[Bug] Spawning a target app with Frida attached crashes ART with "method_index < num_methods_" when Vector has a hook on Application.onCreate

Bắt đầu với repo tái hiện tối thiểu được liên kết và chạy Vector hook, script đã biên dịch cùng chuỗi frida -U -f com.hello.world -l bundle.js được ghi lại trên thiết lập Android đã nêu. So sánh các crash log với trường hợp hook Application.onCreate bị vô hiệu hóa, sau đó xác minh rằng Java.perform hoàn tất mà không xảy ra ART abort trong khi hook vẫn đang hoạt động.

Steps to reproduce/复现步骤

Minimal reproduction repo: https://github.com/staleroot/frida-crash-module

1. Install the module from the repo above on a device with Vector active.
   The module only installs this hook, nothing else:

   hook(Class.forName("android.app.Application").getMethod("onCreate")).intercept { chain ->
       chain.proceed()
   }

2. Save this script as script.js:

import Java from "frida-java-bridge";

setTimeout(() => {
    console.log("Hello");

    Java.perform(() => {
        console.log("Inside Java.perform"); // This line is never reached
    });
}, 2000);

then

frida-compile script.js -o bundle.js

3. Spawn the target app with Frida attached and this script loaded:

frida -U -f com.hello.world -l bundle.js

frida version: 17.18.0
frida-java-bridge version: 7.0.13
frida-compile version: 19.0.5

4. The process crashes before the Java.perform callback runs — the
   "hello" log line is printed, but "Inside Java.perform" is never printed.
   Only "Hello" appears, then the process aborts.

5. If the Application.onCreate hook from step 1 is removed (module
   uninstalled/disabled), the exact same Frida command and script run fine,
   and "does not get called" prints normally (i.e. Java.perform succeeds).

Expected behaviour/预期行为

Frida should be able to spawn/attach and call Java.perform normally, even
while Vector has a hook installed on Application.onCreate.

