IssueTracker

We've encountered a rather odd error that looks like dex2oat is sometimes generating incorrect code for some arithmetic operations.

The problem was first noticed in a banking app protected with obfuscation technology, and the problematic code happened to be doing key generation as part of this obfuscation. However we've isolated it down to a simple example app that just does a tiny bit of maths.

The problem only affects some devices, and we've yet to work out the logic behind when it happens - some devices of a particular model/OS version/manufacturer will have the problem but other apparently-identical devices don't have the problem.

On devices where it occurs, it seems to happen on successive installs (or upgrades) of the app. So the app would work fine, but if you either upgrade it or uninstall and install it, it'll misbehave. Then after the next uninstall/re-install it'll work fine. It's always regular as clockwork - every other install has the issue.

The attached sample app just does some maths and logs the results to logcat in the main activity's onCreate.

public class MainActivity extends AppCompatActivity {
    /* JADX INFO: Access modifiers changed from: protected */
    @Override // androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity
    public void onCreate(Bundle bundle) {
        super.onCreate(bundle);
        Log.e("Test", "i = -512667375");
        Log.e("Test", "i2 = 0");
        Log.e("Test", "Method Length " + MainActivity.class.getMethods().length);
        int i = MainActivity.class.getMethods().length < 1 ? (int) (0 | 94937813634376546L) : 0;
        int i2 = (-512667375) >>> i;
        Log.e("Test", "i3 = " + i2);
        int i3 = (-512667375) << ((-i) & 31);
        Log.e("Test", "i4 = " + i3);
        Log.e("Test", "Value is - " + ((i2 + i3) - (i3 & i2)));
    }
}
 
The first time it’s installed, the value printed at the end is -512667375. If the app is re-installed (on an affected device) then all the intermediate values are the same but the final number becomes 0. This is clearly wrong as it means that final sum is coming up with different answers given the same inputs, which isn’t how arithmetic is supposed to work!

Oddly the call to getMethods() is necessary; if it's removed, the whole thing works, despite the number of methods always being more than 0.

If we could understand when this happened (which arithmetic operations were affected and what other things need to be happening for it to occur) we might be able to code round it, but as it is, it's sufficiently baffling that we are stuck.