YouTube Music: ANR on playback — runaway AbstractFuture.toString() recursion (~12k chained futures)

[simonbaren]

Posting here rather than revanced-patches: that tracker is currently unreachable
(github.com/ReVanced/revanced-patches returns HTTP 451, and issues are disabled on the
GitLab mirror). Manager's config.yml points non-Manager-specific reports to this repo.
Happy to refile wherever is preferred.

Summary

Patched YouTube Music freezes and is killed by the system a few seconds to a few minutes
after playback starts. It presents as a crash, but there is no exception and no native
crash — it is an ANR. The main thread is Runnable (never blocked), spinning inside a
recursive toString() walk over a chain of ~11,000–12,700 chained Guava AbstractFuture
objects, building a multi-hundred-megabyte string until the 5 s input-dispatch deadline
expires and ActivityManager force-finishes the process.

Stream spoofing itself works correctly. The failure is in the async plumbing, not in
stream acquisition.

Environment

App	app.revanced.android.apps.youtube.music 8.40.54 (versionCode 84054240)
	minSdk 26, targetSdk 35
Patches	v6.2.1 (default patch selection)
Manager	ReVanced Manager 2.6.0 (app.revanced.manager.flutter)
GmsCore	app.revanced.android.gms 0.3.13.3.250932 (250932006)
	also reproduced on 0.3.13.2.250932 (250932004)
Device	OnePlus 11 (CPH2449), ColorOS, Android 16 / SDK 36, arm64-v8a
Fingerprint	OnePlus/CPH2449/OP594DL1:16/TP1A.220905.001/T.R4T3.457a297-20cee51-20cee58:user/release-keys
Spoof client	ANDROID_REEL_NO_AUTH (default)

Unpatched YouTube Music 8.40.54 on the same device does not exhibit this.

Steps to reproduce

1. Patch YouTube Music 8.40.54 with the default patch set (patches v6.2.1) via ReVanced Manager.
2. Install ReVanced GmsCore 0.3.13.3 and exempt it from battery optimization.
3. Launch the app and play any song.
4. Within ~5 s to ~3 min the UI stops responding; the next touch produces an ANR and the
   app is killed.

Idle launch alone is stable (verified >2 min with no playback). Playback is the trigger.
If a queue is restored at startup, playback begins automatically and it appears to "crash
on launch".

Evidence

It is an ANR, not a crash

E ActivityManager: ANR in app.revanced.android.apps.youtube.music
                   (…/com.google.android.apps.youtube.music.activities.MusicActivity)
E ActivityManager: Reason: Input dispatching timed out … Waited 5000ms for MotionEvent
W ActivityTaskManager: Force finishing activity …MusicActivity
I am_kill : [0,31641,app.revanced.android.apps.youtube.music,0,
             user request after error:Input dispatching timed out …]

logcat -b crash is empty; no FATAL EXCEPTION, no tombstone, across all captures.

Main thread: recursive toString() over a future chain

"main" prio=5 tid=1 Runnable
  | state=R schedstat=( 4975943781 16853383 941 ) utm=326 stm=171
  | held mutexes= "mutator lock"(shared held)

  at java.lang.StringFactory.newStringFromBytes(Native method)
  at java.lang.StringBuilder.toString(StringBuilder.java:500)
  at bhnj.toString(PG:209)
  at java.lang.String.valueOf(String.java:4788)
  at java.lang.StringBuilder.append(StringBuilder.java:183)
  at bhnj.toString(PG:126)
  at bhnw.gW(PG:24)
  at bhnj.toString(PG:148)
  …repeats ~12,000× …
  at android.os.Looper.loopOnce(Looper.java:243)
  at android.os.Looper.loop(Looper.java:412)
  at android.app.ActivityThread.main(ActivityThread.java:9998)

The thread is Runnable and burning CPU (utm=326 stm=171), not waiting on a lock.

bhnj is a Guava AbstractFuture

Confirmed from an unrelated stack in the same process, which shows the
AbstractFuture API surface on the same class:

W FlagStore: Caused by: acrc: 17: API: Phenotype.API is not available on this device.
  at bhmz.c(PG:3)
  at bhnb.run(PG:130)
  at bhnj.e(PG:1)
  at bhnj.j(PG:93)
  at bhnj.setException(PG:17)

bhnw.gW is the nested-future accessor (pendingToString-equivalent). The recursion is
AbstractFuture.toString() → "setFuture=[" + delegate + "]" → delegate's toString(),
walked over an unbounded setFuture chain.

Chain depth across five independent ANR captures

Capture	Total frames	bhnj.toString	bhnw.gW (chain links)
1 (spoof on, GmsCore 0.3.13.2)	63,465	25,377	12,688
2 (spoof off, GmsCore 0.3.13.2)	61,603	24,631	12,316
3 (spoof off, GmsCore 0.3.13.3)	59,016	23,597	11,799
4 (playback trigger isolated)	61,129	24,442	12,221
5 (spoof on, debug logging on)	55,275	22,101	11,050

Highly reproducible and configuration-independent.

