skylot/jadx · error · JadxRuntimeException

Payload for fill-array not found at {}

Error message

Payload for fill-array not found at {}

What it means

Thrown during instruction post-processing when a FILL_ARRAY instruction references a payload instruction at a specific code offset, but no FILL_ARRAY_DATA instruction exists at that offset. In Dalvik bytecode, fill-array-data instructions are followed by a data payload at a nearby offset; if that payload is missing or relocated, the instruction stream is malformed.

Source

Thrown at jadx-core/src/main/java/jadx/core/dex/visitors/ProcessInstructionsVisitor.java:112

					if (insn.getResult() == null) {
						mergeMoveResult(insnByOffset, offset, insn, ArgType.STRING);
					}
					break;

				case FILLED_NEW_ARRAY:
					ArgType arrType = ((FilledNewArrayNode) insn).getArrayType();
					mergeMoveResult(insnByOffset, offset, insn, arrType);
					break;

				case FILL_ARRAY:
					FillArrayInsn fillArrayInsn = (FillArrayInsn) insn;
					int target = fillArrayInsn.getTarget();
					InsnNode arrDataInsn = getInsnAtOffset(insnByOffset, target);
					if (arrDataInsn != null && arrDataInsn.getType() == InsnType.FILL_ARRAY_DATA) {
						fillArrayInsn.setArrayData((FillArrayData) arrDataInsn);
						removeInsn(insnByOffset, arrDataInsn);
					} else {
						throw new JadxRuntimeException("Payload for fill-array not found at " + InsnUtils.formatOffset(target));
					}
					break;

				default:
					break;
			}
		}
	}

	private static void attachSwitchData(InsnNode[] insnByOffset, int offset, SwitchInsn sw) {
		int nextInsnOffset = getNextInsnOffset(insnByOffset, offset);
		int dataTarget = sw.getDataTarget();
		InsnNode switchDataInsn = getInsnAtOffset(insnByOffset, dataTarget);
		if (switchDataInsn != null && switchDataInsn.getType() == InsnType.SWITCH_DATA) {
			SwitchData data = (SwitchData) switchDataInsn;
			data.fixTargets(offset);
			sw.attachSwitchData(data, nextInsnOffset);
			removeInsn(insnByOffset, switchDataInsn);

View on GitHub (pinned to e738a26571)

Solutions

1. Verify the DEX file integrity with tools like dexdump or baksmali before decompiling
2. Update jadx — new versions add resilience to malformed instruction streams
3. Report the APK as a jadx issue with the method offset for investigation
4. Try unpacking the APK with a generic unpacker first if a packer/protector is suspected

// Validate DEX file integrity before decompiling
try {
    com.android.tools.smali.dexlib2.DexFileFactory.loadDexFile(apkFile, null);
} catch (Exception e) {
    throw new IllegalArgumentException("Invalid or corrupted DEX file", e);
}

try {
    jadxDecompiler.load();
    jadxDecompiler.save();
} catch (JadxRuntimeException e) {
    if (e.getMessage().contains("Payload for fill-array not found")) {
        LOG.warn("Malformed fill-array payload in input, trying fallback mode");
        args.setFallbackMode(true);
        // Re-run with fallback for affected classes
    }
}

When it happens

Trigger: A FillArrayInsn.getTarget() returns an offset where insnByOffset[offset] is either null or not of type InsnType.FILL_ARRAY_DATA. The payload was stripped, moved, or never generated by the DEX producer.

Common situations: Aggressive obfuscators (e.g., DEX-level packers) that split or relocate array-data payloads away from their fill-array instructions; DEX files produced by non-standard or experimental compilers; corrupted or truncated DEX sections.

Related errors

• Payload for switch not found at {}
• Bad name for type variable: {}
• Can't parse type: {}, unexpected: {}
• Unknown array element width: {}
• Unknown type: {}, expected: {}

AI-assisted analysis of skylot/jadx@e738a26571 (2026-08-14). Data as JSON: /api/errors/73c7db09d284959c. Report an issue: GitHub.