
-        (self.currentContainerView.subviews.count > index) &&
-            [self.currentContainerView.subviews objectAtIndex:index] == childComponentView,
+        isIndexInBounds && [containerSubviews objectAtIndex:index] == childComponentView,
         @"Attempt to unmount a view which has a different index. (parent: %@, child: %@, index: %@, actual index: %@, tag at index: %@)",
         self,
         childComponentView,
         @(index),
-        @([self.currentContainerView.subviews indexOfObject:childComponentView]),
-        @([[self.currentContainerView.subviews objectAtIndex:index] tag]));
+        @([containerSubviews indexOfObject:childComponentView]),
+        isIndexInBounds ? @([[containerSubviews objectAtIndex:index] tag]) : @"out of bounds");
+#endif
   }
 
   [childComponentView removeFromSuperview];

packages/react-native/React/Tests/Mounting/RCTViewComponentViewUnmountTests.mm

@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+#import <React/RCTAssert.h>
+#import <React/RCTViewComponentView.h>
+#import <XCTest/XCTest.h>
+
+@interface RCTViewComponentViewUnmountTests : XCTestCase
+@end
+
+@implementation RCTViewComponentViewUnmountTests
+
+// RCTPerformBlockWithAssertFunction pops its handler after calling the block,
+// without @finally, so an exception escaping the block would leave the handler
+// installed for every later test in this process. RCT_NSASSERT is on in debug,
+// which means a failing assert always raises once it has been reported, so the
+// raise has to be caught inside the block rather than around the call.
+static NSString *RCTUnmountAndReportAssert(
+    RCTViewComponentView *parent,
+    UIView<RCTComponentViewProtocol> *child,
+    NSInteger index,
+    NSString **outMessage)
+{
+  __block NSString *thrownName = nil;
+  __block NSString *message = nil;
+
+  RCTPerformBlockWithAssertFunction(
+      ^{
+        @try {
+          [parent unmountChildComponentView:child index:index];
+        } @catch (NSException *exception) {
+          thrownName = exception.name;
+        }
+      },
+      ^(NSString *condition, NSString *fileName, NSNumber *lineNumber, NSString *function, NSString *assertMessage) {
+        message = assertMessage;
+      });
+
+  *outMessage = message;
+  return thrownName;
+}
+
+// The index is read only inside RCTAssert here, so a mismatch is harmless once
+// assertions are compiled out. While they are compiled in, the arguments that
+// build the failure message are evaluated at the call site, and an out-of-range
+// index used to reach objectAtIndex: there. The assert that exists to report the
+// mismatch raised NSRangeException instead of reporting it.
+- (void)testUnmountWithOutOfBoundsIndexReportsRatherThanRaisingRangeException
+{
+  RCTViewComponentView *parent = [[RCTViewComponentView alloc] initWithFrame:CGRectZero];
+  RCTViewComponentView *child = [[RCTViewComponentView alloc] initWithFrame:CGRectZero];
+  [parent mountChildComponentView:child index:0];
+
+  NSString *message = nil;
+  // Only one child is mounted, so index 1 is past the end.
+  NSString *thrownName = RCTUnmountAndReportAssert(parent, child, 1, &message);
+
+  XCTAssertNotNil(message, @"the assert must report the mismatch");
+  XCTAssertTrue([message containsString:@"different index"]);
+  XCTAssertNotEqualObjects(thrownName, NSRangeException, @"reporting must not raise out of bounds");
+}
+
+// The in-bounds mismatch path must keep reporting the tag at that index rather
+// than the out-of-range placeholder.
+- (void)testUnmountWithInBoundsMismatchStillReportsTagAtIndex
+{
+  RCTViewComponentView *parent = [[RCTViewComponentView alloc] initWithFrame:CGRectZero];
+  RCTViewComponentView *first = [[RCTViewComponentView alloc] initWithFrame:CGRectZero];
+  RCTViewComponentView *second = [[RCTViewComponentView alloc] initWithFrame:CGRectZero];
+  [parent mountChildComponentView:first index:0];
+  [parent mountChildComponentView:second index:1];
+
+  NSString *message = nil;
+  // `second` is really at index 1, so index 0 is in bounds but wrong.
+  NSString *thrownName = RCTUnmountAndReportAssert(parent, second, 0, &message);
+
+  XCTAssertNotNil(message);
+  XCTAssertFalse([message containsString:@"out of bounds"]);
+  XCTAssertNotEqualObjects(thrownName, NSRangeException);
+}
+
+@end