IssueTracker

We started experiencing https://github.com/Kotlin/kotlinx.coroutines/issues/3820 in our app (Only in Android 12 and 13 so far, but currently this is just in beta) and after some investigation I think that this could be some issue with the Android Runtime or the GC. Let me share here the same step by step analysis that I already shared in the Coroutines issue:

The crash originates in StateFlowSlot.makePending() which before the atomicfu update looked like this (this is decompiled Android byte code to Java:

public final void makePending() {
    Symbol symbol;
    Symbol symbol2;
    Symbol symbol3;
    Symbol symbol4;
    while (true) {
        Object obj = this._state;
        if (obj == null) {
            return;
        }
        symbol = StateFlowKt.PENDING;
        if (obj == symbol) {
            return;
        }
        symbol2 = StateFlowKt.NONE;
        boolean z16 = false;
        if (obj == symbol2) {
            AtomicReferenceFieldUpdater atomicReferenceFieldUpdater = _state$FU;
            symbol3 = StateFlowKt.PENDING;
            while (true) {
                if (!atomicReferenceFieldUpdater.compareAndSet(this, obj, symbol3)) {
                    if (atomicReferenceFieldUpdater.get(this) != obj) {
                        break;
                    }
                } else {
                    z16 = true;
                    break;
                }
            }
            if (z16) {
                return;
            }
        } else {
            AtomicReferenceFieldUpdater atomicReferenceFieldUpdater2 = _state$FU;
            symbol4 = StateFlowKt.NONE;
            while (true) {
                if (!atomicReferenceFieldUpdater2.compareAndSet(this, obj, symbol4)) {
                    if (atomicReferenceFieldUpdater2.get(this) != obj) {
                        break;
                    }
                } else {
                    z16 = true;
                    break;
                }
            }
            if (z16) {
                int i9 = k.f270577;
                ((CancellableContinuationImpl) obj).resumeWith(c0.f270561);
                return;
            }
        }
    }
}

Note: The crash did not happen in this case.

After the update to atomicfu in 1.7.0 it looks like this:

public final void makePending() {
    Symbol symbol;
    Symbol symbol2;
    Symbol symbol3;
    Symbol symbol4;
    AtomicReferenceFieldUpdater atomicReferenceFieldUpdater = _state$volatile$FU;
    while (true) {
        Object obj = atomicReferenceFieldUpdater.get(this);
        if (obj == null) {
            return;
        }
        symbol = StateFlowKt.PENDING;
        if (obj == symbol) {
            return;
        }
        symbol2 = StateFlowKt.NONE;
        boolean z13 = false;
        if (obj == symbol2) {
            AtomicReferenceFieldUpdater atomicReferenceFieldUpdater2 = _state$volatile$FU;
            symbol3 = StateFlowKt.PENDING;
            while (true) {
                if (!atomicReferenceFieldUpdater2.compareAndSet(this, obj, symbol3)) {
                    if (atomicReferenceFieldUpdater2.get(this) != obj) {
                        break;
                    }
                } else {
                    z13 = true;
                    break;
                }
            }
            if (z13) {
                return;
            }
        } else {
            AtomicReferenceFieldUpdater atomicReferenceFieldUpdater3 = _state$volatile$FU;
            symbol4 = StateFlowKt.NONE;
            while (true) {
                if (!atomicReferenceFieldUpdater3.compareAndSet(this, obj, symbol4)) {
                    if (atomicReferenceFieldUpdater3.get(this) != obj) {
                        break;
                    }
                } else {
                    z13 = true;
                    break;
                }
            }
            if (z13) {
                int i16 = k.f159498;
                ((CancellableContinuationImpl) obj).resumeWith(c0.f159482);
                return;
            }
        }
    }
}

with the crash originating in this line: Object obj = atomicReferenceFieldUpdater.get(this);

Note: Even though StateFlow.kt had no meaningful code change between 1.6.4 and 1.7.0 because of the atomicfu update the byte code changed. This is also the reason why the forced dependency downgrade of atomicfu will not "fix" this issue, as the impacted code is already in the coroutines -core .jar file. So the downgrade during app build does not really do anything anymore.

This is where it gets funky: This code calls get on AtomicReferenceFieldUpdaterImpl with this (StateFlowSlot) instance as parameter.

@SuppressWarnings("unchecked")
public final V get(T obj) {
  accessCheck(obj);
  return (V)U.getObjectVolatile(obj, offset);
}

with

private final void accessCheck(T obj) {
  if (!cclass.isInstance(obj))
    throwAccessCheckException(obj);
}

cclass is StateFlowSlot.class because it is the first parameter in

static final /* synthetic */ AtomicReferenceFieldUpdater _state$FU = AtomicReferenceFieldUpdater.newUpdater(StateFlowSlot.class, Object.class, "_state");

and the constructor of AtomicReferenceFieldUpdaterImpl assigns it to the tclass, which is the fist parameter:

this.cclass = (Modifier.isProtected(modifiers) &&
  tclass.isAssignableFrom(caller) &&
  !isSamePackage(tclass, caller))
  ? caller : tclass;

so this accessCheck is checking if our instance of type StateFlowSlot is an instance of StateFlowSlot.class

on Android 13 the isInstance call looks like this:

public boolean isInstance(Object obj) {
  if (obj == null) {
    return false;
  }
  return isAssignableFrom(obj.getClass());
}

so this will get the class from the object (which itself is not null) that we called this with (which would be the existing instance of StateFlowSlow.

into

public boolean isAssignableFrom(Class<?> cls) {
  if (this == cls) {
    return true;  // Can always assign to things of the same type.
  } else if (this == Object.class) {
    return !cls.isPrimitive();  // Can assign any reference to java.lang.Object.
  } else if (isArray()) {
    return cls.isArray() && componentType.isAssignableFrom(cls.componentType);
  } else if (isInterface()) {
    // Search iftable which has a flattened and uniqued list of interfaces.
    Object[] iftable = cls.ifTable;
    if (iftable != null) {
      for (int i = 0; i < iftable.length; i += 2) {
        if (iftable[i] == this) {
          return true;
        }
     }
    }
  return false;
  } else {
    if (!cls.isInterface()) {
      for (cls = cls.superClass; cls != null; cls = cls.superClass) {
        if (cls == this) {
         return true;
       }
      }
    }
  return false;
  }
}

And this is where the crash is in line if (!cls.isInterface()) {.

Which means that the obj.getClass() call in isInstance returned a null class even though the instance is not null, which leads to that crash and seems to be an impossible state to be in (the Class of a live instance is null).

The Object implementation on Android seems to use some kind of backing field here:

public final Class<?> getClass() {
  return shadow$_klass_;
}

which must be null in this case. Given that this is happening way less often than this code is getting called it appears that this is some kind of race condition, maybe with GC but I really don't know any further.

Android standard lib code examples from: https://android.googlesource.com/platform/libcore/+/refs/heads/android13-d1-release/ojluni/src/main/java/java/lang