java.lang.VerifyError: Verifier rejected class [293501981]

Verified

Bug

Status Update

No update yet.

Description

an...@airbnb.com

created issue #1

Jul 28, 2023 04:57PM

DESCRIBE THE ISSUE IN DETAIL:

Our app started crashing today out of the blue without any code change (or tooling version upgrades) to the code in question:

java.lang.VerifyError: Verifier rejected class s90.b: void s90.b.ǃ(o52.c, u52.a) failed to verify: void s90.b.ǃ(o52.c, u52.a): [0x244] copy1 v26<-v11 type=Undefined cat=3 (declaration of 's90.b' appears in /data/app/~~5Xr2Mb1qMgb3r7pQ7m9qrA==/com.airbnb.android-X4F2fwfbB2MHV1HUOdtkEw==/base.apk!classes16.dex)
at z90.b$a.invokeSuspend(CalendarEditViewModel.kt:118)
at z90.b$a.invoke(CalendarEditViewModel.kt:13)
at kotlinx.coroutines.flow.FlowKt__MergeKt$mapLatest$1.invokeSuspend(Merge.kt:49)
at kotlinx.coroutines.flow.FlowKt__MergeKt$mapLatest$1.invoke(Merge.kt:2)
at kotlinx.coroutines.flow.FlowKt__MergeKt$mapLatest$1.invoke(Merge.kt:1)
at kotlinx.coroutines.flow.internal.ChannelFlowTransformLatest$flowCollect$3$1$2.invokeSuspend(Merge.kt:37)
at kotlinx.coroutines.flow.internal.ChannelFlowTransformLatest$flowCollect$3$1$2.invoke(Merge.kt:2)
at kotlinx.coroutines.flow.internal.ChannelFlowTransformLatest$flowCollect$3$1$2.invoke(Merge.kt:1)
at kotlinx.coroutines.intrinsics.UndispatchedKt.startCoroutineUndispatched(Undispatched.kt:14)
at kotlinx.coroutines.CoroutineStart.invoke(CoroutineStart.kt:28)
at kotlinx.coroutines.AbstractCoroutine.start(AbstractCoroutine.kt:1)
at kotlinx.coroutines.BuildersKt__Builders_commonKt.launch(Builders.common.kt:23)
at kotlinx.coroutines.BuildersKt.launch(Unknown Source:1)
at kotlinx.coroutines.BuildersKt__Builders_commonKt.launch$default(Builders.common.kt:13)
at kotlinx.coroutines.BuildersKt.launch$default(Unknown Source:1)
at kotlinx.coroutines.flow.internal.ChannelFlowTransformLatest$flowCollect$3$1.emit(Merge.kt:111)
at kotlinx.coroutines.flow.SharedFlowImpl.collect$suspendImpl(SharedFlow.kt:202)
at kotlinx.coroutines.flow.SharedFlowImpl$collect$1.invokeSuspend(SharedFlow.kt:13)
at kotlin.coroutines.jvm.internal.a.resumeWith(ContinuationImpl.kt:6)
at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:105)
at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:1)
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.executeTask(CoroutineScheduler.kt:15)
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.runWorker(CoroutineScheduler.kt:29)
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:1)

I saw several of those fixed in the past months so we updated to latest version of R8 (4.0.64) but we are still seeing it.

We are working around this right now by just keeping the class in question but I think this is a bug in R8.

I included the broken .aab and .apk files and also an input dump and shared it with "the usual" people. Happy to share it with others if required, or provide more information.

IMPORTANT: Please read https://developer.android.com/studio/report-bugs.html carefully and supply all required information.

