Redex: Redex crash with -6 code after adding mapping.txt file

[amiton]

Hi,
I'm using the latest redex (December 23, 2019).

When running the following command the redex completes successfully:
redex -c default.config -o out.apk in.apk -P proguard.cfg --sign -s key.keystore -a XXX -p XXX

But when i add the mapping.txt the redex crashes (see blow command and result):
redex -c default.config -o out.apk in.apk -m mapping.txt -P proguard.cfg --sign -s key.keystore -a XXX -p XXX

libc++abi.dylib: terminating with uncaught exception of type boost::exception_detail::error_info_injector: libredex/ProguardMap.cpp:354: DexString *pg_impl::file_name_from_method_string(const DexString *): assertion `start != std::string::npos && end != std::string::npos' failed.

0 redex-all 0x00000001099bfc32 _Z23crash_backtrace_handleri + 50
1 libsystem_platform.dylib 0x00007fff6dae342d _sigtramp + 29
2 ??? 0x0000000000000400 0x0 + 1024
3 libsystem_c.dylib 0x00007fff6d9b8a1c abort + 120
4 libc++abi.dylib 0x00007fff6aa56be8 __cxa_bad_cast + 0
5 libc++abi.dylib 0x00007fff6aa56d84 _ZL28demangling_terminate_handlerv + 238
6 libobjc.A.dylib 0x00007fff6c57e792 _ZL15_objc_terminatev + 104
7 libc++abi.dylib 0x00007fff6aa63dc7 _ZSt11__terminatePFvvE + 8
8 libc++abi.dylib 0x00007fff6aa63b6c __cxa_get_exception_ptr + 0
9 libc++abi.dylib 0x00007fff6aa5545d __cxa_get_globals + 0
10 redex-all 0x00000001099c020c _Z11assert_failPKcS0_jS0_10RedexErrorS0_z + 892
11 redex-all 0x0000000109abc33b _ZN7pg_impl28file_name_from_method_stringEPK9DexString + 811
12 redex-all 0x0000000109abc41d _ZN7pg_impl28apply_deobfuscated_positionsEP6IRCodeRK11ProguardMap + 141
13 redex-all 0x0000000109abf193 _ZNSt3__110__function6__funcIZ24apply_deobfuscated_namesRKNS_6vectorINS2_IP8DexClassNS_9allocatorIS4_EEEENS5_IS7_EEEERK11ProguardMapE3$_1NS5_ISF_EEFvS4_EEclEOS4_ + 771
14 redex-all 0x00000001094d3a72 _ZNSt3__110__function6__funcIZ17workqueue_foreachIP8DexStoreE9WorkQueueIT_ERKNS_8functionIFvS6_EEEjEUlP11WorkerStateIS4_ES4_E_NS_9allocatorISG_EEFvSF_S4_EEclEOSF_OS4_ + 34
15 redex-all 0x00000001094d645d _ZZN9WorkQueueIP8DexClassE7run_allEvENKUlP11WorkerStateIS1_EmE_clES5_m + 141
16 libboost_thread-mt.dylib 0x000000010ae13ae8 _ZN5boost12_GLOBAL__N_112thread_proxyEPv + 136
17 libsystem_pthread.dylib 0x00007fff6daeee65 _pthread_start + 148
18 libsystem_pthread.dylib 0x00007fff6daea83b thread_start + 15
Traceback (most recent call last):
File "/tmp/redex.T873nV/redex.py", line 1146, in
run_redex(args)
File "/tmp/redex.T873nV/redex.py", line 1124, in run_redex
run_redex_binary(state)
File "/tmp/redex.T873nV/redex.py", line 448, in run_redex_binary
if run():
File "/tmp/redex.T873nV/redex.py", line 433, in run
).format(returncode, gdb_script_name, lldb_script_name)
RuntimeError: redex-all crashed with exit code -6! You can re-run it under gdb by running /tmp/redex.T873nV/redex-gdb-c6ipb0my.sh or under lldb by running /tmp/redex.T873nV/redex-lldb-w254lpt0.sh

Kindly let me know if this is a known bug or if there's a workaround i can use?

Thanks,

[helloguo]

The exception happens in function file_name_from_method_string. The function is supposed to return the file name. Maybe you can print out the method name const auto& s to see if anything weird happens there.

[amiton]

@helloguo Thanks for the quick response.

It seems that the failing assertion is when
s = L$r8$java8methods$utility$Boolean$hashCode$IZ;.hashCode:(Z)I

I'm assuming this is because the code might be searching for "/" which doesn't exist?

Thanks,

[amiton]

@helloguo I think the fix should be changing code lines 354-355 in libredex/ProguardMap.cpp to the following:

always_assert(end != std::string::npos);
  ++start; // Skip over the "/" OR go to 0 if there was no "/" which might happen in cases like java8 classes (example: "L$r8$java8methods$utility$Boolean$hashCode$IZ;.hashCode:(Z)I")

Kindly let me know what you think?

[helloguo]

I assume this method is auto generated by r8? cc @justinjhendrick who is familiar with d8/r8.

[justinjhendrick]

Yes, L$r8$java8methods$utility$Boolean$hashCode$IZ;.hashCode:(Z)I is generated by d8. It doesn't have a source file associated with it, so I think we shouldn't be calling file_name_from_method_string on it at all.