Tencent/tinker · critical · IllegalStateException

Multiple switch instructions refer to the same payload. This

Error message

Multiple switch instructions refer to the same payload. This is not currently supported. Please file a bug :)

What it means

dexlib2 builder validation error: two or more switch instructions target the same switch payload location. The builder tracks payloads in a HashSet; a duplicate means the dex shares one payload between multiple switches, which the builder's one-referrer model does not support.

Source

Thrown at tinker-build/tinker-patch-lib/src/main/java/org/jf/dexlib2/builder/BuilderMutableMethodImplementation.java:496

                        if (targetInstruction.getOpcode() == Opcode.NOP) {
                            targetInstruction = getFirstNonNop(targetLocation.index + 1);
                        }
                        if (targetInstruction == null || !(targetInstruction instanceof BuilderSwitchPayload)) {
                            throw new IllegalStateException(String.format("Switch instruction at address/index "
                                            + "0x%x/%d does not refer to a payload instruction.",
                                    location.codeAddress, location.index));
                        }
                        if ((instruction.opcode == Opcode.PACKED_SWITCH
                                && targetInstruction.getOpcode() != Opcode.PACKED_SWITCH_PAYLOAD)
                                || (instruction.opcode == Opcode.SPARSE_SWITCH
                                        && targetInstruction.getOpcode() != Opcode.SPARSE_SWITCH_PAYLOAD)) {
                            throw new IllegalStateException(String.format("Switch instruction at address/index "
                                            + "0x%x/%d refers to the wrong type of payload instruction.",
                                    location.codeAddress, location.index));
                        }

                        if (!payloadLocations.add(targetLocation)) {
                            throw new IllegalStateException("Multiple switch instructions refer to the same payload. "
                                    + "This is not currently supported. Please file a bug :)");
                        }

                        ((BuilderSwitchPayload) targetInstruction).referrer = location;
                        break;
                    }
                    default: {
                        break;
                    }
                }
            }
        }

        boolean madeChanges;
        do {
            madeChanges = false;

            for (int index = 0; index < instructionList.size(); index++) {

View on GitHub (pinned to 1b7ea02c23)

Solutions

Upgrade Tinker / dexlib2 — shared-payload handling has fixes in newer smali releases
Disable the dex optimization/protector that merges switch payloads and rebuild
Report to the Tinker/smali issue tracker with the offending dex if the dex is verified valid

Defensive patterns

Strategy: try-catch

Try / catch

try {
    // dexlib2 builder conversion
} catch (IllegalStateException e) {
    if (String.valueOf(e.getMessage()).contains("same payload")) {
        // exclude offending dex from patch, notify tooling team
    } else { throw e; }
}

Prevention

Upgrade Tinker regularly for shared-payload fixes in bundled smali/dexlib2
Report reproducible cases upstream with the offending dex

When it happens

Trigger: A method contains multiple PACKED_SWITCH/SPARSE_SWITCH instructions whose offsets all resolve to the same payload location; hit when Tinker runs dexlib2's instruction-building pass over such a dex.

Common situations: Size-optimized or obfuscated dex where a protector merges switch payloads; occasionally a genuine dexlib2 bug on legal-but-rare dex shapes ('Please file a bug' message).

Related errors

AI-assisted analysis of Tencent/tinker@1b7ea02c23 (2026-08-14). Data as JSON: /api/errors/6bc3c7831f2f8332. Report an issue: GitHub.