IssueTracker

Guys, do you have any updates? That crash occurred in stable versions of R8.

Thank you for filing an issue with us and for creating a reproduction.

It seems like the issue is related to FilledNewArray. This is the code in 8.1.0-dev:

void com.foo.bar.TestViewController.updateContentState(com.foo.bar.b)
registers: 4, inputs: 2, outputs: 2
------------------------------------------------------------
inst#  offset  instruction         arguments
------------------------------------------------------------
    0:   0x00: InstanceOf          v0, v3, Lcom/foo/bar/b$a;
    1:   0x02: IfNez               v0, 0x25 (+35)
    2:   0x04: InstanceOf          v3, v3, Lcom/foo/bar/b$b;
    3:   0x06: IfEqz               v3, 0x24 (+30)
    4:   0x08: Const4              v3, 0x2 (2)
    5:   0x09: NewArray            v3, v3, [Lcom/foo/bar/a;
    6:   0x0b: NewInstance         v0, Lcom/foo/bar/a$b;
    7:   0x0d: InvokeDirect        { v0 } Lcom/foo/bar/a$b;<init>()V
    8:   0x10: Const4              v1, 0x0 (0)
    9:   0x11: AputObject          v0, v3, v1
   10:   0x13: NewInstance         v0, Lcom/foo/bar/a$a;
   11:   0x15: InvokeDirect        { v0 } Lcom/foo/bar/a$a;<init>()V
   12:   0x18: Const4              v1, 0x1 (1)
   13:   0x19: AputObject          v0, v3, v1

And this is after:

void com.foo.bar.TestViewController.updateContentState(com.foo.bar.a)
registers: 3, inputs: 2, outputs: 2
------------------------------------------------------------
inst#  offset  instruction         arguments
------------------------------------------------------------
    0:   0x00: InstanceOf          v0, v2, Lcom/foo/bar/a$a;
    1:   0x02: IfNez               v0, 0x20 (+30)
    2:   0x04: InstanceOf          v2, v2, Lcom/foo/bar/a$b;
    3:   0x06: IfEqz               v2, 0x1f (+25)
    4:   0x08: NewInstance         v2, Ly0/b;
    5:   0x0a: InvokeDirect        { v2 } Ly0/b;<init>()V
    6:   0x0d: NewInstance         v0, Ly0/a;
    7:   0x0f: InvokeDirect        { v0 } Ly0/a;<init>()V
    8:   0x12: FilledNewArray      { v2 v0 } [Lcom/foo/bar/AdapterContract;
    9:   0x15: MoveResultObject    v2

It seems to work for D8:

void com.foo.bar.TestViewController.updateContentState(com.foo.bar.ContentState)
registers: 5, inputs: 2, outputs: 2
------------------------------------------------------------
inst#  offset  instruction         arguments
------------------------------------------------------------
   ...
   19:   0x29: NewInstance         v4, Lcom/foo/bar/AdapterContract$SummaryItem;
   20:   0x2b: SgetObject          v0, Lcom/foo/bar/SummaryItemType$LoadingSummaryItem;INSTANCE:Lcom/foo/bar/SummaryItemType$LoadingSummaryItem;
   21:   0x2d: CheckCast           v0, Lcom/foo/bar/SummaryItemType;
   22:   0x2f: InvokeDirect        { v4 v0 } Lcom/foo/bar/AdapterContract$SummaryItem;<init>(Lcom/foo/bar/SummaryItemType;)V
   23:   0x32: CheckCast           v4, Lcom/foo/bar/AdapterContract;
         0x34, #66, locals: [3 -> this]
   24:   0x34: NewInstance         v0, Lcom/foo/bar/AdapterContract$ListItem;
   25:   0x36: SgetObject          v1, Lcom/foo/bar/ListItemType$LoadingItem;INSTANCE:Lcom/foo/bar/ListItemType$LoadingItem;
   26:   0x38: CheckCast           v1, Lcom/foo/bar/ListItemType;
   27:   0x3a: InvokeDirect        { v0 v1 } Lcom/foo/bar/AdapterContract$ListItem;<init>(Lcom/foo/bar/ListItemType;)V
   28:   0x3d: CheckCast           v0, Lcom/foo/bar/AdapterContract;
   29:   0x3f: FilledNewArray      { v4 v0 } [Lcom/foo/bar/AdapterContract;
   30:   0x42: MoveResultObject    v4
         0x43, #64, locals: [3 -> this]
   31:   0x43: InvokeStatic        { v4 } Lkotlin/collections/CollectionsKt;listOf([Ljava/lang/Object;)Ljava/util/List;
   32:   0x46: ReturnVoid          

I will check if the issue is the missing CheckCast.

