[Xamarin.Android.Build.Tasks] Generate R8 JNI remapping tables - #12848

The full 18-file review, separate producer-to-runtime integration/completeness pass and final independent sweep identify seven current correctness blockers. The producer-only scope, optional target-signature fallback and already-fixed namespace/signature/IL-scanning findings are accepted; prerequisite #12847 is present.

1. Recognize the linked framework implementation identities (JniRemappingAssemblyScanner.cs:151-184). ILLink at the pinned dependency resolves forwarded TypeMapAttribute<T> and constructor System.Type references to System.Private.CoreLib. The facade-only checks silently discard valid surviving entries; repairing only the attribute check still rejects the constructor. Generated proxies have no ordinary registration/removed-IL fallback. Support genuine facade and implementation identities for both checks, preserve lookalike rejection, and add implementation-scoped metadata coverage.

2. Select the Java TypeMap universe before JNI validation (scanner:160-161). The generic group argument is discarded. Actual TypeMap<JavaDictionary> entries in ValueTypeDictionaryFactory use CLR keys such as System.Collections.Generic.IDictionary2[System.Boolean,System.Boolean]; interpreting these as JNI class names raises BadImageFormatException`/XA4325 and prevents output. Skip unrelated framework mapping groups before parsing their keys; fixing implementation-scope recognition also exposes this valid linked input.

3. Retain class-only surviving entries explicitly (scanner:286-304). RecordAllMappings records only field/method accesses. A renamed marker interface/class with no enumerated member mappings adds no C entry, so GenerateContent removes both required forward and reverse type mappings despite its surviving authoritative TypeMap key. Mark class access independently and add a class-only retention assertion.

4. Filter JNI method attributes before decoding (scanner:315-332). Every method attribute is decoded before the name switch. The reused dummy provider cannot decode enum/System.Type arguments, so a valid unrelated attribute such as EditorBrowsable(Never) becomes a false malformed-assembly XA4325 error and RunTask exits before writing output. Determine a supported JNI attribute name before decoding, as the type/field paths do, and cover unrelated valid attributes.

5. Preserve descriptor-distinct field rows (R8Mapping.cs:141-145). Name-only dictionaries overwrite int value -> a with java.lang.String value -> b, a valid descriptor-distinct JVM layout. The new typed enumeration emits only the latter, while the actual field lookup requires name and source descriptor; the integer consumer loses its remap. Preserve name-plus-type/descriptor identity and all rows, with name-based metadata retention retaining every required variant. This is a tightly coupled new producer failure, not a blanket complaint about the old name-only API.

6. Do not turn a longer NativeAOT class literal into phantom class retention (NativeAotJniRetention.cs:20-25,213-228). Unbounded matching retains com/contoso/Peer inside a genuinely retained com/contoso/Peer$Inner literal. If R8 maps those original classes to one residual class, the phantom parent makes the reverse map falsely ambiguous and suppresses the entry needed by the surviving inner class. Use authoritative typemap keys or complete-literal/descriptor-token boundaries; preserve the intentional policy for truly ambiguous merges and add the prefix/merged-class case.

7. Claim ownership only for XML the merger accepts (GenerateR8JniRemapping.cs:375-384). A well-formed <ignored><replace-type from="com/contoso/Peer" to="a/b" /></ignored> is scanned as an existing owner, suppressing its identical generated forward mapping. MergeRemapXml then rejects the entire input because the root is not replacements, leaving the required mapping absent. Validate existing documents against the merger's acceptance rules before committing their ownership claims and cover rejected-root input.

All seven map to this exact head and were consolidated after every changed file/material path/candidate and the final sweep were accounted for. These are source/metadata/consumer proofs, not executed repository, Java, R8 or native tests; current successful checks do not exercise the counterexamples.

The full 20-file/current-hunk review, separate producer-to-runtime integration pass and final independent sweep confirm the framework identities, universe filtering, class-only retention, unrelated-attribute filtering, typed fields and XML ownership corrections. Phantom NativeAOT retention is only partially fixed; one UTF-16 edge-identity blocker remains.

Preserve complete UTF-16 code units at trimmed edges (NativeAotJniRetention.cs:406-423). For mappings com.contoso.Peer -> a.b and com.contoso.PeeŲ -> a.b, a native literal containing only the latter still retains Peer. Peer ends in 72 00; PeeŲ ends in 72 01. The shortened pattern matches through 72 although the complete Peer encoding is absent. Because the completing 01 is nonzero, the boundary code does not restore/validate the omitted zero and reads 01 00 as the next character, U+0001, which passes the continuation check.

The phantom class makes a/b falsely ambiguous, suppressing the reverse entry needed by the surviving peer; descriptor-identical members with different residual targets can instead cause a false XA4325 conflict. Structural exclusion of dehydration command bytes does not fix this: independently modeled tagged ELF32/ELF64 literal regions retain the same mismatch. A leading-edge counterpart also matches ĀPeer inside ĠPeer.

Account only for zeros genuinely supplied/elided by dehydration while preserving the full code-unit identity; reject nonzero completing bytes and add leading/trailing Unicode identity regressions asserting retained classes and reverse output. This is the residual reported phantom-retention concern, not an objection to conservative handling of genuinely ambiguous merges or accepted producer-only staging. Proof is immutable source and standalone RAM byte/format calculations, not executed ILC, C#, Java or R8 tests. No additional high-confidence blocker remained.

