Pass a top-level JS null TurboModule arg to ObjC as nil, not NSNull

Summary:
Changelog: [iOS][Fixed] - Pass a top-level JS `null` TurboModule argument to Objective-C as `nil` instead of `NSNull` when `enableModuleArgumentNSNullConversionIOS` is enabled

When `enableModuleArgumentNSNullConversionIOS` is on, `convertJSIValueToObjCObject`
maps a JS `null` to `(id)kCFNull`. That is the intended behaviour for nulls *nested*
inside arrays and dictionaries, but a `null` in **argument position** must still reach
Objective-C as `nil` — `NSNull` is truthy and does not respond to the selectors the
receiver expects, so leaking it crashes the callee.

The guard that enforced this lived three branches deep in
`ObjCTurboModule::setInvocationArg`, reachable only when all of the following held:

- `objCArgType == encode(id)`, and
- `getArgumentTypeName(...)` returned non-nil, and
- `RCTConvert` responded to a selector named after that type.

`getArgumentTypeName` resolves the argument type by scanning for `__rct_export__`-prefixed
selectors, which the compiler only emits for methods declared with `RCT_EXPORT_METHOD`.
Any TurboModule method without that macro — or with an `id`-typed argument, since
`[RCTConvert respondsToSelector:selector(id:)]` is `NO` — silently skipped the guard and
received `NSNull`.

This diff hoists the check to immediately after the conversion, so it applies to every
argument regardless of the method's `__rct_export__` metadata, its ObjC type encoding, or
whether an `RCTConvert` converter exists. Returning without calling `setArgument:` leaves
the `NSInvocation` slot zeroed, i.e. `nil` — identical to what the old guard did.

Behaviour is unchanged when the flag is off: the check short-circuits on the flag. Nested
`NSNull` inside arrays and dictionaries is untouched, as asserted by the existing
`testInvokeTurboModuleWithNull` case.

The pre-existing check inside the `RCTConvert` branch is left in place. It is now
effectively unreachable — `objCArg == kCFNull` is the only way `convertedObjCArg` can be
`kCFNull`, because every `RCTConvert` converter either returns a non-`kCFNull` input
unchanged or builds a new object — but it costs nothing and keeps the diff narrow.

Differential Revision: D117960577

Author: christophpurrer

packages/react-native/ReactCommon/react/nativemodule/core/iostests/RCTTurboModuleTests.mm

@@ -12,6 +12,7 @@
 #import <hermes/hermes.h>
 #import <jsi/decorator.h>
 #import <react/featureflags/ReactNativeFeatureFlags.h>
+#import <react/featureflags/ReactNativeFeatureFlagsDefaults.h>
 
 #import <memory>
 #import <vector>
@@ -22,6 +23,11 @@
 
 @interface RCTTestTurboModule : NSObject <RCTBridgeModule>
 
+// Deliberately not exported with RCT_EXPORT_METHOD: TurboModules dispatch through the codegen'd
+// `...SpecJSI`, so many of them carry no `__rct_export__` metadata and `getArgumentTypeName` returns
+// nil for their arguments.
+- (void)testMethodWhichTakesStringWithoutExportMacro:(NSString *)string;
+
 @end
 
 @implementation RCTTestTurboModule
@@ -30,8 +36,20 @@ @implementation RCTTestTurboModule
 
 RCT_EXPORT_METHOD(testMethodWhichTakesObject : (id)object) {}
 
+- (void)testMethodWhichTakesStringWithoutExportMacro:(NSString *)string
+{
+}
+
 @end
 
+class ReactNativeFeatureFlagsNSNullConversionEnabled : public ReactNativeFeatureFlagsDefaults {
+ public:
+  bool enableModuleArgumentNSNullConversionIOS() override
+  {
+    return true;
+  }
+};
+
 // Minimal concrete MutableBuffer that owns its bytes, used to observe lifetime.
 class TestMutableBuffer : public facebook::jsi::MutableBuffer {
  public:
@@ -122,6 +140,8 @@ - (void)tearDown
   module_ = nullptr;
   instance_ = nil;
 
+  ReactNativeFeatureFlags::dangerouslyReset();
+
   [super tearDown];
 }
 
@@ -159,6 +179,29 @@ - (void)testInvokeTurboModuleWithNull
   OCMVerify(OCMTimes(1), [instance_ testMethodWhichTakesObject:nil]);
 }
 
+// A JS `null` argument must arrive as `nil` even when the method carries no `__rct_export__`
+// metadata, so that nullability checks in the receiver behave. `NSNull` is truthy and does not
+// respond to most NSString/NSDictionary selectors, so leaking it crashes the callee.
+- (void)testInvokeUnexportedTurboModuleMethodWithNullPassesNil
+{
+  ReactNativeFeatureFlags::dangerouslyForceOverride(std::make_unique<ReactNativeFeatureFlagsNSNullConversionEnabled>());
+
+  auto hermesRuntime = facebook::hermes::makeHermesRuntime();
+  facebook::jsi::Runtime *rt = hermesRuntime.get();
+
+  facebook::jsi::Value args[1] = {facebook::jsi::Value::null()};
+  module_->invokeObjCMethod(
+      *rt,
+      VoidKind,
+      "testMethodWhichTakesStringWithoutExportMacro",
+      @selector(testMethodWhichTakesStringWithoutExportMacro:),
+      args,
+      1);
+
+  OCMVerify(OCMTimes(1), [instance_ testMethodWhichTakesStringWithoutExportMacro:nil]);
+  OCMVerify(OCMNever(), [instance_ testMethodWhichTakesStringWithoutExportMacro:(id)kCFNull]);
+}
+
 // A native-backed ArrayBuffer is aliased rather than copied, and the RCTArrayBuffer retains
 // the backing MutableBuffer, so the alias outlives the JS object.
 - (void)testNativeBackedArrayBufferIsAliasedAndKeepsBackingStoreAlive

packages/react-native/ReactCommon/react/nativemodule/core/platform/ios/ReactCommon/RCTTurboModule.mm

@@ -727,6 +727,16 @@ TraceSection s(
   BOOL enableModuleArgumentNSNullConversionIOS = ReactNativeFeatureFlags::enableModuleArgumentNSNullConversionIOS();
   id objCArg =
       convertJSIValueToObjCObject(runtime, arg, jsInvoker_, enableModuleArgumentNSNullConversionIOS, mustCopyBytes);
+
+  /**
+   * A JS `null` in argument position must reach ObjC as `nil`; only nulls *nested* inside arrays and
+   * dictionaries are preserved as `kCFNull`. Returning without calling `setArgument:` leaves the
+   * NSInvocation slot zeroed, i.e. `nil`.
+   */
+  if (enableModuleArgumentNSNullConversionIOS && objCArg == (id)kCFNull) {
+    return;
+  }
+
   if (objCArg != nullptr) {
     NSString *methodNameNSString = @(methodName);