Actual behaviour/实际行为

2026-09-18 03:08:08.335 tchapp.helloworld           com...app.helloworld Openjdkjvmti plugin was loaded on a non-debuggable Runtime. Plugin was loaded too late to change runtime state to support all capabilities. Only kArtTiVersion (0x70010200) environments are available. Some functionality might not work properly.
2026-09-18 03:08:08.521 tchapp.helloworld           com...app.helloworld oat_file.cc:2535] Check failed: method_index < num_methods_ (method_index=275, num_methods_=42) /system/framework/arm64/boot-framework.oat
2026-09-18 03:08:08.662 tchapp.helloworld           com...app.helloworld runtime.cc:714] Runtime aborting...
runtime.cc:714] Skipping all-threads dump as mutator lock is exclusively held.Aborting thread:
runtime.cc:714] "Thread-2" prio=5 tid=9 Native
runtime.cc:714]   | group="" sCount=0 ucsCount=0 flags=64 obj=0x0 self=0xb4000073cea6d3f0
runtime.cc:714]   | sysTid=17564 nice=0 cgrp=default sched=0/0 handle=0x72143fb2c0
runtime.cc:714]   | state=R schedstat=( 484357905 10645360 136 ) utm=20 stm=27 core=3 HZ=100
runtime.cc:714]   | stack=0x7214304000-0x7214306000 stackSize=988KB
runtime.cc:714]   | held mutexes= "abort lock" "Class loader classes"(shared held) "ClassLinker classes lock"(shared held) "mutator lock"(exclusive held)
runtime.cc:714]   native: #00 pc 00447800  /apex/com.android.art/lib64/libart.so (art::DumpNativeStack+112) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #01 pc 00541e5c  /apex/com.android.art/lib64/libart.so (art::Thread::DumpStack const+204) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #02 pc 00931838  /apex/com.android.art/lib64/libart.so (art::Thread::DumpStack const+104) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #03 pc 00925de8  /apex/com.android.art/lib64/libart.so (art::AbortState::DumpThread const+56) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #04 pc 0092206c  /apex/com.android.art/lib64/libart.so (art::Runtime::Abort+1084) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #05 pc 00014db0  /apex/com.android.art/lib64/libbase.so (android::base::SetAborter::$_0::__invoke+80) (BuildId: 01f56bead4468a24561430f970f06de2)
runtime.cc:714]   native: #06 pc 00014250  /apex/com.android.art/lib64/libbase.so (android::base::LogMessage::~LogMessage+544) (BuildId: 01f56bead4468a24561430f970f06de2)
runtime.cc:714]   native: #07 pc 005b1b18  /apex/com.android.art/lib64/libart.so (art::OatFile::OatClass::GetOatMethodOffsets const+1224) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #08 pc 0022ad68  /apex/com.android.art/lib64/libart.so (art::FindOatMethodFor +200) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #09 pc 0054fa44  /apex/com.android.art/lib64/libart.so (art::ArtMethod::GetOatMethodQuickCode+52) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #10 pc 007ff8cc  /apex/com.android.art/lib64/libart.so (art::instrumentation::Instrumentation::GetOptimizedCodeFor+76) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #11 pc 007ff76c  /apex/com.android.art/lib64/libart.so (art::instrumentation::Instrumentation::InstallStubsForMethod+300) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #12 pc 005c43bc  /apex/com.android.art/lib64/libart.so (art::instrumentation::Instrumentation::InstallStubsForClass+140) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #13 pc 0080223c  /apex/com.android.art/lib64/libart.so (art::instrumentation::InstallStubsClassVisitor::operator+12) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #14 pc 00612e5c  /apex/com.android.art/lib64/libart.so (bool art::ClassTable::Visit<0, art::VisitClassLoaderClassesVisitor::DefiningClassLoaderFilterVisitor>+204) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #15 pc 00612d70  /apex/com.android.art/lib64/libart.so (art::VisitClassLoaderClassesVisitor::Visit+112) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #16 pc 00396758  /apex/com.android.art/lib64/libart.so (art::ClassLinker::VisitClassLoaders const+104) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #17 pc 004b7514  /apex/com.android.art/lib64/libart.so (art::ClassLinker::VisitClassesInternal+1172) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #18 pc 004b6e9c  /apex/com.android.art/lib64/libart.so (art::ClassLinker::VisitClasses+124) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
2026-09-18 03:08:08.662 tchapp.helloworld           com...app.helloworld runtime.cc:714]   native: #19 pc 007ffb8c  /apex/com.android.art/lib64/libart.so (art::instrumentation::Instrumentation::UpdateEntrypointsForDebuggable+60) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #20 pc 0002f560  /apex/com.android.art/lib64/libopenjdkjvmti.so (openjdkjvmti::DeoptManager::FinishSetup+336) (BuildId: fdfe1c687dfb83aeced7ca2a67feff78)
runtime.cc:714]   native: #21 pc 0004a3ec  /apex/com.android.art/lib64/libopenjdkjvmti.so (ArtPlugin_Initialize+252) (BuildId: fdfe1c687dfb83aeced7ca2a67feff78)
runtime.cc:714]   native: #22 pc 003fdd78  /apex/com.android.art/lib64/libart.so (art::Plugin::Load+104) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #23 pc 003fdb38  /apex/com.android.art/lib64/libart.so (art::Runtime::EnsurePluginLoaded+216) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #24 pc 00b0105c  /memfd:frida-agent-64.so (deleted) (???)
runtime.cc:714]   native: #25 pc 00b00b04  /memfd:frida-agent-64.so (deleted) (???)
runtime.cc:714]   native: #26 pc 009d2fd4  /memfd:frida-agent-64.so (deleted) (???)
runtime.cc:714]   native: #27 pc 009d2b98  /memfd:frida-agent-64.so (deleted) (???)
runtime.cc:714]   native: #60 pc 00b2814c  /memfd:frida-agent-64.so (deleted) (???)
2026-09-18 03:08:08.662 tchapp.helloworld           com...app.helloworld runtime.cc:714]   native: #61 pc 000877dc  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start +236) (BuildId: 30ed8d12b73f97af114ffd98e0d4f2e7)
runtime.cc:714]   native: #62 pc 000785c0  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 30ed8d12b73f97af114ffd98e0d4f2e7)
runtime.cc:714]   (no managed stack frames)
runtime.cc:714] 

Error: abort was called
    at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1)
    at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1)
    at fc (D:\projects\test\app\src\main\assets\scripts\script.js:1)
    at get (D:\projects\test\app\src\main\assets\scripts\script.js:1)
    at dd (D:\projects\test\app\src\main\assets\scripts\script.js:1874)
    at No (D:\projects\test\app\src\main\assets\scripts\script.js:1874)
    at build (D:\projects\test\app\src\main\assets\scripts\script.js:1874)
    at _make (D:\projects\test\app\src\main\assets\scripts\script.js:1875)
    at use (D:\projects\test\app\src\main\assets\scripts\script.js:1875)
    at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1884)
    at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1)
    at _performPendingVmOpsWhenReady (D:\projects\test\app\src\main\assets\scripts\script.js:1884)
    at perform (D:\projects\test\app\src\main\assets\scripts\script.js:1884)
    at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1884)
    at apply (native)
    at <anonymous> (/frida/runtime/core.js:55)

Observation

I've reproduced this same abort signature (method_index < num_methods_)
across multiple different apps and different hooked methods, always with
method_index=275, while num_methods_ varies (5, 42, ...) depending on
the class involved. The crash only happens when both of these are true:

1. Vector has an active hook on some method in the process
   (in this specific repro: Application.onCreate).
2. Frida performs Java.perform in that same process.

Neither condition alone causes a crash.

Xposed Module List/Xposed 模块列表

https://github.com/staleroot/frida-crash-module

Root implementation/Root 方案

Magisk 30.7, Vector 2.2 (3111) API 102

System Module List/系统模块列表

https://github.com/staleroot/frida-crash-module

Vector version/Vector 版本

2.2 (3111)

Android version/Android 版本

16 (API 36.1) LineageOS 23.2-20260830-NIGHTLY-davinci

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

logs.zip