iOS: roll back stuck pending updates before JS/Fabric starts, fix crash

Moves the rollback decision for a stuck (isLoading==YES) pending update from
-initializeUpdateAfterRestart (runs mid bundle-eval, after JS/Fabric already
exist) into +bundleURLForResource:..., the bridge's source-URL provider,
which runs before any JS or Fabric surface exists. This removes the
in-process reload that raced RN 0.86's Fabric surface teardown/recreate
internals and crashed CI intermittently on localPackage.install.revert.dorevert
(EXC_BAD_ACCESS / SIGSEGV).

The rollback itself (+[CodePushPackage rollbackPackage] + bookkeeping) is
extracted into a new +[CodePush rollbackPendingUpdate] class method, callable
with no bridge/instance around. The old -rollbackPackage instance method
(which called -loadBundle to trigger the racy reload) is now dead and
removed; -saveFailedUpdate: became a class method since it is shared by both
the download-failure path and the new rollback path.

Note: the IMMEDIATE-install/restartApp() reload path has the same underlying
Fabric race and is not addressed here; that needs a separate follow-up.

Author: ofalvai

ios/CodePush/CodePush.m

@@ -157,6 +157,16 @@ + (NSURL *)bundleURLForResource:(NSString *)resourceName
     bundleResourceSubdirectory = resourceSubdirectory;
     bundleResourceBundle = resourceBundle;
 
+    // If a pending update never finished loading (i.e. it crashed before calling
+    // notifyApplicationReady), roll it back here, before any JS/Fabric exists to
+    // race against. See docs/IOS_FABRIC_RELOAD_RACE.md.
+    NSUserDefaults *preferences = [NSUserDefaults standardUserDefaults];
+    NSDictionary *pendingUpdate = [preferences objectForKey:PendingUpdateKey];
+    if (pendingUpdate && [pendingUpdate[PendingUpdateIsLoadingKey] boolValue]) {
+        CPLog(@"Update did not finish loading the last time, rolling back to a previous version.");
+        [self rollbackPendingUpdate];
+    }
+
     [self ensureBinaryBundleExists];
 
     NSString *logMessageFormat = @"Loading JS bundle from %@";
@@ -400,20 +410,14 @@ - (void)initializeUpdateAfterRestart
     NSUserDefaults *preferences = [NSUserDefaults standardUserDefaults];
     NSDictionary *pendingUpdate = [preferences objectForKey:PendingUpdateKey];
     if (pendingUpdate) {
+        // A stuck (isLoading == YES) pending update is rolled back earlier, in
+        // +bundleURLForResource:..., before this method ever runs. So by this point,
+        // any pending update here is one that's ready to be tried out.
         _isFirstRunAfterUpdate = YES;
-        BOOL updateIsLoading = [pendingUpdate[PendingUpdateIsLoadingKey] boolValue];
-        if (updateIsLoading) {
-            // Pending update was initialized, but notifyApplicationReady was not called.
-            // Therefore, deduce that it is a broken update and rollback.
-            CPLog(@"Update did not finish loading the last time, rolling back to a previous version.");
-            needToReportRollback = YES;
-            [self rollbackPackage];
-        } else {
-            // Mark that we tried to initialize the new update, so that if it crashes,
-            // we will know that we need to rollback when the app next starts.
-            [self savePendingUpdate:pendingUpdate[PendingUpdateHashKey]
-                          isLoading:YES];
-        }
+        // Mark that we tried to initialize the new update, so that if it crashes,
+        // we will know that we need to rollback when the app next starts.
+        [self savePendingUpdate:pendingUpdate[PendingUpdateHashKey]
+                      isLoading:YES];
     }
 }
 
@@ -546,13 +550,12 @@ - (void)loadBundle
 }
 
 /*
- * This method is used when an update has failed installation
- * and the app needs to be rolled back to the previous bundle.
- * This method is automatically called when the rollback timer
- * expires without the app indicating whether the update succeeded,
- * and therefore, it shouldn't be called directly.
+ * This method is used when a pending update never finished loading (i.e. it
+ * crashed before calling notifyApplicationReady) and needs to be rolled back
+ * to the previous bundle. It's called from +bundleURLForResource:..., before
+ * any JS/Fabric exists, so there's no live bridge to reload.
  */
-- (void)rollbackPackage
++ (void)rollbackPendingUpdate
 {
     NSError *error;
     NSDictionary *failedPackage = [CodePushPackage getCurrentPackage:&error];
@@ -569,18 +572,18 @@ - (void)rollbackPackage
 
     // Rollback to the previous version and de-register the new update
     [CodePushPackage rollbackPackage];
-    [CodePush removePendingUpdate];
-    [self loadBundle];
+    [self removePendingUpdate];
+    needToReportRollback = YES;
 }
 
 /*
  * When an update failed to apply, this method can be called
  * to store its hash so that it can be ignored on future
  * attempts to check the server for an update.
  */
-- (void)saveFailedUpdate:(NSDictionary *)failedPackage
++ (void)saveFailedUpdate:(NSDictionary *)failedPackage
 {
-    if ([[self class] isFailedHash:[failedPackage objectForKey:PackageHashKey]]) {
+    if ([self isFailedHash:[failedPackage objectForKey:PackageHashKey]]) {
         return;
     }
 
@@ -760,7 +763,7 @@ -(void)loadBundleOnTick:(NSTimer *)timer {
         // The download failed
         failCallback:^(NSError *err) {
             if ([CodePushErrorUtils isCodePushError:err]) {
-                [self saveFailedUpdate:mutableUpdatePackage];
+                [[self class] saveFailedUpdate:mutableUpdatePackage];
             }
 
             // Stop observing frame updates if the download fails.