[Android CoreCLR] App crash "A callback was made on a garbage collected delegate" during startup

[kotlarmilos]

Description

When running customer Android apps with the CoreCLR runtime (UseMonoRuntime=false, default partial R2R with generic profile), apps crash during startup with a GC delegate callback error. Reproduced on two customer apps (SeeingAI and AzureUX).

Crash log

Force stopping com.microsoft.azure.dev appid=10208 user=0: from pid 8654
Start proc 8665:com.microsoft.azure.dev/u0a208 for next-top-activity {com.microsoft.azure.dev/crc6431cd41aa6ada328a.SplashScreenActivity}
MAMInfo initialized. Debug=false, Agent=PRODUCTION, ManagedDialogDisabled=false, PolicyRequired=false, MultiIdentityEnabled=true, FullBackupContent=true, DataExtractionRules=true, UseDefaultEnrollment=false, ExceptionOnInit=false, Debuggable=false, IsolatedProcessesAllowed=false
AndroidCryptoNative_InitLibraryOnLoad: jint AndroidCryptoNative_InitLibraryOnLoad(JavaVM *, void *) in /__w/1/s/src/runtime/src/native/libs/System.Security.Cryptography.Native.Android/pal_jni.c
GetOptionalClassGRef: optional class com/android/org/conscrypt/OpenSSLEngineImpl was not found
Checking for metadata for AppLocalesMetadataHolderService : Service not found
Process terminated.
A callback was made on a garbage collected delegate of type '__callback_factory__!callback_delegate__V::Invoke'.
Aborting process.
Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 8665 (osoft.azure.dev), pid 8665 (osoft.azure.dev)
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'google/sdk_gphone64_arm64/emu64a:15/AE3A.240806.043/12960925:userdebug/dev-keys'
Revision: '0'
ABI: 'arm64'
Timestamp: 2026-03-02 13:52:49.725401016+0100
Process uptime: 2s
Cmdline: com.microsoft.azure.dev
pid: 8665, tid: 8665, name: osoft.azure.dev  >>> com.microsoft.azure.dev <<<
uid: 10208
tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
Abort message: 'App secrets string is null or empty'
x0  0000000000000000  x1  00000000000021d9  x2  0000000000000006  x3  0000007fe89be5a0
x4  0000000000000010  x5  0000000000000010  x6  0000000000000010  x7  7f7f7f7f7f7f7f7f
x8  00000000000000f0  x9  0000007ef7923468  x10 ffffff80fffffb9f  x11 0000000000000001
x12 0000007fe89bd320  x13 0000000000000013  x14 0000007fe89bd3d0  x15 000002d027f7f7eb
x16 0000007ef79d2ff8  x17 0000007ef79bd1c0  x18 0000007afaa43800  x19 00000000000021d9
x20 00000000000021d9  x21 00000000ffffffff  x22 b400007d0cd2ee70  x23 0000007bca60acd4
x24 0000007fe89bea70  x25 0000007fe89be690  x26 0000000018380001  x27 0000000000000000
x28 0000007fe89bee50  x29 0000007fe89be620
lr  0000007ef795b6a4  sp  0000007fe89be580  pc  0000007ef795b6d4  pst 0000000000001000
67 total frames
backtrace:
00 pc 000000000005b6d4  /apex/com.android.runtime/lib64/bionic/libc.so (abort+168) (BuildId: 1b9fecf834d610f77e641f026ca7269b)
01 pc 000000000050c4f4  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/lib/arm64/libcoreclr.so (BuildId: 9ec29a9aee50a20213fbdabef6e5e09489c7a0b4)
02 pc 000000000050c3b0  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/lib/arm64/libcoreclr.so (BuildId: 9ec29a9aee50a20213fbdabef6e5e09489c7a0b4)
03 pc 00000000003e32a8  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/lib/arm64/libcoreclr.so (BuildId: 9ec29a9aee50a20213fbdabef6e5e09489c7a0b4)
04 pc 00000000003e0cfc  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/lib/arm64/libcoreclr.so (BuildId: 9ec29a9aee50a20213fbdabef6e5e09489c7a0b4)
05 pc 00000000003e0e30  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/lib/arm64/libcoreclr.so (BuildId: 9ec29a9aee50a20213fbdabef6e5e09489c7a0b4)
06 pc 00000000004d5c4c  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/lib/arm64/libcoreclr.so (BuildId: 9ec29a9aee50a20213fbdabef6e5e09489c7a0b4)
07 pc 000000000009c3a0  /system/framework/arm64/boot.oat (art_jni_trampoline+112) (BuildId: 73f9b9faa342a487ed24dfeab499cec25d5fd3c1)
08 pc 000000000077f320  /apex/com.android.art/lib64/libart.so (nterp_helper+4016) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
09 pc 0000000000c23260  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (crc64e577a4fc45eb42fc.AzureMobileApplication.OnApplicationStart+0)
10 pc 0000000000362774  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
11 pc 000000000035e36c  /apex/com.android.art/lib64/libart.so (_jobject* art::InvokeMethod<(art::PointerSize)8>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jobject*, _jobject*, unsigned long)+540) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
12 pc 00000000006c87f8  /apex/com.android.art/lib64/libart.so (art::Method_invoke(_JNIEnv*, _jobject*, _jobject*, _jobjectArray*) (.__uniq.165753521025965369065708152063621506277)+32) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
13 pc 00000000000a2114  /system/framework/arm64/boot.oat (art_jni_trampoline+116) (BuildId: 73f9b9faa342a487ed24dfeab499cec25d5fd3c1)
14 pc 000000000077f320  /apex/com.android.art/lib64/libart.so (nterp_helper+4016) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
15 pc 000000000039e5e8  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (androidx.lifecycle.ClassesInfoCache$MethodReference.invokeCallback+68)
16 pc 000000000077f2c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
17 pc 000000000039e4d0  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (androidx.lifecycle.ClassesInfoCache$CallbackInfo.invokeMethodsForEvent+32)
18 pc 000000000077e3a4  /apex/com.android.art/lib64/libart.so (nterp_helper+52) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
19 pc 000000000039e47c  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (androidx.lifecycle.ClassesInfoCache$CallbackInfo.invokeCallbacks+16)
20 pc 000000000077f2c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
21 pc 00000000003a2e48  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (androidx.lifecycle.ReflectiveGenericLifecycleObserver.onStateChanged+8)
22 pc 00000000007800e4  /apex/com.android.art/lib64/libart.so (nterp_helper+7540) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
23 pc 00000000003a0afc  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (androidx.lifecycle.LifecycleRegistry$ObserverWithState.dispatchEvent+48)
