[GH-ISSUE #3443] [Bug] inspect_android_method reports an inlined Java method as "native/abstract" with no body #1286

New issue

Closed

opened 2026-10-16 21:03:46 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:03:46 +00:00

Owner

Originally created by @Rinkia on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3443

Before submitting

I searched the open and closed issues for a related report. #1846 (fixed by #1876) covers the same placeholder for <clinit> only; this report is about ordinary methods that JADX inlines.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

For an ordinary, concrete private method, inspect_android_method returns:

body_status: not_available
markers: []
source.text: // method exists but has no decompiled body (native/abstract)

The method is neither native nor abstract. JADX's inline-methods pass merged its body into its only caller, a synthetic lambda, and renamed that lambda after it. REA labels the empty result "native/abstract" and gives no pointer to where the body went. An agent reading this would conclude the code is unavailable, or native, and stop or look in the wrong place.

Reproduction

Public APK: F-Droid org.billthefarmer.editor versionCode 198 (https://f-droid.org/repo/org.billthefarmer.editor_198.apk, sha256 343d17e11d0914e1a7708df2781580a0413e52501c0a41d91f7ef725d9615fe9).

rea inspect-android-method /targets/editor.apk org.billthefarmer.editor.Editor highlightText --format json

Result: body_status: not_available with the placeholder text above. overload_count: 1. Reproduced twice.

Supporting observations:

rea inspect-android-class ... Editor lists highlightText(): void (overload index 0) and m0lambda$checkHighlight$20$orgbillthefarmereditorEditor(): void.
rea trace-android-references ... Editor --method-name highlightText reports one reference, from m0lambda$checkHighlight$20$orgbillthefarmereditorEditor, coverage: complete.

rea inspect-android-method ... Editor 'm0lambda$checkHighlight$20$orgbillthefarmereditorEditor' returns body_status: available, starting with:

/* JADX INFO: renamed from: highlightText, reason: merged with bridge method [inline-methods] */
public void m0lambda$checkHighlight$20$orgbillthefarmereditorEditor() {
    int scrollY = this.scrollView.getScrollY();

Stock JADX 1.5.6 CLI (jadx --single-class org.billthefarmer.editor.Editor) behaves the same: the only highlightText occurrence is that renamed from comment, and the body sits in the lambda.
The app's source at tag v1.98 declares private void highlightText() as an ordinary Java method (src/main/java/org/billthefarmer/editor/Editor.java:2568). The word native doesn't appear in that file.

Expected behavior

Don't describe the method as native/abstract unless its access flags say so.
Return usable evidence for the selected method. Either:
- return its own body from original bytecode (smali), as #1876 does for <clinit>, or
- report that JADX inlined it and name the method that now holds the body (here m0lambda$checkHighlight$20$orgbillthefarmereditorEditor), with a marker distinct from "native/abstract" and from "genuinely unavailable".

Impact and scope

Affects any method that JADX's inline-methods pass merges into a synthetic or bridge caller. Lambdas whose only job is to call one private method are common in Android apps.
Observed impact: while tracing a feature, REA reported the method that actually does the work (syntax highlighting here) as having no body. I found it only by inspecting the caller manually.
Source-derived, not runtime-verified, on current main: src/android/JadxAnalysis.ts still maps this placeholder string to body_status: not_available, and #1876's bridge change routes only <clinit>()V to smali. So I expect current main to behave the same, but I only ran 6.4.0.
Frequency: deterministic for this method (2/2 runs).

REA version

rea-agents@6.4.0 (npm). #1876 isn't in 6.4.0, but it doesn't touch non-<clinit> methods.

Runtime and platform

Linux x64 Docker container (Ubuntu 24.04) on Windows 11 / Docker Desktop. Node 24.21.0, JDK 21.0.12, jadx-headless-mcp 0.7.1 (sha256 6e5eacf5…).

Target and artifact context

Public F-Droid APK listed above. No private samples.

Interface

CLI (the MCP tool inspect_android_method shares the same workflow; MCP not separately run for this case).

Relevant output or evidence

{"class_name":"org.billthefarmer.editor.Editor","method":{"name":"highlightText","reported_signature":"highlightText(): void","overload_index":0},"overload_count":1,"representation":"java","body_status":"not_available","fell_back":false,"markers":[],"source":{"status":"complete","text":"// method exists but has no decompiled body (native/abstract)"}}

Note: source.status is complete while body_status is not_available. That combination may also deserve a look.

