MessageQueue resolves inherited Object properties as callable modules

Description

The legacy bridge stores lazy callable-module initializers in an ordinary object and reads it by arbitrary module name. Unregistered names such as constructor and __proto__ therefore resolve through Object.prototype; getCallableModule('constructor') invokes the inherited constructor and returns an object although no module was registered. Assigning __proto__ also changes the registry prototype instead of creating a normal module entry.

Expected behavior

Only explicitly registered callable modules should resolve, and every valid string name—including __proto__—should be registrable.

React Native Version

0.87.1 and current main

Affected Platforms

Runtime - All

legacy bridge の MessageQueue レジストリと getCallableModule エントリポイントから始めます。任意の名前がどのように検索され、割り当てられるかを確認し、未登録の名前が Object.prototype を通じて解決されないこと、また proto を含むすべての有効な文字列名を登録して取得できることを検証します。