24 pc 000000000077f2c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
25 pc 00000000003a124c  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (androidx.lifecycle.LifecycleRegistry.forwardPass+172)
26 pc 000000000077f2c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
27 pc 00000000003a14c2  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (androidx.lifecycle.LifecycleRegistry.sync+166)
28 pc 000000000077f2c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
29 pc 00000000003a133c  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (androidx.lifecycle.LifecycleRegistry.moveToState+64)
30 pc 000000000077f2c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
31 pc 00000000003a12b8  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (androidx.lifecycle.LifecycleRegistry.handleLifecycleEvent+28)
32 pc 000000000077f2c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
33 pc 00000000003a2cc0  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (androidx.lifecycle.ProcessLifecycleOwner.activityStarted$lifecycle_process_release+32)
34 pc 000000000077f2c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
35 pc 00000000003a29b2  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (androidx.lifecycle.ProcessLifecycleOwner$attach$1$onActivityPreCreated$1.onActivityPostStarted+14)
36 pc 00000000007800e4  /apex/com.android.art/lib64/libart.so (nterp_helper+7540) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
37 pc 0000000000beb408  /data/app/~~uUn1kyczLXesH2fGYMUHLA==/com.microsoft.azure.dev-rbN0NxQhFgrsdwJofD0OOA==/oat/arm64/base.vdex (com.microsoft.intune.mam.client.lifecycle.MAMActivityLifecycleCallbacks.onActivityPostStarted+4)
38 pc 000000000048bfc4  /system/framework/arm64/boot-framework.oat (android.app.Activity.performStart+2388) (BuildId: 63f4eb325f3987ae1d20b869e98918cda0bfdf73)
39 pc 000000000077f320  /apex/com.android.art/lib64/libart.so (nterp_helper+4016) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
40 pc 00000000001d500c  /system/framework/framework.jar (android.app.ActivityThread.handleStartActivity+44)
41 pc 000000000025f9f8  /system/framework/arm64/boot-framework.oat (android.app.servertransaction.TransactionExecutor.performLifecycleSequence+1048) (BuildId: 63f4eb325f3987ae1d20b869e98918cda0bfdf73)
42 pc 000000000025f548  /system/framework/arm64/boot-framework.oat (android.app.servertransaction.TransactionExecutor.cycleToPath+104) (BuildId: 63f4eb325f3987ae1d20b869e98918cda0bfdf73)
43 pc 000000000077f320  /apex/com.android.art/lib64/libart.so (nterp_helper+4016) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
44 pc 00000000002ff7ee  /system/framework/framework.jar (android.app.servertransaction.TransactionExecutor.executeLifecycleItem+74)
45 pc 000000000077f2c4  /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
46 pc 00000000002ff960  /system/framework/framework.jar (android.app.servertransaction.TransactionExecutor.executeTransactionItems+52)
47 pc 000000000025fc1c  /system/framework/arm64/boot-framework.oat (android.app.servertransaction.TransactionExecutor.execute+156) (BuildId: 63f4eb325f3987ae1d20b869e98918cda0bfdf73)
48 pc 00000000002e8380  /system/framework/arm64/boot-framework.oat (android.app.ActivityThread$H.handleMessage+1840) (BuildId: 63f4eb325f3987ae1d20b869e98918cda0bfdf73)
49 pc 00000000005250c8  /system/framework/arm64/boot-framework.oat (android.os.Handler.dispatchMessage+152) (BuildId: 63f4eb325f3987ae1d20b869e98918cda0bfdf73)
50 pc 0000000000528134  /system/framework/arm64/boot-framework.oat (android.os.Looper.loopOnce+980) (BuildId: 63f4eb325f3987ae1d20b869e98918cda0bfdf73)
51 pc 0000000000527ce4  /system/framework/arm64/boot-framework.oat (android.os.Looper.loop+244) (BuildId: 63f4eb325f3987ae1d20b869e98918cda0bfdf73)
52 pc 00000000002f8a04  /system/framework/arm64/boot-framework.oat (android.app.ActivityThread.main+1572) (BuildId: 63f4eb325f3987ae1d20b869e98918cda0bfdf73)
53 pc 0000000000362a40  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+640) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
54 pc 000000000035e42c  /apex/com.android.art/lib64/libart.so (_jobject* art::InvokeMethod<(art::PointerSize)8>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jobject*, _jobject*, unsigned long)+732) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
55 pc 00000000006c87f8  /apex/com.android.art/lib64/libart.so (art::Method_invoke(_JNIEnv*, _jobject*, _jobject*, _jobjectArray*) (.__uniq.165753521025965369065708152063621506277)+32) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
56 pc 00000000000a2114  /system/framework/arm64/boot.oat (art_jni_trampoline+116) (BuildId: 73f9b9faa342a487ed24dfeab499cec25d5fd3c1)
57 pc 00000000007fccf4  /system/framework/arm64/boot-framework.oat (com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run+116) (BuildId: 63f4eb325f3987ae1d20b869e98918cda0bfdf73)
58 pc 0000000000805f24  /system/framework/arm64/boot-framework.oat (com.android.internal.os.ZygoteInit.main+3028) (BuildId: 63f4eb325f3987ae1d20b869e98918cda0bfdf73)
59 pc 0000000000362a40  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+640) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
60 pc 000000000034df38  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+204) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
61 pc 000000000034beec  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list)+512) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
62 pc 00000000007398bc  /apex/com.android.art/lib64/libart.so (art::JNI<true>::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, std::__va_list)+104) (BuildId: dcb9fe2b5c99aa3f1a682a6008427d08)
63 pc 00000000000d5290  /system/lib64/libandroid_runtime.so (_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...)+104) (BuildId: 7e2a886b7a4523debea27d91258da727)
64 pc 00000000000ea74c  /system/lib64/libandroid_runtime.so (android::AndroidRuntime::start(char const*, android::Vector<android::String8> const&, bool)+908) (BuildId: 7e2a886b7a4523debea27d91258da727)
65 pc 0000000000004568  /system/bin/app_process64 (main+1204) (BuildId: ca426b31a2d06fac00c886329fb5d520)
66 pc 00000000000552cc  /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+116) (BuildId: 1b9fecf834d610f77e641f026ca7269b)

