[tests] Complete GC bridge accounting in JNI leak measurements - #13014

Refs #13010, finding 3. This is an independent, non-stacked test-only change; it does not close the multi-finding tracker.

The existing JNI leak checks collect and drain peers before the baseline, but only collect managed garbage after the measured batch. That does not guarantee equivalent bridge phases: CoreCLR/NativeAOT dispatch bridge work asynchronously, the trimmable value manager's wait is intentionally a no-op, and globals temporarily become weak globals before surviving peers are promoted. Managed collection and peer draining alone are not a completion notification.

Use one shared bounded protocol for both samples. Android creates an unreachable peer-cycle witness and waits for its finalization, completion of the GC/finalizer worker, an advanced CoreCLR/NativeAOT bridge generation, and stable strong/weak counts with no transient weak globals. Drain peers after completion without starting another collection. Host JVM sampling does not require an impossible Android generation change. A ten-second timeout poisons the helper for that process: an uninterruptible worker cannot be followed by another action batch or GC worker.

Keep the 100-iteration warmup, 100 measured iterations, and zero-growth threshold. Both retained-GREF controls require the actual growth assertion and Delta=100; a timeout cannot masquerade as successful leak detection. Preserve JavaSideActivation/Jcw control Explicit isolation and existing TryFindClass categories. No production runtime APIs or wait semantics change.

Review fixes

Follow-up commit 2bed85fda5c7438a83d64ef85b22408e577ae065 addresses both inline findings. Each collection request now records its own generation. A retry waits for the previous worker and bridge to complete, and acceptance requires a completion notification newer than the latest request, not the original round. A retry also creates an additional unreachable cycle so it still requests bridge work if the original witness finalizes just before its GC. Timeout handling irreversibly poisons the helper before observing a completed task, preserving late worker faults instead of reporting them as timeout assertions.

Added deterministic regressions for a finalized original witness and completed retry worker while the retry bridge callback has not started, and for a worker fault becoming observable after the final polling observation. Existing phase, notification, empty-host, drain, pending-worker, timeout/reuse, and worker-fault coverage remains.

Validation

Final source after the review fixes was rebuilt and retested locally. All outputs and Android toolchain/AVD files were in this worktree. Device runs used dedicated API29 arm64-v8a emulator emulator-5620 with private adb server5051. SDK/runtime: 12.0.100-alpha.1.26477.101 / .NET 12.0.0-alpha.1.26477.101; Android assemblies target net11.0-android. Host assemblies target net10.0, roll forward to that runtime, and use Microsoft JDK25.

Accepted samples had weak=0 and advancing bridge generations. Final CoreCLR samples typically advanced 2→4 for controls, 6→8 for activation, and 6→8/10→12 for lookups. NativeAOT controls advanced 2→4 and 4→6; activation 6→8; lookups 8→10 and 12→14. Both retained-GREF controls triggered the expected strict Delta=100 assertion on both Android runtimes, as did the host control.

Exact commands/results, with $PWD initially the independent worktree root:

env RuntimeFrameworkVersion=10.0.0 \
  AndroidToolchainDirectory="$PWD/bin/android-toolchain" \
  ANDROID_SDK_ROOT= ANDROID_HOME= \
  PATH="$PWD/bin/Debug/dotnet:$PATH" DOTNET_ROLL_FORWARD=Major make prepare

Passed during initial SDK preparation. Bootstrap initially requested unavailable 10.0.13 reference packages; the environment override propagated 10.0.0 into child builds without changing product pins. The same environment with make all initially reached workload configuration but lacked API37.1/37.2 references. Built the existing API projects:

for api in 37.1 37.2; do
  env RuntimeFrameworkVersion=10.0.0 \
    AndroidToolchainDirectory="$PWD/bin/android-toolchain" \
    PATH="$PWD/bin/Debug/dotnet:$PATH" DOTNET_ROLL_FORWARD=Major \
    bin/Debug/dotnet/dotnet build src/Mono.Android/Mono.Android.csproj \
      -c Debug -p:AndroidApiLevel="$api" -p:AndroidPlatformId="$api" \
      -p:AndroidFrameworkVersion="v17${api#37}" -v:q
done

Both passed. Final initial make all using the prepare environment passed, zero warnings/errors in the final summary. Production SDK code is unchanged by the review fix; the affected host/device test sources were rebuilt below. The bootstrap runtime override was not passed to Android application builds.

