[GH-ISSUE #901] fix(android): avoid eager JADX code generation and retain owned APK sessions #365

New issue

Closed

opened 2026-10-15 18:24:19 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:24:19 +00:00

Owner

Originally created by @morluto on GitHub (Oct 7, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/901

Originally assigned to: @N0zoM1z0 on GitHub.

Track the JADX MCP integration fixes identified while investigating #893. @n0z0m1z0, tagging you for the engine integration and metadata boundary review; the producer report and standalone public-fixture reproducer are in jadx-headless-mcp#39.

Confirmed causes

REA overrides caller heap settings: JadxProvider passes -Xmx512m and replaces _JAVA_OPTIONS with another 512 MiB cap plus ActiveProcessorCount=1. A real JVM probe confirms that inherited JAVA_TOOL_OPTIONS=-Xmx8g still results in a 512 MiB heap. This is a REA defect, independent of upstream behavior.
Each Android request copies and verifies the inputs, starts a new JVM, loads the APK, performs one operation, and destroys warmed engine state. Related navigation therefore repeats APK loading and cold decompilation.
Upstream v0.7.1's class resolver builds allClasses by reading JavaClass.innerClasses, which triggers code generation. On the public ApiDemos fixture, one exact class lookup changes all 2,876 top-level classes from NOT_LOADED to processed states before the summary timeout starts. Summary getters also materialize code. The upstream report includes pinned source links and a runnable reproducer.
Complete class search issues sequential pages of 200; upstream pagination walks the skipped prefix again for each page.

Implementation direction

Preserve caller JVM options, add validated explicit heap/processor configuration, keep the single JADX analysis worker separate from JVM CPU/GC controls, and report the actual effective heap in Evidence.
Use a REA-owned metadata bridge against the audited JAR without modifying vendored upstream source. Build class/member inventories from parsed metadata; preserve exact class selection, stable overload identity, and explicit unknown source positions. Decompile only for explicit source/body requests.
Retain one serialized, owned session bound to immutable APK, engine, and launch configuration identities. Clean up on idle expiry, target/configuration switch, cancellation, disconnect, and shutdown. Failed or uncertain cleanup must block replacements; Evidence and output budgets must remain scoped to each operation.
Use indexed pagination and reuse a complete validated inventory while preserving case-sensitive search semantics, duplicate/total checks, completeness reporting, and transport byte limits.

Acceptance

A real launched JVM honors caller heap configuration; malformed options fail before launch; CLI/MCP report consistent effective runtime metadata.
Related operations reuse one engine session, with unchanged artifact-bound results. Changed inputs cannot reuse stale state. Cancellation, target switching, disconnect, and shutdown leave no owned process/workspace behind, and cleanup failure remains actionable.
Metadata-only lookup/summary does not invoke code generation; explicit method/source requests still work with stable overload selection after code generation.
Large inventories remain complete with unchanged mixed-case query results; per-operation budgets and raw Evidence do not accumulate prior request data.
Run focused configuration, protocol, lifecycle, CLI/MCP and graph regressions, plus the real Android verification lane and before/after profiling on the public fixture. Implementation and review are in progress; this issue does not claim a completed fix or PR.

The reporter's private 133 MB / 11 DEX APK is unavailable. Its required heap and end-to-end fix remain unverified. Linux/OpenJDK 25 coverage is also unverified; current real-provider evidence is macOS arm64/OpenJDK 21. No OpenJDK defect is established.

Originally created by @morluto on GitHub (Oct 7, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/901 Originally assigned to: @N0zoM1z0 on GitHub. Track the JADX MCP integration fixes identified while investigating #893. @n0z0m1z0, tagging you for the engine integration and metadata boundary review; the producer report and standalone public-fixture reproducer are in [jadx-headless-mcp#39](https://github.com/1013503897/jadx-headless-mcp/issues/39). ## Confirmed causes - REA overrides caller heap settings: `JadxProvider` passes `-Xmx512m` and replaces `_JAVA_OPTIONS` with another 512 MiB cap plus `ActiveProcessorCount=1`. A real JVM probe confirms that inherited `JAVA_TOOL_OPTIONS=-Xmx8g` still results in a 512 MiB heap. This is a REA defect, independent of upstream behavior. - Each Android request copies and verifies the inputs, starts a new JVM, loads the APK, performs one operation, and destroys warmed engine state. Related navigation therefore repeats APK loading and cold decompilation. - Upstream v0.7.1's class resolver builds `allClasses` by reading `JavaClass.innerClasses`, which triggers code generation. On the public ApiDemos fixture, one exact class lookup changes all 2,876 top-level classes from `NOT_LOADED` to processed states before the summary timeout starts. Summary getters also materialize code. The upstream report includes pinned source links and a runnable reproducer. - Complete class search issues sequential pages of 200; upstream pagination walks the skipped prefix again for each page. ## Implementation direction - Preserve caller JVM options, add validated explicit heap/processor configuration, keep the single JADX analysis worker separate from JVM CPU/GC controls, and report the actual effective heap in Evidence. - Use a REA-owned metadata bridge against the audited JAR without modifying vendored upstream source. Build class/member inventories from parsed metadata; preserve exact class selection, stable overload identity, and explicit unknown source positions. Decompile only for explicit source/body requests. - Retain one serialized, owned session bound to immutable APK, engine, and launch configuration identities. Clean up on idle expiry, target/configuration switch, cancellation, disconnect, and shutdown. Failed or uncertain cleanup must block replacements; Evidence and output budgets must remain scoped to each operation. - Use indexed pagination and reuse a complete validated inventory while preserving case-sensitive search semantics, duplicate/total checks, completeness reporting, and transport byte limits. ## Acceptance - A real launched JVM honors caller heap configuration; malformed options fail before launch; CLI/MCP report consistent effective runtime metadata. - Related operations reuse one engine session, with unchanged artifact-bound results. Changed inputs cannot reuse stale state. Cancellation, target switching, disconnect, and shutdown leave no owned process/workspace behind, and cleanup failure remains actionable. - Metadata-only lookup/summary does not invoke code generation; explicit method/source requests still work with stable overload selection after code generation. - Large inventories remain complete with unchanged mixed-case query results; per-operation budgets and raw Evidence do not accumulate prior request data. - Run focused configuration, protocol, lifecycle, CLI/MCP and graph regressions, plus the real Android verification lane and before/after profiling on the public fixture. Implementation and review are in progress; this issue does not claim a completed fix or PR. The reporter's private 133 MB / 11 DEX APK is unavailable. Its required heap and end-to-end fix remain unverified. Linux/OpenJDK 25 coverage is also unverified; current real-provider evidence is macOS arm64/OpenJDK 21. No OpenJDK defect is established. Related: #893; [upstream jadx-headless-mcp#39](https://github.com/1013503897/jadx-headless-mcp/issues/39).

bsakaguchi

2026-10-15 18:24:19 +00:00

closed this issue
added the
area: runtime

bug
labels

bsakaguchi referenced this issue

2026-10-16 21:13:12 +00:00

[PR #448] [MERGED] feat(protocol): add custom TCP/UDP/IPC/XPC and auth-flow capture #1997

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#365

No description provided.

Rows
Columns