fix(turbomodule): never let instrumentation break user TurboModule calls

Addresses the unresolved Warden finding on #6227.

Previously, the wrapper called `pushTurboModuleCall` *outside* its
`try` block. `pushTurboModuleCall` synchronously writes to the pinned
scope, and `scopeSync.ts`'s hooked `setContext` calls into
`NATIVE.setContext`, which throws `_NativeClientError` when the
RNSentry module isn't loaded (and any other native bridge error along
that path). A throw there would abort the wrapper before
`originalFn.apply` was reached \u2014 silently dropping the user's real
TurboModule call (including critical ones like `captureEnvelope`) and
surfacing an unexpected error to the caller. It also left the just-
pushed frame on the tracker stack with no matching pop, leaking the
`turbo_module` context.

Two-layer fix:

- `pushTurboModuleCall` is now atomic. If `syncToScope` throws, the
  stack push is rolled back so the tracker stack stays consistent.

- The wrapper isolates every tracker interaction (push, pop, relabel)
  in its own try/catch with a `logger.warn` on failure. The user's
  call is always executed and its result/exception is always returned
  to the caller. The worst case is loss of the `turbo_module`
  attribution for that call \u2014 never a broken user invocation.

Tests added: atomic-push rollback on `syncToScope` throw; wrapper still
calls the original method (and returns its result) when push or pop
throws.

Author: alwx

packages/core/src/js/turbomodule/turboModuleTracker.ts

@@ -99,8 +99,16 @@ export function pushTurboModuleCall(args: {
     scope: args.scope ?? getCurrentScope(),
   };
 
+  // Atomic push: if `syncToScope` throws (e.g. a scope-sync hook calls into a
+  // native bridge that rejects with `_NativeClientError`), roll back the stack
+  // push so we don't leak a frame.
   stack.push(call);
-  syncToScope(call);
+  try {
+    syncToScope(call);
+  } catch (e) {
+    stack.pop();
+    throw e;
+  }
   return call.callId;
 }
 

packages/core/src/js/turbomodule/wrapTurboModule.ts

@@ -74,32 +74,42 @@ export function wrapTurboModule<T extends object>(
     const originalFn = original as (...a: unknown[]) => unknown;
 
     const wrapper = function sentryTurboModuleWrapper(this: unknown, ...args: unknown[]): unknown {
+      // The instrumentation must never break the user's call — every tracker
+      // interaction is isolated so a failure inside Sentry only drops the
+      // attribution data, never the real TurboModule invocation.
+      //
       // We don't know yet whether `original` is sync or async — start optimistic
       // as sync, relabel to 'async' if the result turns out to be thenable.
-      const callId = pushTurboModuleCall({ name, method: key, kind: 'sync' });
+      let callId: number | undefined;
+      try {
+        callId = pushTurboModuleCall({ name, method: key, kind: 'sync' });
+      } catch (e) {
+        logger.warn(`[TurboModuleTracker] push failed for ${name}.${key}: ${String(e)}`);
+      }
+
       let result: unknown;
       try {
         result = originalFn.apply(this, args);
       } catch (e) {
-        popTurboModuleCall(callId);
+        safePop(callId, name, key);
         throw e;
       }
 
       if (isThenable(result)) {
-        relabelTurboModuleCallKind(callId, 'async');
+        safeRelabel(callId, 'async', name, key);
         return (result as Promise<unknown>).then(
           value => {
-            popTurboModuleCall(callId);
+            safePop(callId, name, key);
             return value;
           },
           err => {
-            popTurboModuleCall(callId);
+            safePop(callId, name, key);
             throw err;
           },
         );
       }
 
-      popTurboModuleCall(callId);
+      safePop(callId, name, key);
       return result;
     };
 
@@ -153,6 +163,28 @@ function collectMethodNames(module: object): string[] {
   return Array.from(seen);
 }
 
