[0.81] Fix use-after-free data race in EventEmitter.cpp (fatal heap-corruption crashes on Android 16 — Expo SDK 54 line)

Start with EventEmitter.cpp on the 0.81-stable branch and compare it with commit 5dea3b5e6c01743a331105a031ab33e016e64b3a and the 0.86-stable backport. Resolve the drifted hunks, then build a 0.81 release candidate and verify it on affected Android 16 devices, especially Samsung models. Done means the adapted fix is accepted for 0.81-stable and the relevant crash no longer reproduces.

Target Branch

0.81

Link to commit or PR to be picked

https://github.com/facebook/react-native/commit/5dea3b5e6c01743a331105a031ab33e016e64b3a

Description

Follow-up to #1369, where this commit ("Events: Fix use-after-free data race in EventEmitter.cpp", released in 0.87.0) was accepted and cherry-picked onto 0.86-stable as fdb26edfe790. We're requesting the same fix for 0.81-stable.

Why 0.81 despite being outside the support window:

• 0.81 is the React Native version pinned by Expo SDK 54, which carries a very large active install base — the 0.81 branch has received post-window patches before (0.81.5 in Jan 2026, 0.81.6 in Feb 2026), we believe for this reason.
• The bug this fixes is production-fatal at fleet scale on Android 16: a use-after-free race in Fabric event dispatch that corrupts the native heap and silently kills apps mid-interaction (Scudo invalid chunk state abort in EventQueue::flushEvents, or SIGSEGV constructing the payload jsi::Value in UIManagerBinding::dispatchEventToJS). Full symbolicated production stacks are in #1369; an independent report is facebook/react-native#57963.
• Frequency grows with the Android 16 / One UI 8 rollout — in our fleet, ~80% of Android users with device telemetry are already on Android 16, and some users crash every session with no possible workaround. For teams on Expo SDK 54, the only alternatives today are a full SDK migration or building react-android from source with a hand-applied patch.

Note on the pick: the commit does not apply cleanly to 0.81-stable (EventEmitter.cpp has drifted — the file is ~163 lines there vs ~180 on main; both hunks fail). The adaptation is small and mechanical (same ~20-line change: copy eventTarget_ / shadowNodeFamily_ under DispatchMutex() before dispatching). We're happy to open the conflict-resolved backport PR against 0.81-stable ourselves if the crew is open to accepting this pick — please say the word.

We can also verify a 0.81 RC on affected Samsung/Android 16 devices (we have several affected users' exact device models represented in our fleet).