Guard primitive array value-manager routing

[simonrozsival]

Summary

• require the JNI runtime type to match the selected primitive-array marshaler before invoking array JNI APIs
• route non-array IList<T> handles through JavaConvert only when JNI confirms the object implements java.util.List
• apply the equivalent exact JNI signature and List-assignability guards to the trimmable PrimitiveArrayInfo path
• honor JniObjectReferenceOptions before all new invalid-cast failures

CheckJNI evidence and safety boundary

The reproducer passed a java.util.ArrayList handle while requesting IList<bool>. The reflection value manager selected JavaBooleanArray.ArrayMarshaler from the managed target type alone, leading CheckJNI to abort the process with jarray argument has non-array type: java.util.ArrayList. This change establishes the safety boundary before any array JNI call: only the matching primitive array signature (for example, [Z) may enter that marshaler. A non-array reference may enter collection conversion only when JNI IsInstanceOf confirms java.util.List; other objects and mismatched arrays fail with InvalidCastException. Failure paths dispose and invalidate transferred references according to the requested ownership options.

Retained behavior

A genuine Java primitive array still marshals to IList<T>, and genuine Java List implementations still use JavaConvert. The guard compares the actual JNI runtime type rather than rejecting IList<T> generally.

Tests

Added on-device coverage in JavaConvertTest for:

• java.util.ArrayList<Boolean> handle -> IList<bool>
• Java boolean[] handle -> IList<bool>
• Java String handle -> IList<bool> safely throws, preserving Copy and consuming CopyAndDispose
• Java int[] handle -> IList<bool> safely throws and consumes CopyAndDispose

Validation:

• dotnet build external/Java.Interop/src/Java.Interop/Java.Interop.csproj ... passed with 0 warnings/errors after the review fixes.
• On-device tests were not run locally because this worktree has no prepared local SDK (make prepare is required).
• A direct Mono.Android.csproj build reaches the repository prerequisite failure because bin/BuildDebug/net10.0/xa-prep-tasks.dll is absent.

[simonrozsival]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflict with origin/main in commit 3b58d52b. The resolution keeps the primitive-array ValueManager regression tests and the new upstream FromJniHandle collection tests.

[Copilot]

Pull request overview

Adds defensive JNI type guards around primitive-array marshaling so IList<T> conversions don’t accidentally invoke array JNI APIs on non-array objects (avoiding CheckJNI aborts), while still allowing java.util.List objects to be converted via JavaConvert when appropriate.

Changes:

• In ReflectionJniValueManager, gate primitive-array marshalers on the actual JNI runtime type signature (e.g. only [Z may enter the boolean-array marshaler), and route non-array IList<T> conversions via a new CreateNonArrayListValue hook only when JNI confirms java.util.List.
• Apply equivalent guards to the trimmable typemap path (PrimitiveArrayInfo).
• Add on-device regression tests covering valid conversions and invalid-cast/ownership behavior for IList<bool> scenarios.

Show a summary per file

File	Description
tests/Mono.Android-Tests/Mono.Android-Tests/Java.Interop/JavaConvertTest.cs	Adds on-device regression tests for list/primitive-array IList<bool> conversions and failure/ownership behaviors.
src/Mono.Android/Microsoft.Android.Runtime/PrimitiveArrayInfo.cs	Adds JNI runtime-type guard for primitive array wrappers and allows java.util.List to fall back to JavaConvert for IList<T>.
src/Mono.Android/Microsoft.Android.Runtime/JavaMarshalValueManager.cs	Overrides new CreateNonArrayListValue hook to route guarded non-array list conversions through JavaConvert.
src/Mono.Android/Android.Runtime/AndroidRuntime.cs	Same override as above for the runtime value manager used by AndroidRuntime.
external/Java.Interop/src/Java.Interop/PublicAPI.Unshipped.txt	Declares the newly added virtual ReflectionJniValueManager.CreateNonArrayListValue(...) API.
external/Java.Interop/src/Java.Interop/Java.Interop/JniRuntime.ReflectionJniValueManager.cs	Implements primitive-array signature checks, java.util.List assignability gate, and new CreateNonArrayListValue extensibility point.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Lite

[simonrozsival]

/review

[github-actions]

✅ Android PR Reviewer completed successfully!

Generated by Android PR Reviewer for #12114

[github-actions]

⚠️ Needs Changes

Findings: 1 error · 0 warnings · 0 suggestions

The new runtime checks correctly protect the intended IList<T> conversion and preserve ownership on rejection, but the reflection value-manager path still treats managed array targets as list targets. A java.util.List requested as bool[] therefore reaches JNIEnv.GetArray through JavaConvert instead of failing safely. The trimmable path already avoids this by restricting its fallback to an actual IList<> target.

CI build #1564780 is still running; all completed checks currently pass.

Generated by Android PR Reviewer for #12114 · gpt56 · 137.5 AIC · ⌖ 10.8 AIC · ⊞ 25.7K
_{Comment /review to run again}

[github-actions]

🤖 ❌ JNI interop — GetListType(targetType) is also non-null for managed arrays because bool[] implements IList<bool>. Consequently, asking for bool[] when the JNI object is a java.util.List enters this branch and CreateNonArrayListValue delegates to JavaConvert; its array converter then calls JNIEnv.GetArray on the non-array reference, preserving the fatal JNI misuse this guard is intended to prevent. Please exclude array targets from this fallback (and add the corresponding GetValue<bool[]> regression case) so this path throws safely instead.

Rule: Validate the runtime JNI type before array access