fix(DexFactory): register injected proxy dex with a single class loader

Injecting a generated proxy into the app's PathClassLoader by opening it
through a temporary DexClassLoader and splicing its dex element left the
same DexFile claimed by two class loaders. ART rejects this
unconditionally ("Attempt to register dex file ... with multiple class
loaders"), but the second registration only materializes on
non-debuggable builds, so release apps crashed on the first
runtime-generated proxy while debug builds worked.

Use BaseDexClassLoader.addDexPath (API 24+) on the target class loader
instead. The dex element is built through the loader's own DexPathList
with that loader as defining context, so the DexFile is registered
exactly once. On API < 24, or if injection fails, fall back to the
isolated DexClassLoader path (pre-#1951 behavior) instead of failing the
subsequent loadClass with ClassNotFoundException.

Adds tests covering the original FragmentFactory scenario: proxies
generated at runtime (hidden from the static binding generator) must be
resolvable via Class.forName through the app's class loader.

Fixes #1962

Refs #1951

Author: edusperoni

test-app/app/src/main/assets/app/mainpage.js

@@ -50,6 +50,7 @@ require("./tests/java-array-test");
 require("./tests/field-access-test");
 require("./tests/byte-buffer-test");
 require("./tests/dex-interface-implementation");
+require("./tests/testClassForNameDiscovery");
 require("./tests/testInterfaceImplementation");
 require("./tests/testRuntimeImplementedAPIs");
 require("./tests/testsInstanceOfOperator");

test-app/app/src/main/assets/app/tests/testClassForNameDiscovery.js

@@ -0,0 +1,78 @@
+describe("Tests Class.forName discovery of runtime generated classes", function () {
+
+    // Android framework components (e.g. FragmentFactory) resolve classes with
+    // Class.forName(className, false, context.getClassLoader()). Runtime generated
+    // proxies must be discoverable through the app's class loader, otherwise
+    // framework lookups crash with ClassNotFoundException (see issue #1962 / PR #1951).
+    //
+    // The extend calls below are built dynamically so the static binding generator
+    // cannot pre-generate the proxies and DexFactory.resolveClass takes the runtime
+    // generation + parent class loader injection path.
+    var ext = "ex" + "tend";
+
+    // dex injection into the parent class loader requires BaseDexClassLoader.addDexPath (API 24+)
+    var supportsInjection = android.os.Build.VERSION.SDK_INT >= 24;
+    // the same class loader the framework uses, e.g. in FragmentFactory.loadFragmentClass
+    var appClassLoader = com.tns.Runtime.getCurrentRuntime().getContext().getClassLoader();
+
+    it("When_extending_a_class_at_runtime_it_should_be_discoverable_through_the_app_class_loader", function () {
+        if (!supportsInjection) {
+            return;
+        }
+
+        var MyObject = java.lang.Object[ext]("ClassForNameDiscoveryObject", {
+            toString: function () {
+                return "discoverable";
+            }
+        });
+
+        var instance = new MyObject();
+        var className = instance.getClass().getName();
+
+        var found = java.lang.Class.forName(className, false, appClassLoader);
+
+        expect(found.getName()).toBe(className);
+        expect(found.equals(instance.getClass())).toBe(true);
+    });
+
+    it("When_implementing_an_interface_at_runtime_it_should_be_discoverable_through_the_app_class_loader", function () {
+        if (!supportsInjection) {
+            return;
+        }
+
+        var MyRunnable = java.lang.Runnable[ext]("ClassForNameDiscoveryRunnable", {
+            run: function () {
+            }
+        });
+
+        var instance = new MyRunnable();
+        var className = instance.getClass().getName();
+
+        var found = java.lang.Class.forName(className, false, appClassLoader);
+
+        expect(found.getName()).toBe(className);
+        expect(found.equals(instance.getClass())).toBe(true);
+    });
+
+    it("When_a_runtime_generated_class_is_instantiated_through_reflection_it_should_dispatch_to_the_JS_implementation", function () {
+        if (!supportsInjection) {
+            return;
+        }
+
+        var MyObject = java.lang.Object[ext]("ClassForNameDiscoveryInstantiated", {
+            toString: function () {
+                return "created via reflection";
+            }
+        });
+
+        // make sure the implementation object is registered before Java constructs an instance
+        var instance = new MyObject();
+        var className = instance.getClass().getName();
+
+        // FragmentFactory resolves the class by name and instantiates it through reflection
+        var found = java.lang.Class.forName(className, false, appClassLoader);
+        var created = found.getDeclaredConstructor().newInstance();
+
+        expect(created.toString()).toBe("created via reflection");
+    });
+});

test-app/runtime/src/main/java/com/tns/DexFactory.java

@@ -1,5 +1,6 @@
 package com.tns;
 