Memory signature

The partially-built string dominates the heap; GC runs roughly every 100 ms:

Background concurrent mark compact GC freed 196KB AllocSpace bytes,
  361(199MB) LOS objects, 38% free, 152MB/248MB
Background concurrent mark compact GC freed 132KB AllocSpace bytes,
  271(227MB) LOS objects, 36% free, 169MB/265MB

Single Large-Object-Space allocations of 90–227 MB. (LARGE_HEAP is set, so the process
survives long enough to ANR rather than OOM.)

Stream spoofing is working — it is not the cause

With ReVanced debug logging enabled, every streaming request succeeds:

StreamingDataRequest: Available spoof clients: [ANDROID_REEL_NO_AUTH, ANDROID_VR_1_43_32, VISIONOS]
StreamingDataRequest: Fetching video streams for: V7xx_XBaTJI using client: ANDROID_REEL_NO_AUTH
StreamingDataRequest: video: V7xx_XBaTJI took: 1630ms
StreamingDataRequest: Fetching video streams for: mi6EKPaNt0o using client: ANDROID_REEL_NO_AUTH
StreamingDataRequest: video: mi6EKPaNt0o took: 748ms
StreamingDataRequest: Fetching video streams for: VZ7Q6d5cQUA using client: ANDROID_REEL_NO_AUTH
StreamingDataRequest: video: VZ7Q6d5cQUA took: 246ms

No Playback error lines for the default client, and playback ran ~3 minutes across
several tracks before the ANR. (ANDROID_REEL — not the default — does return
Playback error (App is outdated?) ANDROID_REEL: 400 response: Bad Request.)

Ruled out

• Spoof video streams patch — removing it changes the failure mode but not the outcome;
  the identical recursion occurs with it on and off (captures 1–2 vs 3–5). Verified in the
  decompiled APK that no app class references SpoofVideoStreamsPatch when deselected.

• Spoof client selection — all selectable clients tried; no change.

• App version — 8.40.54 is the suggested version.

• Patch bundle age — v6.2.1 is current.

• GmsCore version — reproduced on both 0.3.13.2 and 0.3.13.3.

• GmsCore background restrictions — already battery-whitelisted
  (user,app.revanced.android.gms,10530), RUN_ANY_IN_BACKGROUND: allow. The
  Cached(nirvana) kill of …gms:persistent occurs after the failures begin.

• App data corruption — clearing data only removes the saved queue (so nothing
  auto-resumes at launch); playback still reproduces it.

• Logged errors as the driver — nothing logged occurs at anywhere near chain scale:

  Event	Occurrences	Chain links
  Empty persistent device token received from InnerTube	29	11,050
  YT.onesie … Response code: 413	15	11,050
  Service not supported: 161	4	11,050
  Invalid playback type; streaming data is not playable	2	11,050

  The chain accumulates silently, which points at a retry/continuation path that calls
  setFuture on a growing chain rather than replacing it.

Suspected cause

An operation on the playback path retries by chaining setFuture onto the same future
instead of replacing the delegate, so the chain grows without bound for the lifetime of the
process. Any later stringification of the head — e.g. Guava's
AbstractFuture.get(long, TimeUnit) timeout path, which embeds toString() in its
TimeoutException message — then walks the whole chain on the main thread.

Two independent bugs are implied:

1. The unbounded setFuture chain (the leak).
2. Stringifying it on the main thread (turns the leak into an ANR). Guava guards against
   self-reference but not against long chains.

Secondary finding: GmsCore phenotype action mismatch

Independent of the above, and worth fixing separately.

Patched YouTube Music requests the un-renamed action against the renamed package:

W GmsClient: unable to connect to service:
             com.google.android.gms.phenotype.service.START on app.revanced.android.gms
W FlagStore: Phenotype.API is not available on this device.
             Connection failed with: sns{statusCode=API_UNAVAILABLE}

APK string table:

String	Occurrences
com.google.android.gms.phenotype.service.START	1
app.revanced.android.gms.phenotype.service.START	0

But the provider authority was rewritten (app.revanced.android.gms.phenotype, 3
occurrences) — so the rewrite is inconsistent: authority renamed, service action not.

GmsCore registrations (aapt2 dump xmltree):

GmsCore	phenotype action
0.3.13.2.250932	app.revanced.android.gms.phenotype.service.START
0.3.13.3.250932	com.google.android.gms.phenotype.service.START

So patches v6.2.1 pair correctly only with 0.3.13.3. On 0.3.13.2 the bind can never
succeed (28 failures in 13 s → 0 after upgrading).

Note also that the GmsCore version check misparses the -user suffix and reports a
downgrade as an upgrade:

I revanced: GmsCoreSupport: GmsCore update available.
            Installed: 0.3.13.3.250932, Latest: 0.3.13.2.250932

Diagnostic method

adb logcat -b all plus dumpsys dropbox --print for the data_app_anr entries and
/data/anr/anr_* stacks (unreadable directly on this non-rooted device). ReVanced debug
logging (revanced_debug + revanced_debug_stacktrace) enabled for the final capture.
APK inspected with aapt2 dump and apktool 2.7.0.