AOSP Source Releases Are So Late Developers Disassemble Libraries to Report Bugs

Android developers have discovered that the open-source Android Operating System (AOSP) source releases are consistently delayed, leading them to resort to disassembling libraries to identify and report bugs. This issue was observed in Android 17 builds from September 2026, specifically with the `wcscspn()` and `wcspbrk()` functions.

When testing the `wcscspn()` and `wcspbrk()` functions using a sample string `s` containing a mix of characters and Unicode code points, including a character with the value U+0100, the expected behavior was for these functions to return a value of 4. However, the output from CP3A.260905.009 showed that the `wcscspn()` function returned 1 instead of the expected 4, and the `wcspbrk()` function returned index 1 instead of the expected 4.

This discrepancy only occurred when the set of characters to reject consisted of more than one character, and all characters were equal to U+0100.

Further investigation into the source code revealed that the `wcscspn()` function in the system library (`libc.so`) on CP3A.260905.009 exhibits a flawed mechanism. When the set of characters to reject contains exactly one character equal to U+0100, the function falls back to calling the `wcschr()` function for each character in the haystack string. This fallback mechanism causes the functions to return incorrect results for code points ranging from U+0100 to U+10FFFF.

The problem appears to be specific to certain sets of characters that trigger the fallback behavior. For instance, when the reject set consists of a single character or two or more characters, all of which are equal to U+0100, the functions work correctly. However, when the reject set consists of multiple characters, including U+0100, the functions fail to provide the expected results.

Android developers have identified this issue and are actively working to report it to the Android Open Source Project (AOSP) maintainers, hoping for a timely fix in future source releases. This incident highlights the importance of timely source releases for developers, as delays can hinder their ability to identify and address critical bugs in a timely manner.