+import android.os.Build;
 import android.util.Log;
 
 import com.tns.bindings.AnnotationDescriptor;
@@ -18,8 +19,7 @@
 import java.io.InputStreamReader;
 import java.io.InvalidClassException;
 import java.io.OutputStreamWriter;
-import java.lang.reflect.Array;
-import java.lang.reflect.Field;
+import java.lang.reflect.Method;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.zip.ZipEntry;
@@ -166,13 +166,19 @@ public Class<?> resolveClass(String baseClassName, String name, String className
         }
         jarFile.setReadOnly();
 
-        Class<?> result;
+        Class<?> result = null;
         String classNameToLoad = isInterface ? fullClassName : desiredDexClassName;
 
-        if (injectIntoParentClassLoader && classLoader instanceof BaseDexClassLoader) {
-            injectDexIntoClassLoader((BaseDexClassLoader) classLoader, jarFilePath);
-            result = classLoader.loadClass(classNameToLoad);
-        } else {
+        if (injectIntoParentClassLoader && classLoader instanceof BaseDexClassLoader
+                && injectDexIntoClassLoader((BaseDexClassLoader) classLoader, jarFilePath)) {
+            try {
+                result = classLoader.loadClass(classNameToLoad);
+            } catch (ClassNotFoundException e) {
+                // fall through to the isolated DexClassLoader below
+            }
+        }
+
+        if (result == null) {
             DexClassLoader dexClassLoader = new DexClassLoader(jarFilePath, this.odexDir.getAbsolutePath(), null, classLoader);
             result = dexClassLoader.loadClass(classNameToLoad);
         }
@@ -389,40 +395,31 @@ private String getCachedProxyThumb(File proxyDir) {
      * (e.g. FragmentFactory) use Class.forName() to instantiate classes by name, but
      * NativeScript's dynamically-generated classes normally live in isolated DexClassLoaders
      * that Class.forName() doesn't search.
+     *
+     * The jar must be added through the target class loader's own DexPathList so that
+     * the resulting DexFile has the PathClassLoader as its only owner. Opening the jar
+     * through a separate DexClassLoader first and splicing its dex element would leave
+     * the same DexFile claimed by two loaders, which ART rejects on non-debuggable
+     * builds with "Attempt to register dex file ... with multiple class loaders".
+     *
+     * @return true if the jar was injected and the class can be loaded through the
+     *         target class loader, false if the caller should fall back to an
+     *         isolated DexClassLoader.
      */
-    private void injectDexIntoClassLoader(BaseDexClassLoader targetClassLoader, String jarFilePath) {
-        try {
-            // Create a temporary DexClassLoader to produce the optimized dex
-            DexClassLoader tempLoader = new DexClassLoader(jarFilePath, this.odexDir.getAbsolutePath(), null, targetClassLoader);
-
-            // Get pathList from both classloaders
-            Field pathListField = BaseDexClassLoader.class.getDeclaredField("pathList");
-            pathListField.setAccessible(true);
-
-            Object targetPathList = pathListField.get(targetClassLoader);
-            Object sourcePathList = pathListField.get(tempLoader);
-
-            // Get dexElements from both pathLists
-            Field dexElementsField = targetPathList.getClass().getDeclaredField("dexElements");
-            dexElementsField.setAccessible(true);
-
-            Object targetElements = dexElementsField.get(targetPathList);
-            Object sourceElements = dexElementsField.get(sourcePathList);
-
-            int targetLen = Array.getLength(targetElements);
-            int sourceLen = Array.getLength(sourceElements);
-
-            // Create merged array: target + source
-            Object merged = Array.newInstance(targetElements.getClass().getComponentType(), targetLen + sourceLen);
-            System.arraycopy(targetElements, 0, merged, 0, targetLen);
-            System.arraycopy(sourceElements, 0, merged, targetLen, sourceLen);
+    private boolean injectDexIntoClassLoader(BaseDexClassLoader targetClassLoader, String jarFilePath) {
+        // BaseDexClassLoader.addDexPath exists since API 24
+        if (Build.VERSION.SDK_INT < 24) {
+            return false;
+        }
 
-            dexElementsField.set(targetPathList, merged);
+        try {
+            Method addDexPath = BaseDexClassLoader.class.getDeclaredMethod("addDexPath", String.class);
+            addDexPath.setAccessible(true);
+            addDexPath.invoke(targetClassLoader, jarFilePath);
+            return true;
         } catch (Exception e) {
-            if (logger.isEnabled()) {
-                logger.write("Failed to inject dex into parent classloader: " + e.getMessage());
-            }
-            // Non-fatal: class will still be loadable via the ClassStorageService fallback
+            Log.w("JS", "Failed to inject dex into parent classloader: " + e);
+            return false;
         }
     }
 }