The crash reproduces regardless of R2R vs JIT, or trimming.

Environment

• .NET SDK: 11.0.100-preview.3.26124.102
• Android SDK: Microsoft.Android.Sdk.Darwin 36.1.99-ci.main.162
• CoreCLR Runtime Pack: Microsoft.Android.Runtime.CoreCLR.36.1.android-arm64
• MAUI SDK: 11.0.0-preview.1.26107.1
• Build: Release, net11.0-android, android-arm64, UseMonoRuntime=false
• Device: Android emulator API 35 (arm64-v8a, Google APIs)
• Host: macOS Darwin, Apple Silicon

[jonathanpeppers]

Does this happen for a specific app? Can you link to the project?

[kotlarmilos]

These are first-party apps, I will share the link internally.

[simonrozsival]

We independently hit this same issue and did a deep dive into the root cause. Posting the analysis here for the team:

Root Cause

The bug is in AndroidTypeManager.RegisterNativeMembers in Mono.Android.dll. For __export__ methods, CreateDynamicCallback() creates a Delegate backed by a DynamicMethod inside the __callback_factory__ dynamic assembly. The delegate is stored in a local JniNativeMethodRegistration[] array, passed to JniEnvironment.Types.RegisterNatives(), and then the array goes out of scope — nothing retains a reference to the delegate, so GC collects it.

