[Bug] Spawning a target app with Frida attached crashes ART with "method_index < num_methods_" when Vector has a hook on Application.onCreate

从链接的最小复现仓库开始，在所述的 Android 设置上运行文档中记录的 Vector hook、编译后的脚本以及 frida -U -f com.hello.world -l bundle.js 序列。将崩溃日志与禁用 Application.onCreate hook 时的情况进行比较，然后验证在 hook 保持活动的情况下，Java.perform 能够完成且不会发生 ART abort。

Steps to reproduce/复现步骤

Minimal reproduction repo: https://github.com/staleroot/frida-crash-module

1. Install the module from the repo above on a device with Vector active.
   The module only installs this hook, nothing else:

   hook(Class.forName("android.app.Application").getMethod("onCreate")).intercept { chain ->
       chain.proceed()
   }

2. Save this script as script.js:

import Java from "frida-java-bridge";

setTimeout(() => {
    console.log("Hello");

    Java.perform(() => {
        console.log("Inside Java.perform"); // This line is never reached
    });
}, 2000);

then

frida-compile script.js -o bundle.js

3. Spawn the target app with Frida attached and this script loaded:

frida -U -f com.hello.world -l bundle.js

frida version: 17.18.0
frida-java-bridge version: 7.0.13
frida-compile version: 19.0.5

4. The process crashes before the Java.perform callback runs — the
   "hello" log line is printed, but "Inside Java.perform" is never printed.
   Only "Hello" appears, then the process aborts.

5. If the Application.onCreate hook from step 1 is removed (module
   uninstalled/disabled), the exact same Frida command and script run fine,
   and "does not get called" prints normally (i.e. Java.perform succeeds).

Expected behaviour/预期行为

Frida should be able to spawn/attach and call Java.perform normally, even
while Vector has a hook installed on Application.onCreate.