I made a few additional checks with check-cast and typing the FilledNewArray as Ljava/lang/Object; and both worked.

void com.foo.bar.TestViewController.updateContentState(com.foo.bar.a)
registers: 3, inputs: 2, outputs: 2
------------------------------------------------------------
inst#  offset  instruction         arguments
------------------------------------------------------------
    0:   0x00: InstanceOf          v0, v2, Lcom/foo/bar/a$a;
    1:   0x02: IfNez               v0, 0x24 (+34)
    2:   0x04: InstanceOf          v2, v2, Lcom/foo/bar/a$b;
    3:   0x06: IfEqz               v2, 0x23 (+29)
    4:   0x08: NewInstance         v2, Ly0/b;
    5:   0x0a: InvokeDirect        { v2 } Ly0/b;<init>()V
    6:   0x0d: CheckCast           v2, Lcom/foo/bar/AdapterContract;
    7:   0x0f: NewInstance         v0, Ly0/a;
    8:   0x11: InvokeDirect        { v0 } Ly0/a;<init>()V
    9:   0x14: CheckCast           v0, Lcom/foo/bar/AdapterContract;
   10:   0x16: FilledNewArray      { v2 v0 } [Lcom/foo/bar/AdapterContract;
   11:   0x19: MoveResultObject    v2
...

I could reproduce the error on an api 33 emulator but not 31. Our headless VMs we use for testing did not reproduce it. One thing we can do is synthesize the CheckCast when creating FilledNewArray but potentially the ART team knows why the verifier rejects it on Android 13 (and potentially before).

ngeoffray@, are you aware of any problems or changes to the verification of FilledNewArray?

Yeah, this is my mistake. Crash reproducible on Android 13+

Hi, guys. How about a backport in 8.1?

It will be backported when it passes our internal tests.

This was fixed after landing: https://googleplex-android-review.git.corp.google.com/c/platform/prebuilts/r8/+/23489252

For our own purposes, the fix in ART is here: https://android-review.git.corp.google.com/c/platform/art/+/2438373

This can not be seen externally.

The public URL for the Art fix is: https://android-review.googlesource.com/c/platform/art/+/2438373.

Hey, guys! Crash still reproduced on Sample Project with fresh R8 8.1.53

Thanks for reporting back that this is still an issue. I've tested and could also see the same issue. I did do a check before submitting 8.1.51 but must either have used the D8 or an incorrect emulator.

The issue here is the check:

return clazz.isInterface() || valueType.isClassType(elementType);

Ordinarily, type-checking is weakened for interface types due other strange issues and since I found no issues testing it I included it. The fix needs to be:

return valueType.isClassType(elementType);

Will update the code and do a new cherry-pick to the 8.1 branch.

Checked that running with 3232b654f8432d9f8cc0a501afdc2bed8bbde0ec resolves the issue by adding :

maven {
    url 'https://storage.googleapis.com/r8-releases/raw/main'
}

and

buildscript {
    dependencies {
        classpath("com.android.tools:r8:3232b654f8432d9f8cc0a501afdc2bed8bbde0ec")
    }
}

The APP now runs without throwing the error

# compiler: R8
# compiler_version: main
# min_api: 24
# compiler_hash: 3232b654f8432d9f8cc0a501afdc2bed8bbde0ec
# common_typos_disable
# {"id":"com.android.tools.r8.mapping","version":"2.2"}
# pg_map_id: 9ef8888
# pg_map_hash: SHA-256 9ef88884af70a1da33707ec31626367b52a37d290c9c8aadf9cd4dc008816dfd

Will merge this new CL to 8.1