+function safePop(callId: number | undefined, name: string, method: string): void {
+  if (callId === undefined) {
+    return;
+  }
+  try {
+    popTurboModuleCall(callId);
+  } catch (e) {
+    logger.warn(`[TurboModuleTracker] pop failed for ${name}.${method}: ${String(e)}`);
+  }
+}
+
+function safeRelabel(callId: number | undefined, kind: 'sync' | 'async', name: string, method: string): void {
+  if (callId === undefined) {
+    return;
+  }
+  try {
+    relabelTurboModuleCallKind(callId, kind);
+  } catch (e) {
+    logger.warn(`[TurboModuleTracker] relabel failed for ${name}.${method}: ${String(e)}`);
+  }
+}
+
 function isThenable(value: unknown): value is PromiseLike<unknown> {
   if (!value || (typeof value !== 'object' && typeof value !== 'function')) {
     return false;

packages/core/test/turbomodule/turboModuleTracker.test.ts

@@ -219,6 +219,20 @@ describe('turboModuleTracker', () => {
     expect(relabelTurboModuleCallKind(9999, 'async')).toBe(false);
   });
 
+  it('rolls back the stack push if syncToScope throws (atomic push)', () => {
+    const failingScope = new Scope();
+    jest.spyOn(failingScope, 'setContext').mockImplementation(() => {
+      throw new Error('native bridge boom');
+    });
+
+    const before = getTurboModuleCallStack().length;
+    expect(() =>
+      pushTurboModuleCall({ name: 'X', method: 'y', kind: 'sync', scope: failingScope }),
+    ).toThrow('native bridge boom');
+    // Stack is unchanged — the failed push didn't leak a frame.
+    expect(getTurboModuleCallStack().length).toBe(before);
+  });
+
   it('assigns monotonically increasing call ids', () => {
     const a = pushTurboModuleCall({ name: 'M', method: 'a', kind: 'sync', scope });
     const b = pushTurboModuleCall({ name: 'M', method: 'b', kind: 'sync', scope });

packages/core/test/turbomodule/wrapTurboModule.test.ts

@@ -214,6 +214,53 @@ describe('wrapTurboModule', () => {
     );
   });
 
+  it('still calls the original method when the tracker push throws (native bridge error)', () => {
+    const warnSpy = jest.spyOn(require('@sentry/core').logger, 'warn').mockImplementation(() => undefined);
+    // Simulate a scope-sync hook that calls into a native bridge which throws.
+    jest.spyOn(scope, 'setContext').mockImplementation(() => {
+      throw new Error('NATIVE.setContext boom');
+    });
+
+    const originalFn = jest.fn(() => 'real-result');
+    const module = { doStuff: originalFn };
+
+    wrapTurboModule('Mod', module);
+
+    // The user's call must still complete with the original return value
+    // — Sentry's instrumentation can never break the wrapped TurboModule.
+    const result = module.doStuff();
+
+    expect(result).toBe('real-result');
+    expect(originalFn).toHaveBeenCalledTimes(1);
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('push failed for Mod.doStuff'));
+    // And the failed push left no leaked frame on the tracker.
+    expect(getTurboModuleCallStack()).toEqual([]);
+  });
+
+  it('still calls the original method when the tracker pop throws', () => {
+    const warnSpy = jest.spyOn(require('@sentry/core').logger, 'warn').mockImplementation(() => undefined);
+
+    const originalFn = jest.fn(() => 42);
+    const module = { doStuff: originalFn };
+
+    wrapTurboModule('Mod', module);
+
+    // Make `setContext` throw only on the pop's restore/clear path. We do this
+    // by letting push succeed, then breaking setContext before the pop fires.
+    let setContextCalls = 0;
+    jest.spyOn(scope, 'setContext').mockImplementation(() => {
+      setContextCalls++;
+      if (setContextCalls > 1) {
+        throw new Error('clear boom');
+      }
+      return scope;
+    });
+
+    expect(() => module.doStuff()).not.toThrow();
+    expect(originalFn).toHaveBeenCalled();
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('pop failed for Mod.doStuff'));
+  });
+
   it('does not leak a tracker frame when the result has a throwing `then` getter', () => {
     const trap = Object.defineProperty({}, 'then', {
       get() {