Actual behaviour/实际行为

2026-09-18 03:08:08.335 tchapp.helloworld           com...app.helloworld Openjdkjvmti plugin was loaded on a non-debuggable Runtime. Plugin was loaded too late to change runtime state to support all capabilities. Only kArtTiVersion (0x70010200) environments are available. Some functionality might not work properly.
2026-09-18 03:08:08.521 tchapp.helloworld           com...app.helloworld oat_file.cc:2535] Check failed: method_index < num_methods_ (method_index=275, num_methods_=42) /system/framework/arm64/boot-framework.oat
2026-09-18 03:08:08.662 tchapp.helloworld           com...app.helloworld runtime.cc:714] Runtime aborting...
runtime.cc:714] Skipping all-threads dump as mutator lock is exclusively held.Aborting thread:
runtime.cc:714] "Thread-2" prio=5 tid=9 Native
runtime.cc:714]   | group="" sCount=0 ucsCount=0 flags=64 obj=0x0 self=0xb4000073cea6d3f0
runtime.cc:714]   | sysTid=17564 nice=0 cgrp=default sched=0/0 handle=0x72143fb2c0
runtime.cc:714]   | state=R schedstat=( 484357905 10645360 136 ) utm=20 stm=27 core=3 HZ=100
runtime.cc:714]   | stack=0x7214304000-0x7214306000 stackSize=988KB
runtime.cc:714]   | held mutexes= "abort lock" "Class loader classes"(shared held) "ClassLinker classes lock"(shared held) "mutator lock"(exclusive held)
runtime.cc:714]   native: #00 pc 00447800  /apex/com.android.art/lib64/libart.so (art::DumpNativeStack+112) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #01 pc 00541e5c  /apex/com.android.art/lib64/libart.so (art::Thread::DumpStack const+204) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #02 pc 00931838  /apex/com.android.art/lib64/libart.so (art::Thread::DumpStack const+104) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #03 pc 00925de8  /apex/com.android.art/lib64/libart.so (art::AbortState::DumpThread const+56) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #04 pc 0092206c  /apex/com.android.art/lib64/libart.so (art::Runtime::Abort+1084) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #05 pc 00014db0  /apex/com.android.art/lib64/libbase.so (android::base::SetAborter::$_0::__invoke+80) (BuildId: 01f56bead4468a24561430f970f06de2)
runtime.cc:714]   native: #06 pc 00014250  /apex/com.android.art/lib64/libbase.so (android::base::LogMessage::~LogMessage+544) (BuildId: 01f56bead4468a24561430f970f06de2)
runtime.cc:714]   native: #07 pc 005b1b18  /apex/com.android.art/lib64/libart.so (art::OatFile::OatClass::GetOatMethodOffsets const+1224) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #08 pc 0022ad68  /apex/com.android.art/lib64/libart.so (art::FindOatMethodFor +200) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #09 pc 0054fa44  /apex/com.android.art/lib64/libart.so (art::ArtMethod::GetOatMethodQuickCode+52) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #10 pc 007ff8cc  /apex/com.android.art/lib64/libart.so (art::instrumentation::Instrumentation::GetOptimizedCodeFor+76) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #11 pc 007ff76c  /apex/com.android.art/lib64/libart.so (art::instrumentation::Instrumentation::InstallStubsForMethod+300) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #12 pc 005c43bc  /apex/com.android.art/lib64/libart.so (art::instrumentation::Instrumentation::InstallStubsForClass+140) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #13 pc 0080223c  /apex/com.android.art/lib64/libart.so (art::instrumentation::InstallStubsClassVisitor::operator+12) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #14 pc 00612e5c  /apex/com.android.art/lib64/libart.so (bool art::ClassTable::Visit<0, art::VisitClassLoaderClassesVisitor::DefiningClassLoaderFilterVisitor>+204) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #15 pc 00612d70  /apex/com.android.art/lib64/libart.so (art::VisitClassLoaderClassesVisitor::Visit+112) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #16 pc 00396758  /apex/com.android.art/lib64/libart.so (art::ClassLinker::VisitClassLoaders const+104) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #17 pc 004b7514  /apex/com.android.art/lib64/libart.so (art::ClassLinker::VisitClassesInternal+1172) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #18 pc 004b6e9c  /apex/com.android.art/lib64/libart.so (art::ClassLinker::VisitClasses+124) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
2026-09-18 03:08:08.662 tchapp.helloworld           com...app.helloworld runtime.cc:714]   native: #19 pc 007ffb8c  /apex/com.android.art/lib64/libart.so (art::instrumentation::Instrumentation::UpdateEntrypointsForDebuggable+60) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #20 pc 0002f560  /apex/com.android.art/lib64/libopenjdkjvmti.so (openjdkjvmti::DeoptManager::FinishSetup+336) (BuildId: fdfe1c687dfb83aeced7ca2a67feff78)
runtime.cc:714]   native: #21 pc 0004a3ec  /apex/com.android.art/lib64/libopenjdkjvmti.so (ArtPlugin_Initialize+252) (BuildId: fdfe1c687dfb83aeced7ca2a67feff78)
runtime.cc:714]   native: #22 pc 003fdd78  /apex/com.android.art/lib64/libart.so (art::Plugin::Load+104) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #23 pc 003fdb38  /apex/com.android.art/lib64/libart.so (art::Runtime::EnsurePluginLoaded+216) (BuildId: 40c660f95066cc11f492b0a0091a58ad)
runtime.cc:714]   native: #24 pc 00b0105c  /memfd:frida-agent-64.so (deleted) (???)
runtime.cc:714]   native: #25 pc 00b00b04  /memfd:frida-agent-64.so (deleted) (???)
runtime.cc:714]   native: #26 pc 009d2fd4  /memfd:frida-agent-64.so (deleted) (???)
runtime.cc:714]   native: #27 pc 009d2b98  /memfd:frida-agent-64.so (deleted) (???)
runtime.cc:714]   native: #60 pc 00b2814c  /memfd:frida-agent-64.so (deleted) (???)
2026-09-18 03:08:08.662 tchapp.helloworld           com...app.helloworld runtime.cc:714]   native: #61 pc 000877dc  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start +236) (BuildId: 30ed8d12b73f97af114ffd98e0d4f2e7)
runtime.cc:714]   native: #62 pc 000785c0  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 30ed8d12b73f97af114ffd98e0d4f2e7)
runtime.cc:714]   (no managed stack frames)
runtime.cc:714] 

Error: abort was called
    at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1)
    at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1)
    at fc (D:\projects\test\app\src\main\assets\scripts\script.js:1)
    at get (D:\projects\test\app\src\main\assets\scripts\script.js:1)
    at dd (D:\projects\test\app\src\main\assets\scripts\script.js:1874)
    at No (D:\projects\test\app\src\main\assets\scripts\script.js:1874)
    at build (D:\projects\test\app\src\main\assets\scripts\script.js:1874)
    at _make (D:\projects\test\app\src\main\assets\scripts\script.js:1875)
    at use (D:\projects\test\app\src\main\assets\scripts\script.js:1875)
    at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1884)
    at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1)
    at _performPendingVmOpsWhenReady (D:\projects\test\app\src\main\assets\scripts\script.js:1884)
    at perform (D:\projects\test\app\src\main\assets\scripts\script.js:1884)
    at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1884)
    at apply (native)
    at <anonymous> (/frida/runtime/core.js:55)

Observation

I've reproduced this same abort signature (method_index < num_methods_)
across multiple different apps and different hooked methods, always with
method_index=275, while num_methods_ varies (5, 42, ...) depending on
the class involved. The crash only happens when both of these are true:

1. Vector has an active hook on some method in the process
   (in this specific repro: Application.onCreate).
2. Frida performs Java.perform in that same process.

Neither condition alone causes a crash.

Xposed Module List/Xposed 模块列表

https://github.com/staleroot/frida-crash-module

Root implementation/Root 方案

Magisk 30.7, Vector 2.2 (3111) API 102

System Module List/系统模块列表

https://github.com/staleroot/frida-crash-module

Vector version/Vector 版本

2.2 (3111)

Android version/Android 版本

16 (API 36.1) LineageOS 23.2-20260830-NIGHTLY-davinci

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

logs.zip