The previously reported UTF-16 edge-trimming cases are fixed. The complete current 20-file/36-hunk review, separate producer-to-runtime integration pass and final independent sweep leave one different class-evidence blocker.

Match actual string payloads and encodings (NativeAotJniRetention.cs:374-409). Both UTF-8 and UTF-16 patterns scan untyped buffers. A frozen string containing com/contoso/ plus53 B characters has length65: its copied Int32 header 41 00 00 00 retains absent class A inbothencodings. Independently, genuine UTF-16 classU+0141 (41 01) retains absent A viaitsUTF-8pattern 41,because the following controlbyte 01 passes the boundary check. Neither case requires shortened patterns or inventedzeros.

These phantom classes falsely make a shared R8 residual name ambiguous, suppressing the reverse mapping required by the actual surviving peer; descriptor-identical members with different residual targets can instead cause false XA4325 conflicts and prevent output. Restrict class evidence to identified literal payloads and actual encodings, excluding headers/executable bytes, and cover exact-survivor/reverse/member-conflict cases. Conservative member matching, genuine merged-class ambiguity and producer-only scope remain accepted.

This route was already discoverable on the earlier reviewed afecd5e/3ad9a4 heads and was a review-completeness miss, not introduced by your UTF-16 correction. Proof is independently verified current/pinned ILC source and static RAM byte calculations, not executed repository/compiler/device tests. The failed external MAUI check stopped at APK installation with INSTALL_FAILED_INSUFFICIENT_STORAGE/invalid UID; it is not presented as an additional R8 source blocker or a green-CI claim.

The previous length-header and cross-encoding class-evidence cases are fixed, and the producer-only scope, conservative member matching and genuine merged-class ambiguity remain accepted. The complete current 25-file/44-hunk review and separate integration/final sweep leave one new valid-input blocker.

Identify actual frozen-string symbols, not any __Str_ substring (NativeAotJniRetention.cs:196-205). A legitimate retained managed type such as N.__Str_Helper in assembly App has an ordinary MethodTable symbol _ZTV18App_N___Str_Helper, which now enters the FrozenStringNode reader. With normal ILC data dehydration, its EEType is misread using string-object offsets: on ELF64 the attempted length at offset 8 falls inside the related-type relocation; on ELF32 BaseSize at offset 4 becomes the string length and the payload starts at that same relocation. The sparse reader correctly rejects the unknown bytes, but the false classification causes XA4325 and prevents remapping XML even when this unrelated type has no JNI mappings.

Constrain classification to actual compiler-frozen string identities/regions while preserving fail-closed handling of genuinely incomplete strings, and cover ordinary non-string marker collisions in both ELF classes. This is introduced by the current provenance replacement, not the older header/UTF16 completeness miss. Proof is independently verified dependency-pinned compiler/ELF source and RAM-only layout reasoning, not executed ILC, repository or device tests; no additional independent blocker remained.

The ordinary MethodTable/frozen-string collision and hydration-source ordering are fixed. The complete current 25-file/44-hunk review, separate integration pass and final independent sweep leave two correctness blockers:

1. Distinguish primitive descriptor tokens from class references (NativeAotJniRetention.cs:652-663). A genuine frozen member string run.(I)V retains absent default-package class I: its complete, aligned UTF-16 pattern is bounded by ( and ), which the bare-class matcher accepts. With I -> a.b and com.contoso.Peer -> a.b, but only Peer actually retained, this phantom class suppresses the required Peer reverse mapping. Different residual run(int) targets also cause a false XA4325 conflict before output. Make bare-class evidence descriptor-aware while preserving genuine LI; object references, and cover exact-survivor/reverse/conflict cases on raw/dehydrated ELF32 and ELF64.

2. Recognize the pinned compiler's disambiguated Java-group identities (TypeMapKey.cs:35-38). A valid application/reference named Mono-Android sorts before Mono.Android; both sanitize to Mono_Android, so NativeAotNameMangler names the framework assembly Mono_Android_0. Its real Java group relocation is _ZTV31Mono_Android_0_Java_Lang_Object, which the fixed-spelling predicate rejects. A disambiguated local TypeMap assembly similarly loses the required anchor suffix. ReadKeys then skips the genuine group, silently dropping key-only surviving classes and their remapping rows. Account for actual mangler disambiguation without admitting CLR universes, and cover shared/local-anchor collision shapes.

Both cases were already discoverable on the previously reviewed 73e244b head and were misses in my earlier review, not regressions introduced by this correction. The evidence is independently verified current source, dependency-pinned compiler/ELF contracts and RAM-only byte/name calculations, not executed repository, ILC or device tests. Producer-only scope, conservative member evidence and genuine merged-class ambiguity remain accepted. Current CI is not claimed green; its observed NativeAOT Dispose_Finalized failure is not asserted flaky or an additional proven R8 source defect.

The complete 26-file re-review confirms both remaining fixes. Whole-literal class matching excludes primitive descriptor tokens while retaining genuine object references, and the shared canonical suffix/framing predicate agrees with the pinned compiler in both native consumers. The previously fixed metadata, provenance, typed-field, XML ownership and native lookup contracts remain preserved. No blocking issue remains within the accepted producer-only scope.