Tencent/tinker · critical · IllegalStateException

Switch instruction at address/index 0x%x/%d refers to the wr

Error message

Switch instruction at address/index 0x%x/%d refers to the wrong type of payload instruction.

What it means

dexlib2 validation error: the switch opcode and its payload opcode disagree — a PACKED_SWITCH must target a PACKED_SWITCH_PAYLOAD and SPARSE_SWITCH must target SPARSE_SWITCH_PAYLOAD. The dex violates this invariant, so dexlib2 refuses to rebuild the method.

Source

Thrown at tinker-build/tinker-patch-lib/src/main/java/org/jf/dexlib2/builder/BuilderMutableMethodImplementation.java:490

                        BuilderInstruction targetInstruction = targetLocation.instruction;
                        if (targetInstruction == null) {
                            throw new IllegalStateException(String.format("Switch instruction at address/index "
                                    + "0x%x/%d points to the end of the method.", location.codeAddress, location.index));
                        }

                        if (targetInstruction.getOpcode() == Opcode.NOP) {
                            targetInstruction = getFirstNonNop(targetLocation.index + 1);
                        }
                        if (targetInstruction == null || !(targetInstruction instanceof BuilderSwitchPayload)) {
                            throw new IllegalStateException(String.format("Switch instruction at address/index "
                                            + "0x%x/%d does not refer to a payload instruction.",
                                    location.codeAddress, location.index));
                        }
                        if ((instruction.opcode == Opcode.PACKED_SWITCH
                                && targetInstruction.getOpcode() != Opcode.PACKED_SWITCH_PAYLOAD)
                                || (instruction.opcode == Opcode.SPARSE_SWITCH
                                        && targetInstruction.getOpcode() != Opcode.SPARSE_SWITCH_PAYLOAD)) {
                            throw new IllegalStateException(String.format("Switch instruction at address/index "
                                            + "0x%x/%d refers to the wrong type of payload instruction.",
                                    location.codeAddress, location.index));
                        }

                        if (!payloadLocations.add(targetLocation)) {
                            throw new IllegalStateException("Multiple switch instructions refer to the same payload. "
                                    + "This is not currently supported. Please file a bug :)");
                        }

                        ((BuilderSwitchPayload) targetInstruction).referrer = location;
                        break;
                    }
                    default: {
                        break;
                    }
                }
            }
        }

View on GitHub (pinned to 1b7ea02c23)

Solutions

Rebuild the offending dex from source without the tool that rewrites switch payloads
Upgrade the Tinker patch toolchain so its dexlib2 matches the dex producer
Verify patch file integrity (checksum/MD5) and re-download/regenerate if damaged

Defensive patterns

Strategy: try-catch

Try / catch

try {
    // patch generation / application over suspect dex
} catch (IllegalStateException e) {
    if (String.valueOf(e.getMessage()).contains("wrong type of payload")) {
        // mark dex invalid, exclude from patch scope
    } else { throw e; }
}

Prevention

Pin stable obfuscation tool versions across base and patch builds
Validate dex with dexdump --verify before including it in the patch pipeline

When it happens

Trigger: A dex where a packed-switch instruction's offset resolves to a sparse-switch payload (or vice versa), encountered while dexlib2 builds instructions during Tinker patch generation or application.

Common situations: Hand-crafted or obfuscator-generated dex that swaps payload types; tools that rewrite switch payloads without fixing the referring instruction; corrupted patch/dex files after bad transfers.

Related errors

AI-assisted analysis of Tencent/tinker@1b7ea02c23 (2026-08-14). Data as JSON: /api/errors/61940ab8c3018017. Report an issue: GitHub.