Don't keep paragraph content with attachments across clones

Attachments hold raw pointers to the children the content was built
from, and layout() replaces those children with laid-out clones. A clone
that kept that content pointed at nodes only the previous revision still
owned, and once that revision was released, layout() read freed memory
and crashed in ParagraphShadowNode::layout. Only keep content that has no
attachments.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: tomekzaw

packages/react-native/ReactCommon/react/renderer/components/text/ParagraphShadowNode.cpp

@@ -64,11 +64,17 @@ ParagraphShadowNode::ParagraphShadowNode(
   // attributed string and the layouts measured for it instead of rebuilding
   // and re-measuring them. `getContent` drops both if the layout context they
   // were built for no longer matches.
+  //
+  // Content with attachments is not kept: they point at the children the
+  // content was built from, and `layout` replaces those children with laid-out
+  // clones, so in a later revision the pointers would outlive the nodes.
   if (fragment.props == nullptr && fragment.children == nullptr) {
     const auto& source =
         static_cast<const ParagraphShadowNode&>(sourceShadowNode);
-    content_ = source.content_;
-    measuredLayouts_ = source.measuredLayouts_;
+    if (source.content_.has_value() && source.content_->attachments.empty()) {
+      content_ = source.content_;
+      measuredLayouts_ = source.measuredLayouts_;
+    }
   }
 }