Final host build and repeats:

JDK="$PWD/bin/android-toolchain/jdk-25"
DOTNET_ROLL_FORWARD=Major bin/Debug/dotnet/dotnet build \
  external/Java.Interop/tests/Java.Interop-Tests/Java.Interop-Tests.csproj \
  -c Debug -p:RuntimeFrameworkVersion=10.0.0 \
  -p:JavaCPath="$JDK/bin/javac" -p:JarPath="$JDK/bin/jar" \
  -p:DotnetToolPath="$PWD/bin/Debug/dotnet/dotnet" -v:q
for run in 1 2 3 4 5; do
  JAVA_HOME="$JDK" DOTNET_ROLL_FORWARD=Major bin/Debug/dotnet/dotnet test \
    external/Java.Interop/bin/TestDebug-net10.0/Java.Interop-Tests.dll \
    --filter 'TestCategory=JniReferenceLeak|FullyQualifiedName~JniReferenceLeakMeasurementTests' \
    --logger 'console;verbosity=normal' \
    --results-directory "$PWD/bin/TestDebug/JniLeakHost"
done

Build passed with zero warnings/errors. All19 cases passed in each of five processes: 95/95.

For final Android builds/tests, exported this environment at the worktree root:

export AndroidToolchainDirectory="$PWD/bin/android-toolchain" \
  AndroidSdkDirectory="$PWD/bin/android-toolchain/sdk" \
  AndroidNdkDirectory="$PWD/bin/android-toolchain/ndk" \
  JavaSdkDirectory="$PWD/bin/android-toolchain/jdk-25" \
  ANDROID_HOME="$PWD/bin/android-toolchain/sdk" \
  ANDROID_SDK_ROOT="$PWD/bin/android-toolchain/sdk" \
  ADB_SERVER_SOCKET=tcp:localhost:5051 ADB_SERVER_PORT=5051 \
  ANDROID_ADB_SERVER_PORT=5051 DOTNET_ROLL_FORWARD=Major

The following exact matrix cleans/restores/rebuilds before installation, then runs each real leak/control suite five times and the protocol fixture once per runtime:

ROOT="$PWD"
for config in Debug Release; do
  opts=()
  if test "$config" = Release; then opts=(-p:PublishAot=true); fi
  for suite in jcw mono protocol; do
    category=JniReferenceLeak
    project=tests/Mono.Android-Tests/Mono.Android-Tests/Mono.Android.NET-Tests.csproj
    if test "$suite" = jcw; then
      project=tests/CodeGen-Binding/Xamarin.Android.JcwGen-Tests/Xamarin.Android.JcwGen-Tests.csproj
    elif test "$suite" = protocol; then
      category=JniReferenceLeakMeasurement
    fi
    ./dotnet-local.sh clean -c "$config" "$project" "${opts[@]}" \
      -p:IncludeCategories="$category" -p:RuntimeIdentifier=android-arm64 -v:q
    ./dotnet-local.sh build '-t:Build;Install' -c "$config" "$project" "${opts[@]}" \
      -p:IncludeCategories="$category" -p:RuntimeIdentifier=android-arm64 \
      -p:AdbTarget='-s emulator-5620' -v:q
    for run in 1 2 3 4 5; do
      (cd "$(dirname "$project")" && \
        ../../../dotnet-local.sh test "$(basename "$project")" \
          --device emulator-5620 --no-build -c "$config" "${opts[@]}" \
          -p:IncludeCategories="$category" -p:RuntimeIdentifier=android-arm64 \
          -p:AdbTarget='-s emulator-5620' --report-trx \
          --results-directory "$ROOT/bin/Test$config/JniLeakDevice/review-$suite-$run")
      if test "$suite" = protocol; then break; fi
    done
  done
done

All six clean/build/install combinations passed. CoreCLR Debug and NativeAOT Release each passed 2/2 Jcw and 3/3 Mono.Android cases in all five runs, plus exactly16/16 protocol cases. Builds reported existing binding/nullability and NUnit/runtime trim/AOT warnings. Final git diff --check passed. Owned emulator/private adb server were stopped after validation.

An initial review-fix candidate reset the generation without supplying a fresh retry cycle. Device validation correctly timed out when the original witness finalized immediately before a retry and no new bridge generation was produced. Adding the retry cycle addressed that legitimate no-peer condition without relaxing completion or count requirements; the final results above are from the corrected source. Separately, -t:Rebuild;Install initially deleted a referenced project's NuGet assets after restore. Running clean separately before build/restore fixed the build prerequisite. This is documented, along with explicit device selection and NativeAOT category-change test-count verification.

Before review, initial validation also passed host17×5=85/85, CoreCLR25/25 +14/14 protocol, and NativeAOT25/25 +14/14 protocol. The final counts above include the two new deterministic regressions.

Limitations

Pinned CoreCLR/NativeAOT contract analysis and deterministic regressions demonstrate the missing completion guarantee, including misleading strong/weak-phase snapshots. The historical intermittent Android failure was not reproduced: this is not a causality claim and not evidence other GREF leaks are absent. Only arm64/API29 device coverage is included. No code dependency on the other independent tracker fixes was identified; the witness relies on normal Dispose(false) finalization.

Pull Request
title and
description
should follow the
commit-messages.md workflow documentation, and in particular should include:

• Useful description of why the change is necessary.
• Links to issues fixed
• Unit tests