Studio Build: Not relevant Version of Gradle Plugin: 7.4.2 Version of Kotlin: 1.8.21 Version of Gradle: 7.6 Version of Java: openjdk 17.0.8 2023-07-18 LTS OS: Linux

https://drive.google.com/file/d/1ggIkdj93p1XEon-u-gJHEW127kmQk_lq/view?usp=drive_web (release_global_airbnb.gz)

https://drive.google.com/file/d/1VO_s1gOXew1G_WtFKC-J9kQm5dN5SuW5/view?usp=drive_web (r8_dump_release_global_airbnb.zip)

Comments

ar...@google.com <ar...@google.com> Jul 28, 2023 06:45PM

Assigned to an...@google.com.

an...@airbnb.com <an...@airbnb.com> #2Jul 28, 2023 11:49PM

Further investigation showed that this error only happens if R8 full mode is disabled. If R8 full mode is enabled we do not see the error.

ri...@google.com <ri...@google.com> Jul 31, 2023 07:59AM

Reassigned to ch...@google.com.

ch...@google.com <ch...@google.com> #3Jul 31, 2023 09:08AM

Thanks for sharing the relevant artifacts. As mentioned offline I had some trouble decompressing the artifacts.

Given the compiler dump I will try to reproduce the issue on R8 4.0.64, and then validate if the issue is still present in R8 8.0, 8.1, and 8.2. If not, I will try to bisect when this was fixed.

an...@airbnb.com <an...@airbnb.com> #4Jul 31, 2023 05:21PM

I fixed the naming for the archive and also created a new just zip one here:

https://drive.google.com/file/d/1sP67ftqhDfHcE8bwrWFK4DaXEuQDbzs1/view?usp=drive_web (airbnb.zip)

ch...@google.com <ch...@google.com> #5Aug 2, 2023 11:49AM

Thanks for sharing the dump. I was able to reproduce the issue all the way up to the latest stable version, R8 8.1.60. I will start diagnosing what is causing this.

ch...@google.com <ch...@google.com> #6Aug 4, 2023 10:59AM

I have now found the root cause. This is hitting a bug in the ART verifier. The compiler already has a workaround in place to avoid hitting the ART verifier bug, but after the workaround has been applied, other optimizations rewrite the code in a way that breaks the workaround.

This should be quite straight-forward to fix. I expect to land a fix on Monday and will then try cherry-picking this back to R8 4.0.

an...@airbnb.com <an...@airbnb.com> #7Aug 4, 2023 06:06PM

Thank you for the update!

ch...@google.com <ch...@google.com> #8Aug 7, 2023 01:08PM

Creating a minimal reproduction of the verification error I hit with R8 8.2 ended up being a bit trickier than expected.

Moreover, the verification error I was able to reproduce with R8 8.2 actually seems to be different than the verification error you hit with R8 4.0.

I will validate if I can reproduce the verification error in comment #1 with the dump, and look if we already have a fix for that.

ch...@google.com <ch...@google.com> #9Aug 9, 2023 06:07AM

The other verification error reproduces up until 8.2.14-dev but disappears with 8.2.15-dev. The error was "fixed" with [LIR] Default enable the use of light-weight IR, but this is not actually fixing the root cause.

Trying to rebuild IR from the offending method fails with "Undefined value encountered during compilation. This is typically caused by invalid dex input that uses a register that is not defined on all control-flow paths leading to the use".

This is typically due to an optimization that has incorrectly rewritten some piece of code.

ap...@google.com <ap...@google.com> #10Aug 11, 2023 05:55AM

Project: r8
Branch: main

commit e04d305fe2a6d63999f6d32c08d5cfb689ac8818
Author: Christoffer Quist Adamsen <christofferqa@google.com>
Date: Thu Aug 10 14:53:26 2023

Avoid conflating register sets at move-exception

In-resolution moves to a move-exception instruction cannot be inserted before the move-exception instruction.

Previously, we worked around this by adding the in-resolution moves to a move-exception instruction as in-resolution moves to the goto instruction that is always after the move-exception instruction (since catch handlers are split blocks).

The in-resolution moves to the move-exception instruction must be inserted before any of the in-resolution moves to the goto instruction, however. By conflating the two in-resolution move sets, the subsequent parallel move scheduling may incorrectly reorder two moves.

