Add the dispatch guard conformance harness

A two-app, adb-driven test for the guard in the previous commit. Kept because it
caught three defects there that a reading of the bytecode had passed, each one
only surfacing once something shaped differently was run against it.

It asserts five properties of dispatch. The fourth is the one that is easy to
lose and hard to see: the dispatch must not dispatch its own internal calls. A
dispatch that re-enters itself still returns the right answers, at a multiple of
the cost, until a real workload turns that into an ANR - so it is asserted by the
nesting cap staying silent on an ordinary run rather than by any result value.

Needs a device and a Vector build to run, so it is not wired into any Gradle
build; see its README. Separate from the fix so it can be dropped without
touching it.

Author: JingMatrix

tests/dispatch-guard/.gitignore

@@ -0,0 +1,3 @@
+build/
+.gradle/
+local.properties

tests/dispatch-guard/README.md

@@ -0,0 +1,74 @@
+# Dispatch guard conformance harness
+
+Two apps, driven from `adb`, asserting five properties of hook dispatch.
+
+| | Property |
+| --- | --- |
+| P1 | Hooks fire: instance, static, constructor, class initializer, both `Invoker` types |
+| P2 | A hooker sees other hooks — the guard comes down for module code |
+| P3 | Hooking a method the dispatch itself calls does not break the dispatch |
+| P4 | The dispatch never dispatches its own internal calls |
+| P5 | A hooker that calls the method it hooks is bounded, not fatal |
+
+P4 is the one that is easy to lose and hard to see: a dispatch that re-enters itself still returns
+the right answers, just at thirty-two times the cost, until some real workload turns that into an
+ANR. It is asserted by the nesting cap staying silent, not by any result value.
+
+`Object.getClass()` is the sharpest case for P3 and P4 because the compiler writes calls to it on
+everyone's behalf — R8 lowers Kotlin's parameter null checks into it — so the dispatch calls it
+whether or not anyone wrote that call.
+
+| Module   | Package               | Role |
+| -------- | --------------------- | ---- |
+| `target` | `org.matrix.dgtarget` | The hooked app. `ProbeReceiver` runs each check and logs one `RESULT` line each |
+| `module` | `org.matrix.dgmodule` | An API 101 module that installs the hooks |
+
+Scoped to the throwaway target, so the two hostile hooks can only take that app down. Both are armed
+on demand, so the safe checks run first.
+
+## Build and install
+
+The module compiles against the framework's own `:legacy` output for the `de.robv` check, so build
+that once from the repository root first: `./gradlew :legacy:assembleDebug`.
+
+```sh
+./gradlew :target:assembleDebug :module:assembleDebug
+adb install -r target/build/outputs/apk/debug/target-debug.apk
+adb install -r module/build/outputs/apk/debug/module-debug.apk
+
+V=/data/adb/modules/zygisk_vector/cli
+adb shell "su -c '$V modules enable org.matrix.dgmodule'"
+adb shell "su -c '$V scope set org.matrix.dgmodule org.matrix.dgtarget/0'"
+```
+
+Both APKs set `isDebuggable = false`. A debuggable app makes the zygote turn CheckJNI on, which
+aborts the process on any JNI type slip in the framework and hides everything else.
+
+## Run
+
+```sh
+P="adb shell am broadcast -a org.matrix.dgtarget.PROBE -n org.matrix.dgtarget/.ProbeReceiver"
+$P                              # P1, P2
+$P --es cmd arm-getclass        # then $P again, for P3 and P4
+$P --es cmd arm-recursion       # then --es cmd recurse, for P5
+adb logcat -d | grep -E 'DGTarget|DGModule|nested past'
+```
+
+## Reading the result
+
+| Check | Expected | Fails as |
+| ----- | -------- | -------- |
+| `instance` `static` `ctor` | `hooked-…[orig-…]` | P1 |
+| `clinit` | `clinit-ran`, plus `clinit hook fired` | P1 — the second line is the one that matters |
+| `invoker` | `chain=hooked-… origin=orig-…` | P1 |
+| `nested` | `outerHook{outer[hookedHelper]}` | P2 — `orig-helper` means the guard stayed up across module code |
+| every check, after `arm-getclass` | unchanged, same pid | P3 |
+| `Hook dispatch nested past 32` on a plain run | **absent** | P4 |
+| `selfRecurse` | `1`, process alive, cap fires | P5 |
+
+The pid must not change across the whole sequence.
+
+A P3 failure looks like a hang rather than a crash: no `RESULT` line, then `ANR in …` and a kill,
+with no `main` thread in the ANR trace because the recursing thread cannot be checkpointed.
+
+A P4 failure passes every check above. That is the point of asserting it separately.

tests/dispatch-guard/build.gradle.kts

@@ -0,0 +1 @@
+plugins { id("com.android.application") version "9.3.1" apply false }

tests/dispatch-guard/gradle.properties

@@ -0,0 +1,2 @@
+android.useAndroidX=true
+org.gradle.jvmargs=-Xmx2048m

tests/dispatch-guard/gradle/wrapper/gradle-wrapper.jar

@@ -0,0 +1,9 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
+networkTimeout=10000
+retries=0
+retryBackOffMs=500
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists

tests/dispatch-guard/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,41 @@
+plugins { id("com.android.application") }
+
+android {
+    namespace = "org.matrix.dgmodule"
+    compileSdk = 37
+    buildToolsVersion = "37.0.0"
+    defaultConfig {
+        applicationId = "org.matrix.dgmodule"
+        minSdk = 31
+        targetSdk = 37
+        versionCode = 1
+        versionName = "1.0"
+    }
+    buildTypes {
+        release { isMinifyEnabled = false }
+        debug { isDebuggable = false }
+    }
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+    signingConfigs {
+        getByName("debug") {
+            storeFile = file("${System.getProperty("user.home")}/.android/debug.keystore")
+            storePassword = "android"
+            keyAlias = "androiddebugkey"
+            keyPassword = "android"
+        }
+    }
+}
+
+dependencies {
+    compileOnly("io.github.libxposed:api:101.0.1")
+    // de.robv is not published anywhere; compile against the framework's own :legacy output.
+    // Run `../../gradlew :legacy:assembleDebug` from the repository root first.
+    compileOnly(
+        files(
+            "$rootDir/../../legacy/build/intermediates/aar_main_jar/debug/syncDebugLibJars/classes.jar"
+        )
+    )
+}

tests/dispatch-guard/gradlew

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <application android:label="DG Module" android:allowBackup="false">
+        <meta-data android:name="xposedmodule" android:value="true" />
+        <meta-data android:name="xposeddescription" android:value="#798 dispatch guard conformance" />
+        <meta-data android:name="xposedminversion" android:value="101" />
+    </application>
+</manifest>