Originally created by @Rinkia on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3443 ### Before submitting - [x] I searched the open and closed issues for a related report. #1846 (fixed by #1876) covers the same placeholder for `<clinit>` only; this report is about ordinary methods that JADX inlines. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior For an ordinary, concrete private method, `inspect_android_method` returns: ```text body_status: not_available markers: [] source.text: // method exists but has no decompiled body (native/abstract) ``` The method is neither native nor abstract. JADX's `inline-methods` pass merged its body into its only caller, a synthetic lambda, and renamed that lambda after it. REA labels the empty result "native/abstract" and gives no pointer to where the body went. An agent reading this would conclude the code is unavailable, or native, and stop or look in the wrong place. ### Reproduction Public APK: F-Droid `org.billthefarmer.editor` versionCode 198 (`https://f-droid.org/repo/org.billthefarmer.editor_198.apk`, sha256 `343d17e11d0914e1a7708df2781580a0413e52501c0a41d91f7ef725d9615fe9`). ```bash rea inspect-android-method /targets/editor.apk org.billthefarmer.editor.Editor highlightText --format json ``` Result: `body_status: not_available` with the placeholder text above. `overload_count: 1`. Reproduced twice. Supporting observations: 1. `rea inspect-android-class ... Editor` lists `highlightText(): void` (overload index 0) and `m0lambda$checkHighlight$20$orgbillthefarmereditorEditor(): void`. 2. `rea trace-android-references ... Editor --method-name highlightText` reports one reference, from `m0lambda$checkHighlight$20$orgbillthefarmereditorEditor`, `coverage: complete`. 3. `rea inspect-android-method ... Editor 'm0lambda$checkHighlight$20$orgbillthefarmereditorEditor'` returns `body_status: available`, starting with: ```java /* JADX INFO: renamed from: highlightText, reason: merged with bridge method [inline-methods] */ public void m0lambda$checkHighlight$20$orgbillthefarmereditorEditor() { int scrollY = this.scrollView.getScrollY(); ``` 4. Stock JADX 1.5.6 CLI (`jadx --single-class org.billthefarmer.editor.Editor`) behaves the same: the only `highlightText` occurrence is that `renamed from` comment, and the body sits in the lambda. 5. The app's source at tag `v1.98` declares `private void highlightText()` as an ordinary Java method (`src/main/java/org/billthefarmer/editor/Editor.java:2568`). The word `native` doesn't appear in that file. ### Expected behavior - Don't describe the method as native/abstract unless its access flags say so. - Return usable evidence for the selected method. Either: - return its own body from original bytecode (smali), as #1876 does for `<clinit>`, or - report that JADX inlined it and name the method that now holds the body (here `m0lambda$checkHighlight$20$orgbillthefarmereditorEditor`), with a marker distinct from "native/abstract" and from "genuinely unavailable". ### Impact and scope - Affects any method that JADX's `inline-methods` pass merges into a synthetic or bridge caller. Lambdas whose only job is to call one private method are common in Android apps. - Observed impact: while tracing a feature, REA reported the method that actually does the work (syntax highlighting here) as having no body. I found it only by inspecting the caller manually. - Source-derived, not runtime-verified, on current `main`: `src/android/JadxAnalysis.ts` still maps this placeholder string to `body_status: not_available`, and #1876's bridge change routes only `<clinit>()V` to smali. So I expect current `main` to behave the same, but I only ran 6.4.0. - Frequency: deterministic for this method (2/2 runs). ### REA version `rea-agents@6.4.0` (npm). #1876 isn't in 6.4.0, but it doesn't touch non-`<clinit>` methods. ### Runtime and platform Linux x64 Docker container (Ubuntu 24.04) on Windows 11 / Docker Desktop. Node 24.21.0, JDK 21.0.12, `jadx-headless-mcp` 0.7.1 (sha256 `6e5eacf5…`). ### Target and artifact context Public F-Droid APK listed above. No private samples. ### Interface CLI (the MCP tool `inspect_android_method` shares the same workflow; MCP not separately run for this case). ### Relevant output or evidence ```json {"class_name":"org.billthefarmer.editor.Editor","method":{"name":"highlightText","reported_signature":"highlightText(): void","overload_index":0},"overload_count":1,"representation":"java","body_status":"not_available","fell_back":false,"markers":[],"source":{"status":"complete","text":"// method exists but has no decompiled body (native/abstract)"}} ``` Note: `source.status` is `complete` while `body_status` is `not_available`. That combination may also deserve a look.

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:10:00 +00:00

[PR #1286] [MERGED] fix(electron): resolve effective preload after option overrides #2767

bsakaguchi referenced this issue

2026-10-17 21:10:04 +00:00

[PR #1294] [MERGED] test(process): check malformed capture choices concurrently #2774

bsakaguchi closed this issue

2026-10-31 00:30:27 +00:00