Actually sorry, it may be possible to create a sample project which could replicate this issue. If needed then please let me know.

Thank you for reporting this issue. For us to further investigate this issue, please provide the following additional information:

Sample application to reproduce the issue.

Android build
Which Android build are you using? (e.g. KVT49L)

Steps to reproduce
What steps do others need to take in order to reproduce the issue themselves?

Frequency
How frequently does this issue occur? (e.g 100% of the time, 10% of the time)

Android bug report
After reproducing the issue, press the volume up, volume down, and power button simultaneously. This will capture a bug report on your device in the “bug reports” directory. Attach the bug report  file to this issue.

Alternate method:
After reproducing the issue, navigate to developer settings, ensure ‘USB debugging’ is enabled, then enable ‘Bug report shortcut’. To take bug report, hold the power button and select the ‘Take bug report’ option.

Please upload the files to Google Drive and share the folder to android-bugreport@google.com, then share the link here.

After further debugging, the issue is called by calling notifyItemChanged() with a negative argument. Shouldn't there perhaps be a range check in that method?

For us to further check this case and find the possible root cause, we would need details as requested in comment #3.

Unfortunately we do not have enough actionable information to proceed further on this issue. Kindly share the requested details and raise a new bug in case issue is seen in future.

Would it be possible to reopen this issue? I believe I've found the same thing although in my case the index is off the end of the array.  I've created a sample application which reproduces the issue:

https://drive.google.com/file/d/1AB-Gl_hfkO9SBTYIiLJ1tMjQcMeB7ttl/view?usp=sharing

NOTE: The device resolution is important because the number of elements visible and the number of elements added to the RecyclerView is specific.  Please run this on an emulator of 1080x1920 (confirmed on Pixel API 27 and Nexus 5 API 25).

Repro steps:
1. Create an emulator with 1080x1920.
2. Launch the StaggeredBug sample on the emulator.
3. Click the button at the bottom of the view.

Callstack:
java.lang.ArrayIndexOutOfBoundsException: Array index out of range: 13
        at java.util.Arrays.rangeCheck(Arrays.java:1598)
        at java.util.Arrays.fill(Arrays.java:2928)
        at androidx.recyclerview.widget.StaggeredGridLayoutManager$LazySpanLookup.invalidateAfter(StaggeredGridLayoutManager.java:2878)
        at androidx.recyclerview.widget.StaggeredGridLayoutManager.handleUpdate(StaggeredGridLayoutManager.java:1550)
        at androidx.recyclerview.widget.StaggeredGridLayoutManager.onItemsUpdated(StaggeredGridLayoutManager.java:1526)
        at androidx.recyclerview.widget.RecyclerView$6.dispatchUpdate(RecyclerView.java:1016)
        at androidx.recyclerview.widget.RecyclerView$6.onDispatchSecondPass(RecyclerView.java:1027)
        at androidx.recyclerview.widget.AdapterHelper.consumePostponedUpdates(AdapterHelper.java:121)
        at androidx.recyclerview.widget.AdapterHelper.consumeUpdatesInOnePass(AdapterHelper.java:557)
        at androidx.recyclerview.widget.RecyclerView.dispatchLayoutStep2(RecyclerView.java:3918)
        at androidx.recyclerview.widget.RecyclerView.dispatchLayout(RecyclerView.java:3641)
        at androidx.recyclerview.widget.RecyclerView.onLayout(RecyclerView.java:4194)
        at android.view.View.layout(View.java:17637)
        at android.view.ViewGroup.layout(ViewGroup.java:5575)
        at android.widget.LinearLayout.setChildFrame(LinearLayout.java:1741)
        at android.widget.LinearLayout.layoutVertical(LinearLayout.java:1585)
        at android.widget.LinearLayout.onLayout(LinearLayout.java:1494)
        at android.view.View.layout(View.java:17637)
        at android.view.ViewGroup.layout(ViewGroup.java:5575)
        at android.widget.FrameLayout.layoutChildren(FrameLayout.java:323)
        at android.widget.FrameLayout.onLayout(FrameLayout.java:261)
        at android.view.View.layout(View.java:17637)
        at android.view.ViewGroup.layout(ViewGroup.java:5575)
        at androidx.appcompat.widget.ActionBarOverlayLayout.onLayout(ActionBarOverlayLayout.java:444)
        at android.view.View.layout(View.java:17637)
        at android.view.ViewGroup.layout(ViewGroup.java:5575)
        at android.widget.FrameLayout.layoutChildren(FrameLayout.java:323)
        at android.widget.FrameLayout.onLayout(FrameLayout.java:261)
        at android.view.View.layout(View.java:17637)
        at android.view.ViewGroup.layout(ViewGroup.java:5575)
        at android.widget.LinearLayout.setChildFrame(LinearLayout.java:1741)
        at android.widget.LinearLayout.layoutVertical(LinearLayout.java:1585)
        at android.widget.LinearLayout.onLayout(LinearLayout.java:1494)
        at android.view.View.layout(View.java:17637)
        at android.view.ViewGroup.layout(ViewGroup.java:5575)
        at android.widget.FrameLayout.layoutChildren(FrameLayout.java:323)
        at android.widget.FrameLayout.onLayout(FrameLayout.java:261)
        at com.android.internal.policy.DecorView.onLayout(DecorView.java:726)
        at android.view.View.layout(View.java:17637)
        at android.view.ViewGroup.layout(ViewGroup.java:5575)
        at android.view.ViewRootImpl.performLayout(ViewRootImpl.java:2346)
        at android.view.ViewRootImpl.performTraversals(ViewRootImpl.java:2068)
        at android.view.ViewRootImpl.doTraversal(ViewRootImpl.java:1254)
        at android.view.ViewRootImpl$TraversalRunnable.run(ViewRootImpl.java:6337)
        at android.view.Choreographer$CallbackRecord.run(Choreographer.java:874)
        at android.view.Choreographer.doCallbacks(Choreographer.java:686)
        at android.view.Choreographer.doFrame(Choreographer.java:621)
        at android.view.Choreographer$FrameDisplayEventReceiver.run(Choreographer.java:860)
        at android.os.Handler.handleCallback(Handler.java:751)
        at android.os.Handler.dispatchMessage(Handler.java:95)
        at android.os.Looper.loop(Looper.java:154)
        at android.app.ActivityThread.main(ActivityThread.java:6119)
        at java.lang.reflect.Method.invoke(Native Method)
        at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:886)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:776)
Application terminated.

It seems like the call to ensureSize(positionStart + itemCount) in offsetForAddition isn't correct; maybe something like ensureSize(mFullSpanItems.size() + itemCount)?

Thanks,
Tim

https://drive.google.com/file/d/1AB-Gl_hfkO9SBTYIiLJ1tMjQcMeB7ttl/view?usp=drive_web (StaggeredBug.tgz)

To describe what's happening in the sample, clicking the button adds a chunk of elements to the ListAdapter but also modifies an existing element. The real-world use case is a list of category headers which expand when clicked.  After applying the two changes to the adapter, the DiffUtil is creating two ops of [ADD, UPDATE]. The ADD operation modifies mFullSpanItems.mPosition to be something like [1, 2, 3, 4, 5, 11, 12, 13, 14]. The op also tries to ensure that mData is large enough but instead does nothing. The UPDATE op then does an array copy by utilizing the mPosition values from the previous op. These mPosition values are outside the bounds of the array.