[tinker] Fix: ClassDef order validation failure caused by DexPatchGenerator.

Author: tys282000

third-party/aosp-dexutils/src/main/java/com/tencent/tinker/android/dex/Dex.java

@@ -52,6 +52,27 @@ public final class Dex {
     static final short[] EMPTY_SHORT_ARRAY = new short[0];
     private static final int CHECKSUM_OFFSET = 8;
     private static final int SIGNATURE_OFFSET = CHECKSUM_OFFSET + SizeOf.CHECKSUM;
+
+    public static final int ACC_PUBLIC = 0x1;
+    public static final int ACC_PRIVATE = 0x2;
+    public static final int ACC_PROTECTED = 0x4;
+    public static final int ACC_STATIC = 0x8;
+    public static final int ACC_FINAL = 0x10;
+    public static final int ACC_SYNCHRONIZED = 0x20;
+    public static final int ACC_VOLATILE = 0x40;
+    public static final int ACC_BRIDGE = 0x40;
+    public static final int ACC_TRANSIENT = 0x80;
+    public static final int ACC_VARARGS = 0x80;
+    public static final int ACC_NATIVE = 0x100;
+    public static final int ACC_INTERFACE = 0x200;
+    public static final int ACC_ABSTRACT = 0x400;
+    public static final int ACC_STRICT = 0x800;
+    public static final int ACC_SYNTHETIC = 0x1000;
+    public static final int ACC_ANNOTATION = 0x2000;
+    public static final int ACC_ENUM = 0x4000;
+    public static final int ACC_CONSTRUCTOR = 0x10000;
+    public static final int ACC_DECLARED_SYNCHRONIZED = 0x20000;
+
     private final TableOfContents tableOfContents = new TableOfContents();
     private final StringTable strings = new StringTable();
     private final TypeIndexToDescriptorIndexTable typeIds = new TypeIndexToDescriptorIndexTable();
@@ -595,15 +616,11 @@ public short[] interfaceTypeIndicesFromClassDefIndex(int classDefIndex) {
     }
 
     public short[] interfaceTypeIndicesFromClassDef(ClassDef classDef) {
-        int position = classDef.off;
-        position += SizeOf.UINT;  // type
-        position += SizeOf.UINT;  // accessFlags
-        position += SizeOf.UINT;  // superType
-        int interfacesOffset = data.getInt(position);
+        int interfacesOffset = classDef.interfacesOffset;
         if (interfacesOffset == 0) {
             return EMPTY_SHORT_ARRAY;
         }
-        position = interfacesOffset;
+        int position = interfacesOffset;
         int size = data.getInt(position);
         if (size <= 0) {
             throw new AssertionError("Unexpected interfaces list size: " + size);

tinker-commons/src/main/java/com/tencent/tinker/commons/dexpatcher/algorithms/patch/ClassDefSectionPatchAlgorithm.java

@@ -20,16 +20,26 @@
 import com.tencent.tinker.android.dex.Dex;
 import com.tencent.tinker.android.dex.TableOfContents;
 import com.tencent.tinker.android.dex.io.DexDataBuffer;
+import com.tencent.tinker.android.utils.SparseIntArray;
 import com.tencent.tinker.commons.dexpatcher.struct.DexPatchFile;
 import com.tencent.tinker.commons.dexpatcher.util.AbstractIndexMap;
 import com.tencent.tinker.commons.dexpatcher.util.SparseIndexMap;
 
+import java.util.ArrayDeque;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Queue;
+
 /**
  * Created by tangyinsheng on 2016/7/4.
  */
 public class ClassDefSectionPatchAlgorithm extends DexSectionPatchAlgorithm<ClassDef> {
+    private Dex patchedDex = null;
     private TableOfContents.Section patchedClassDefTocSec = null;
     private Dex.Section patchedClassDefSec = null;
+    private List<ClassDef> patchedClassDefs = null;
 
     public ClassDefSectionPatchAlgorithm(
             DexPatchFile patchFile,
@@ -40,8 +50,10 @@ public ClassDefSectionPatchAlgorithm(
         super(patchFile, oldDex, oldToPatchedIndexMap);
 
         if (patchedDex != null) {
+            this.patchedDex = patchedDex;
             this.patchedClassDefTocSec = patchedDex.getTableOfContents().classDefs;
             this.patchedClassDefSec = patchedDex.openSection(this.patchedClassDefTocSec);
+            this.patchedClassDefs = new ArrayList<>(512);
         }
     }
 
