Status Update
Comments
sh...@gmail.com <sh...@gmail.com> #2
Thank you for the report and reproduction. I can reproduce on a Android TV emulator.
vi...@google.com <vi...@google.com> #3 Restricted+
vi...@google.com <vi...@google.com> #4
Looks like dead code removal in java.lang.Object androidx.collection.LruCache.remove(java.lang.Object)
is causing this.
The method java.lang.Object androidx.collection.LruCache.remove(java.lang.Object)
is processed twice in first round of IR, second time with more precise type for the argument as java.lang.Object androidx.collection.LruCache.remove(java.lang.String)
.
That second processing involves quite a bit of inlining. However before dead code removal the return is still split between null and not null return value:
block 33, pred-counts: 1, succ-count: 2, filled: true, sealed: false
predecessors: 32
successors: 37 34 (no try/catch successors)
no phis
#187:remove;0:remove: -1: If v54 EQZ block 37 (fallthrough 34)
block 34, pred-counts: 1, succ-count: 1, filled: true, sealed: false
predecessors: 33
successors: 35 (no try/catch successors)
no phis
#187:remove;0:remove: -1: Assume v49 <- v54; not null
#188:remove;0:remove: -1: ConstNumber v32(0b0) <- 0 (INT)
: -1: ConstNumber v33(0) <- 0 (@Null NULL)
: -1: Goto block 35
block 35, pred-counts: 1, succ-count: 0, filled: true, sealed: false
predecessors: 34
successors: -
no phis
#188:remove;0:remove: -1: ConstString v90 <- "key"
: -1: Invoke-Static v45, v90; method: void kotlin.jvm.internal.Intrinsics.checkNotNullParameter(java.lang.Object, java.lang.String)
: -1: ConstString v91 <- "oldValue"
: -1: Invoke-Static v49, v91; method: void kotlin.jvm.internal.Intrinsics.checkNotNullParameter(java.lang.Object, java.lang.String)
#191:remove;0:remove: -1: Return v49
block 37, pred-counts: 1, succ-count: 0, filled: true, sealed: false
predecessors: 33
successors: -
no phis
#191:remove;0:remove: -1: Return v54
After dead code removal a single return is left with the non null assumption:
block 34, pred-counts: 1, succ-count: 1, filled: true, sealed: false
predecessors: 32
successors: 35 (no try/catch successors)
no phis
#187:remove;0:remove: -1: Assume v49 <- v54; not null
#188:remove;0:remove: -1: Goto block 35
block 35, pred-counts: 1, succ-count: 0, filled: true, sealed: false
predecessors: 34
successors: -
no phis
#191:remove;0:remove: -1: Return v49
For reference the source of the method is:
public fun remove(key: K): V? {
val previous: V?
lock.synchronized {
previous = map.remove(key)
if (previous != null) {
size -= safeSizeOf(key, previous)
}
}
if (previous != null) {
entryRemoved(false, key, previous, null)
}
return previous
}
with the default implementation of entryRemoved
doing nothing:
protected open fun entryRemoved(evicted: Boolean, key: K, oldValue: V, newValue: V?) {}
sh...@gmail.com <sh...@gmail.com> #5
The underlying issue is that branch simplification (as part of dead code removal) is comparing return values through their aliased values (in valuesAreIdentical
) potentially conflating return values with different assume instructions. As this happens before collecting optimization info this can lead to the wrong dynamic type for the return value.
private boolean valuesAreIdentical(Value value, Value other) {
value = value.getAliasedValue();
other = other.getAliasedValue();
if (value == other) {
return true;
}
if (value.isPhi() || other.isPhi()) {
return false;
}
return instructionsDefineIdenticalValues(value.definition, other.definition);
}
vv...@google.com <vv...@google.com> #6
Project: r8
Branch: main
Author: Søren Gjesse <
Link:
Add reproduction of
Expand for full commit details
Add reproduction of b/395489597
Bug: b/395489597
Change-Id: If769fae5db93ee8e2cfc1cf9feeddd847b00832b
Files:
- A
src/test/java/com/android/tools/r8/deadcode/DifferentAssumptionsOnReturnValuesTest.java
Hash: 92f532e6521e5e18a35f365824ad402acb325b3e
Date: Wed Feb 12 12:02:20 2025
Description
What
User experience
What type of Android issue is this?
Reboot, Crash or Device Hang
What steps would let us observe this issue?
What did you expect to happen?
Normal continuation of call
What actually happened?
Phone froze and rebooted
What was the effect of this issue on your device usage, such as lost time or work?
Extreme - device was unusable
When
Time and frequency
Time when bug report was triggered: Jan 26, 2025 11:24 AM GMT+05:30
How often has this happened?
Frequently
Where
Component
Originating component: <not visible> (1684638)
Build and device data
- Build Number: google/lynx_beta/lynx:Baklava/BP22.250103.008/12932282:user/release-keys
(Note: It is the build when sending this report. For exact build reference, please see the attached bugreport.)
Debugging information
Google Play services
com.google.android.gms
Version 250231035 (25.02.31 (260400-713337402))
System App (Bundled)
Android System WebView
com.google.android.webview
Version 677826033 (131.0.6778.260)
System App (Updated)
Network operator: airtel
SIM operator: airtel
Network operator: JIO 4G
SIM operator: Jio
Filed by Android Beta Feedback. Version (Updated): 2.46-betterbug.external_20241023_RC01 (DOGFOOD)https://developer.android.com/preview/feedback#feedback-app .
To learn more about our feedback process, please visit