Compare with JniType.RegisterNativeMethods which correctly retains references:

// JniType.RegisterNativeMethods — retains delegates ✅
this.methods = methods;  // prevents GC collection

For non-[Export] methods (e.g., GetOnCreateHandler), delegates are cached in static fields by generated connector code, so they survive GC. Only [Export] delegates are affected.

Suggested Fix

Root the dynamically-created [Export] callback delegates in a static collection, or use nativeClass.RegisterNativeMethods(array) (the JniType method) instead of JniEnvironment.Types.RegisterNatives directly, since JniType already retains the array.

Workaround

Replace ILifecycleObserver + [Export] with IDefaultLifecycleObserver (or ILifecycleEventObserver), which use standard JNI callback registration with properly-rooted static delegate fields. This avoids the [Export] code path entirely.

Test Matrix

TFM	Runtime	Result
net9.0-android	MonoVM (default)	✅ 5/5 OK
net10.0-android	MonoVM (default)	✅ 5/5 OK
net10.0-android + UseMonoRuntime=false	CoreCLR	❌ 5/5 CRASH
net11.0-android	CoreCLR (default)	❌ 5/5 CRASH
net11.0-android + workaround	CoreCLR (default)	✅ 5/5 OK

See also #10996 (closed as dup) for additional details.

/cc @jonathanpeppers

[simonrozsival]

Note

This comment was generated with the help of Copilot.

Root cause analysis: Why MonoVM does not collect the delegate but CoreCLR does

The discrepancy comes down to what kind of GC handle each runtime creates inside Marshal.GetFunctionPointerForDelegate (or the equivalent internal path when a delegate is marshaled to a native function pointer).

CoreCLR: unconditionally uses a weak handle

In src/coreclr/vm/comdelegate.cpp (COMDelegate::ConvertToCallback), the delegate is stored in a UMEntryThunk via:

// comdelegate.cpp, inside COMDelegate::ConvertToCallback
OBJECTHANDLE objhnd = GetAppDomain()->CreateLongWeakHandle(pDelegate);

This is a HNDTYPE_WEAK_LONG handle — it does not prevent the GC from collecting the delegate. If the delegate is later collected, the thunk detects it via IsCollectedDelegate() and aborts with "A callback was made on a garbage collected delegate".

This is by design — the documentation for Marshal.GetFunctionPointerForDelegate explicitly states:

"You must manually keep the delegate from being collected by the garbage collector from managed code. The garbage collector does not track references to unmanaged code."

Mono: uses a strong handle for static delegates (no target)

In src/mono/mono/metadata/marshal.c (mono_delegate_to_ftnptr_impl), after creating the native trampoline, the delegate is added to a global delegate_hash_table:

// marshal.c — delegate_hash_table_add
if (has_target) {
    // Instance delegate → weak GC handle (can be collected)
    gchandle = mono_gchandle_new_weakref_from_handle(...);
    g_hash_table_insert(delegate_hash_table, delegate_trampoline, gchandle);
} else {
    // Static delegate → STRONG GC handle (permanently rooted!)
    gchandle = mono_gchandle_from_handle(..., FALSE);  // ← strong handle
    // "We don't free this delegate object because it is too expensive
    //  to keep track of these pairs and avoid races with the delegate finalization."
    g_hash_table_insert(delegate_hash_table, delegate_trampoline, gchandle);
}

mono_gchandle_from_handle(d, FALSE) allocates a HANDLE_NORMAL (strong) GC handle, which acts as a permanent GC root.

Additionally, this strong handle is never freed — it has double protection:

1. delegate_hash_table_remove returns early for static delegates:

   if (!d->target) return;  // static delegates are never removed from the hash table

2. mono_delegate_free_ftnptr also returns early:

   if (!delegate->target) {
       /* The wrapper method is shared between delegates -> no need to free it */
       return;
   }

Why this matters for [Export]

The [Export] callback delegates created by DynamicCallbackCodeGenerator.Create(method) are static delegates (backed by DynamicMethod, no target). So:

Runtime	Handle type	Delegate collected?
MonoVM	Strong (via delegate_hash_table)	No — permanently rooted
CoreCLR	Weak (CreateLongWeakHandle)	Yes — GC can collect anytime

On MonoVM, the bug in AndroidTypeManager.RegisterNativeMembers (not retaining the delegate array after RegisterNatives) was silently masked because Mono's internal GetFunctionPointerForDelegate implementation permanently roots static delegates. On CoreCLR, the weak handle means the delegate becomes eligible for collection as soon as managed code drops its last reference — which happens immediately when the local JniNativeMethodRegistration[] array goes out of scope.

This is why the crash is 100% reproducible on CoreCLR but was never observed on MonoVM — it's not a race condition in the traditional sense, but rather a latent bug that was hidden by Mono's more aggressive delegate rooting strategy.

[simonrozsival]

Fixed in #10997