Example: Consider that the in-resolution moves for the move-exception instruction is the set { move r11, r3 } and the in-resolution moves for the goto instruction is the set { move r1, r11 }.

The instructions must be laid out in sequence as:

move r11, r3
move r1, r11

When the two sets are conflated as { move r11, r3; move r1, r11 }, parallel move scheduling will instead layout the moves as follows, which may lead to arbitrary errors:

move r1, r11
move r11, r3

Fix: Instead of conflating the two in-resolution move sets, this CL simply inserts the in-resolution moves for the move-exception instruction immediately after the move-exception instruction.

Bug:

Issue 293501981

Description

Issue summary

Comments

ar...@google.com <ar...@google.com> Jul 28, 2023 06:45PM

an...@airbnb.com <an...@airbnb.com> #2Jul 28, 2023 11:49PM

ri...@google.com <ri...@google.com> Jul 31, 2023 07:59AM

ch...@google.com <ch...@google.com> #3Jul 31, 2023 09:08AM

an...@airbnb.com <an...@airbnb.com> #4Jul 31, 2023 05:21PM

ch...@google.com <ch...@google.com> #5Aug 2, 2023 11:49AM

ch...@google.com <ch...@google.com> #6Aug 4, 2023 10:59AM

an...@airbnb.com <an...@airbnb.com> #7Aug 4, 2023 06:06PM

ch...@google.com <ch...@google.com> #8Aug 7, 2023 01:08PM

ch...@google.com <ch...@google.com> #9Aug 9, 2023 06:07AM

ap...@google.com <ap...@google.com> #10Aug 11, 2023 05:55AM

ap...@google.com <ap...@google.com> #11Aug 11, 2023 07:47AM

ap...@google.com <ap...@google.com> #12Aug 11, 2023 07:47AM

ap...@google.com <ap...@google.com> #13Aug 11, 2023 08:28AM

ap...@google.com <ap...@google.com> #14Aug 11, 2023 11:00AM

ap...@google.com <ap...@google.com> #15Aug 11, 2023 11:00AM

ap...@google.com <ap...@google.com> #16Aug 11, 2023 11:00AM

ap...@google.com <ap...@google.com> #17Aug 11, 2023 11:00AM

ap...@google.com <ap...@google.com> #18Aug 11, 2023 11:00AM

ap...@google.com <ap...@google.com> #19Aug 11, 2023 11:00AM

ap...@google.com <ap...@google.com> #20Aug 11, 2023 11:00AM

ap...@google.com <ap...@google.com> #21Aug 11, 2023 11:00AM

ap...@google.com <ap...@google.com> #22Aug 11, 2023 11:02AM

ap...@google.com <ap...@google.com> #23Aug 11, 2023 11:02AM

ap...@google.com <ap...@google.com> #24Aug 11, 2023 11:02AM

ap...@google.com <ap...@google.com> #25Aug 11, 2023 11:16AM

ap...@google.com <ap...@google.com> #26Aug 11, 2023 11:16AM

ap...@google.com <ap...@google.com> #27Aug 11, 2023 11:16AM

ap...@google.com <ap...@google.com> #28Aug 11, 2023 11:16AM

ap...@google.com <ap...@google.com> #29Aug 11, 2023 11:18AM

ap...@google.com <ap...@google.com> #30Aug 13, 2023 11:52AM

ap...@google.com <ap...@google.com> #31Aug 13, 2023 03:04PM

ap...@google.com <ap...@google.com> #32Aug 13, 2023 03:04PM

ap...@google.com <ap...@google.com> #33Aug 13, 2023 03:05PM

ap...@google.com <ap...@google.com> #34Aug 13, 2023 03:06PM

ch...@google.com <ch...@google.com> #35Aug 14, 2023 08:32AM

an...@airbnb.com <an...@airbnb.com> #36Sep 5, 2023 06:16PM

Add comment

Issue metadata