.NET 10 Android crash due to AndroidEnableMarshalMethods

[mjo151]

Android framework version

net10.0-android

Affected platform version

Android workload 36.1.30

Description

Our Android app is crashing on some devices with AndroidEnableMarshalMethods set to true (default in .NET 10). When AndroidEnableMarshalMethods is set to false, the app runs normally. The crash is occurring when connecting and communicating with Bluetooth and Bluetooth LE devices, but might occur in other cases. It only appears to affect some devices (e.g. it's very reproducible on a Samsung Galaxy A50 running Android 11).

I am using mono AOT, but also reproduced the crash without AOT.

Tombstone is attached.

tombstone_04.txt

Steps to Reproduce

1. Build a .NET 10 app with AndroidEnableMarshalMethods set to true
2. Run on a Samsung Galaxy A50 running Android 11
3. Connect to a Bluetooth LE device and try to communicate. This was the best way for me to reproduce the issue, but I'm not sure why. Maybe the BluetoothGattCallback implementation?

Did you find any workaround?

Set AndroidEnableMarshalMethods to false

Relevant log output

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
Cause: null pointer dereference
  x0  0000000000000000  x1  000000006ff43570  x2  0000000000000008  x3  0000000000000000
  x4  00000074cf2f75e4  x5  000000744985fd38  x6  0000000000000000  x7  0000000000000000
  x8  0000000000000001  x9  0000000070a6596c  x10 0000000000000000  x11 00000074cf5fb000
  x12 00000000346c1050  x13 00000000541b3201  x14 0000000000000008  x15 00000074b51923e8
  x16 0000000000000002  x17 0000000000000000  x18 00000075568ae000  x19 0000007fed292490
  x20 0000000000008bf6  x21 0000000000000000  x22 0000000000000000  x23 0000000012c82b30
  x24 00000074ceff5f85  x25 000000755615b000  x26 00000074cefd95e2  x27 0000000000000043
  x28 000000755615b000  x29 0000007fed292420
  lr  00000074cf4a60f8  sp  0000007fed2923b0  pc  00000074cf4a6104  pst 0000000060000000

backtrace:
  #00 pc 000000000055e104  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithJValues<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, jvalue const*)+132) (BuildId: 20a61ceda1c3bdebcedb0a6a38e4361c)
  #01 pc 00000000003af870  /apex/com.android.art/lib64/libart.so (art::JNI<false>::CallIntMethodA(_JNIEnv*, _jobject*, _jmethodID*, jvalue const*)+652) (BuildId: 20a61ceda1c3bdebcedb0a6a38e4361c)
  #02 pc 000000000001e25c  <anonymous:754fcf5000>

[jonathanpeppers]

Are you able to share a sample project that causes this crash?

Offhand, copilot 🤖 thinks:

Likely root cause: This appears to be a GC bridge / Java peer lifetime issue specific to marshal methods. The BluetoothGattCallback instance's Java peer gets collected (or its reference invalidated) before
a callback fires, because marshal methods change the reference tracking lifecycle. When the callback arrives, the managed wrapper still exists but its Java handle is null, so the managed code calling back
into Java via CallIntMethodA crashes.

But it doesn't seem like the problem should go away with AndroidEnableMarshalMethods=false if that were true.

[mjo151]

I can't share the app source code. I'll have to see if I can create a simple sample that reproduces the issue. Anything else that might be helpful?

[jonathanpeppers]

I think a sample is the next step, thanks!

Maybe there is a bluetooth sample somewhere, that is close to what you are doing?

[mjo151]

I spent a good bit of time trying to come up with a simple sample that reproduces the issue but have not yet been successful. I will try again once I get some spare time.