@@ -69,6 +81,70 @@ protected ClassDef adjustItem(AbstractIndexMap indexMap, ClassDef item) {
     @Override
     protected int writePatchedItem(ClassDef patchedItem) {
         ++this.patchedClassDefTocSec.size;
-        return this.patchedClassDefSec.writeClassDef(patchedItem);
+        this.patchedClassDefs.add(patchedItem);
+        // Since no other sections concern about offset of ClassDef item, we can simply return 0 here.
+        return 0;
+    }
+
+    @Override
+    protected void onPatchAlgorithmEnd() {
+        this.patchedClassDefs = topologicalSort(this.patchedClassDefs);
+        for (ClassDef patchedItem : this.patchedClassDefs) {
+            this.patchedClassDefSec.writeClassDef(patchedItem);
+        }
+    }
+
+    private List<ClassDef> topologicalSort(List<ClassDef> elements) {
+        final Map<Integer, ClassDef> typeIdToClassDefMap = new HashMap<>(elements.size() + 8);
+        final Map<Integer, List<Integer>> typeGraph = new HashMap<>(elements.size() + 8);
+        final SparseIntArray inDegrees = new SparseIntArray(elements.size() + 8);
+        for (ClassDef elem : elements) {
+            typeIdToClassDefMap.put(elem.typeIndex, elem);
+            typeGraph.put(elem.typeIndex, new ArrayList<>(8));
+            inDegrees.put(elem.typeIndex, 0);
+        }
+
+        for (ClassDef elem : elements) {
+            if (typeIdToClassDefMap.containsKey(elem.supertypeIndex)) {
+                typeGraph.get(elem.supertypeIndex).add(elem.typeIndex);
+                inDegrees.put(elem.typeIndex, inDegrees.get(elem.typeIndex) + 1);
+            }
+            for (int implTypeId : patchedDex.interfaceTypeIndicesFromClassDef(elem)) {
+                if (typeIdToClassDefMap.containsKey(implTypeId)) {
+                    typeGraph.get(implTypeId).add(elem.typeIndex);
+                    inDegrees.put(elem.typeIndex, inDegrees.get(elem.typeIndex) + 1);
+                }
+            }
+        }
+
+        final Queue<Integer> typeIdWithZeroInDegrees = new ArrayDeque<>(64);
+        for (int i = 0; i < inDegrees.size(); ++i) {
+            final int typeId = inDegrees.keyAt(i);
+            final int inDegree = inDegrees.valueAt(i);
+            if (inDegree == 0) {
+                typeIdWithZeroInDegrees.offer(typeId);
+            }
+        }
+
+        final List<ClassDef> result = new ArrayList<>();
+        while (!typeIdWithZeroInDegrees.isEmpty()) {
+            final int currentTypeId = typeIdWithZeroInDegrees.poll();
+            result.add(typeIdToClassDefMap.get(currentTypeId));
+
+            for (int nextTypeId : typeGraph.get(currentTypeId)) {
+                final int newInDegree = inDegrees.get(nextTypeId) - 1;
+                inDegrees.put(nextTypeId, newInDegree);
+                if (newInDegree == 0) {
+                    typeIdWithZeroInDegrees.offer(nextTypeId);
+                }
+            }
+        }
+
+        // Check if type graph contains loop.
+        if (result.size() != elements.size()) {
+            throw new IllegalStateException("Illegal dex format, there's at least one loop in class inheritance graph.");
+        }
+
+        return result;
     }
 }

tinker-commons/src/main/java/com/tencent/tinker/commons/dexpatcher/algorithms/patch/DexSectionPatchAlgorithm.java

@@ -94,10 +94,16 @@ protected void markDeletedIndexOrOffset(SparseIndexMap sparseIndexMap, int delet
      * Output patched item. This method should be overrided by subclass
      * so that patched item can be written to right place.
      * <p/>
-     * Returns the offset where {@code patchedItem} is written. (<b>Must be valid.</b>)
+     * Returns the offset where {@code patchedItem} is written.
+     * (<b>Must be valid if the patched section is depended by other sections.</b>)
      */
     protected abstract int writePatchedItem(T patchedItem);
 
+    /**
+     * Called when patch algorithm finish generating patched section.
+     */
+    protected void onPatchAlgorithmEnd() {}
+
     private int[] readDeltaIndiciesOrOffsets(int count) {
         int[] result = new int[count];
         int lastVal = 0;
@@ -234,5 +240,7 @@ private void doFullPatch(
                     )
             );
         }
+
+        onPatchAlgorithmEnd();
     }
 }