VerifyError on GoogleAuthUtil class

Question

Sometimes I can find in crash reporting service logs like below

Caused by: java.lang.VerifyError: com/google/android/gms/auth/GoogleAuthUtil
    at com.google.api.client.googleapis.extensions.android.gms.auth.GoogleAccountCredential.getToken(ProGuard:255)
    at com.google.api.client.googleapis.extensions.android.gms.auth.GoogleAccountCredential$RequestHandler.intercept(ProGuard:279)
    at com.google.api.client.http.HttpRequest.execute(ProGuard:859)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(ProGuard:410)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(ProGuard:343)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(ProGuard:460)

From documentation

Thrown when the VM notices that an attempt is made to load a class which does not pass the class verification phase.

It happens very rarely and mostly on rooted devices. This class is packaged within the app so it's weird it doesn't work only on some devices.

I think this is because somebody is trying to modify the app (e.g. through odex or dalvik-cache patching). At the moment I let the app crash, because it's LinkageError and it should not be handled in my opinion. Am I right, or there may be other causes of this problem?

Answer 1

Since VerifyError is thrown during class loading by the JVM if incorrect byte code has been encountered, it's likely that any errors are caused by instrumentation. Your error on Android means that your bytecode contains a reference to com/google/android/gms/auth/GoogleAuthUtil which Dalvik isn't able to load. It could also happen if there are used methods in GoogleAuthUtil which require a higher API level than what's present on the device.

Beyond this, it's hard to deduce more facts from your customer's devices. As you suggest, it could be that someone is trying to modify bytecode of the app or (in case of rooted devices probably more likely) the API resulting in GoogleAuthUtil not executing properly.

Considering that a) you can't deduce the root cause in most cases and b) even if, not do much about it, letting the app crash is perfectly fine imo.