[CoreCLR] MarshalMethodsAppRuns crashes in Java_mono_android_TypeManager_n_activate

[matouskozak]

Android framework version

• net11.0-android (Preview)

Affected platform version

• dotnet/android PR pipeline definition 333 on 2026-07-21–22
• Android x64 emulator
• CoreCLR
• The newest public artifact uses .NET SDK 11.0.100-preview.7.26365.101

Description

MarshalMethodsAppRuns(CoreCLR) is repeatedly crashing during unrelated PR builds.
In a sample of 12 distinct PRs targeting main, the test failed in 6 PRs. Five
public test artifacts contain the same native null-dereference; the sixth run
timed out without producing the startup marker.

The test reports:

Failed MarshalMethodsAppRuns(CoreCLR)
Output did not contain XXX:OnStart done!

In the five crash artifacts, logcat shows that the app did not merely miss the
expected log line—it crashed during startup:

Got a SIGSEGV while executing native code.
Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0

#01 ... libxamarin-app-clr.so
    Java_mono_android_TypeManager_n_1activate+73

The same signature appeared in these distinct PR builds:

• build 1520924 / PR 12203
• build 1520526 / PR 12199
• build 1520455 / PR 12148
• build 1519810 / PR 12193
• build 1520229 / PR 12200

The latest occurrence is available in the public
MSBuild+Emulator 3 test artifact;
the signature is in
MarshalMethodsAppRunsCoreCLR/logcat-failed.log.

Build 1520448 / PR 12195
also failed the same test, but its artifact shows an accepted Activity launch with
no app-process/CoreCLR output before the approximately four-minute timeout. That
run is not counted among the five confirmed native crashes.

Related but distinct work

• dotnet/android#12201
  tracks a physical-arm64 incremental Fast Deploy typemap mismatch after a C# edit.
  These CI crashes happen in the existing clean MarshalMethodsAppRuns(CoreCLR)
  device test on an x64 emulator and have a different native signature.
• dotnet/android#12195 and
  dotnet/android#12196 address
  logcat-monitor timing. The public artifacts above contain an actual process
  SIGSEGV, so the recurring failure is not only a missed startup log line.

Steps to reproduce

No standalone local reproduction has been reduced yet.

1. Run the dotnet-android PR pipeline against an unrelated change targeting
   main.
2. Inspect macOS > Tests > MSBuild+Emulator 3.
3. Run MarshalMethodsAppRuns(CoreCLR) on the Android x64 emulator.
4. Inspect logcat-failed.log when the test does not observe
   XXX:OnStart done!.

Across the sampled PRs, this reproduced as the identical native crash in five
distinct runs.

Expected behavior

The CoreCLR marshal-methods app starts and writes XXX:OnStart done!.

Actual behavior

The app intermittently receives SIGSEGV at address 0x0 in
Java_mono_android_TypeManager_n_1activate+73 before startup completes.

Workaround

None known.