8.61.1 fails to dex on AGP 8.0 and older: D8 NullPointerException "Cannot invoke String.length()" #6355

Description

Starting with 8.61.1, Android release builds that use D8 older than 8.1 (AGP 8.0 and older) fail in mergeExtDexRelease while dexing io.sentry:sentry and io.sentry:sentry-android-core:

D8: java.lang.NullPointerException: Cannot invoke "String.length()" because "<parameter1>" is null

We found it in the React Native SDK's RN 0.71 E2E build (failing job) and reverted the bump there in getsentry/sentry-react-native#6931. It is not RN specific: any Android app whose build uses D8 < 8.1 is affected, no matter the framework.

Root cause

#6242 moved compilation to a JDK 21 toolchain. Since JDK 21 (JDK-8292275), javac writes a MethodParameters attribute for methods with synthetic or mandated parameters, such as bridge methods, even without -parameters. These entries carry flags but no name. As far as we can tell, javac has no option to turn this off.

Example from the published sentry-8.61.1.jar, io.sentry.SentryLogLevel$Deserializer:

public java.lang.Object deserialize(io.sentry.ObjectReader, io.sentry.ILogger) throws java.lang.Exception;
  flags: (0x1041) ACC_PUBLIC, ACC_BRIDGE, ACC_SYNTHETIC
  ...
  MethodParameters:
    Name                           Flags
    <no name>                      synthetic
    <no name>                      synthetic

Older D8 versions read the null name and crash.

Classes with a MethodParameters attribute (checked with javap -v on the Maven Central artifacts):

D8 compatibility

A class compiled with javac 21, run through the newest release of each D8 line:

Reproduction

Either build any AGP 7.3.1 app that depends on io.sentry:sentry-android:8.61.1 with ./gradlew assembleRelease, or run D8 directly, no Gradle needed:

curl -LO https://maven.google.com/com/android/tools/r8/3.3.75/r8-3.3.75.jar
curl -LO https://repo1.maven.org/maven2/io/sentry/sentry/8.61.1/sentry-8.61.1.jar
mkdir out
java -cp r8-3.3.75.jar com.android.tools.r8.D8 --release --min-api 21 \
  --lib $ANDROID_HOME/platforms/android-<api>/android.jar --output out sentry-8.61.1.jar

The same command succeeds with sentry-8.61.0.jar.

Proposed fix

Remove the MethodParameters attribute from the main Java classes of published modules after JavaCompile, using ASM (already on the build classpath through AGP, same version 9.9). Without -parameters the attribute only holds these nameless entries, so nothing the SDK relies on is lost, and the output matches what javac 17 produced. Kotlin code is unaffected, because kotlinc doesn't write the attribute unless -java-parameters is set.

We didn't go with -parameters: it would add the attribute, with names, to every method of every published class, which makes the jars and dex output bigger, and we haven't verified that it avoids the nameless entries for synthetic parameters.

Verified locally with the fix:

• 0 classes with MethodParameters in the sentry jar and the sentry-android-core AAR
• both dex cleanly with D8 3.3.75, while the published 8.61.1 jar fails with the NPE above
• the attribute stays stripped after a forced recompile (--rerun), with configuration cache enabled

Impact

• React Native: the peer range is react-native >=0.65.0. RN 0.72 and older default to AGP 7.x, so those apps fail their release builds on an RN SDK version that bundles 8.61.1. RN stays on 8.61.0 until a fixed release is out.