Fix use-after-free race in RCTInstance callFunctionOnJSModule (#58816)

Summary:
Pull Request resolved: #58816

## Changelog:

[Internal]

Reviewed By: zeyap

Differential Revision: D122831570

fbshipit-source-id: 924ffa228cadc454069b268a0fd1c1126953ba33

Author: generatedunixname1608173377072046

packages/react-native/ReactCommon/react/runtime/platform/ios/ReactCommon/RCTInstance.mm

@@ -171,10 +171,14 @@ - (void)dealloc
 
 - (void)callFunctionOnJSModule:(NSString *)moduleName method:(NSString *)method args:(NSArray *)args
 {
-  if (_valid) {
-    _reactInstance->callFunctionOnModule(
-        [moduleName UTF8String], [method UTF8String], convertIdToFollyDynamic(args ? args : @[]));
+  // This is called from arbitrary threads, while -invalidate destroys _reactInstance on
+  // the JS thread, so checking _valid and dereferencing have to happen as one step.
+  std::lock_guard<std::mutex> lock(_invalidationMutex);
+  if (!_valid || !_reactInstance) {
+    return;
   }
+  _reactInstance->callFunctionOnModule(
+      [moduleName UTF8String] ?: "", [method UTF8String] ?: "", convertIdToFollyDynamic(args ? args : @[]));
 }
 
 - (void)invalidate