Crash in selection library [128054552]

Fixed

Bug

Status Update

No update yet.

Description

al...@gmail.com

created issue #1

Mar 10, 2019 12:17AM

I don't know how to reproduce this, but I'm getting these crashes from my users:

Fatal Exception: java.lang.IllegalStateException: Range start point not set.
at androidx.core.util.Preconditions.checkState(SourceFile:96)
at androidx.recyclerview.selection.DefaultSelectionTracker.extendProvisionalRange(SourceFile:281)
at androidx.recyclerview.selection.GestureSelectionHelper.extendSelection(SourceFile:227)
at androidx.recyclerview.selection.GestureSelectionHelper.handleMoveEvent(SourceFile:204)
at androidx.recyclerview.selection.GestureSelectionHelper.handleTouch(SourceFile:151)
at androidx.recyclerview.selection.GestureSelectionHelper.onTouchEvent(SourceFile:125)
at androidx.recyclerview.selection.TouchEventRouter.onTouchEvent(SourceFile:103)
at androidx.recyclerview.widget.RecyclerView.dispatchToOnItemTouchListeners(SourceFile:3035)
at android.view.View.dispatchTouchEvent(View.java:10775)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2859)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2535)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2865)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2550)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2865)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2550)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2865)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2550)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2865)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2550)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2865)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2550)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2865)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2550)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2865)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2550)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2865)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2550)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2865)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2550)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2865)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2550)
at com.android.internal.policy.DecorView.superDispatchTouchEvent(DecorView.java:568)
at com.android.internal.policy.PhoneWindow.superDispatchTouchEvent(PhoneWindow.java:1896)
at android.app.Activity.dispatchTouchEvent(Activity.java:3247)
at com.supercilex.robotscouter.core.ui.ActivityBase.dispatchTouchEvent(SourceFile:82)
at androidx.appcompat.view.WindowCallbackWrapper.dispatchTouchEvent(SourceFile:69)
at androidx.appcompat.view.WindowCallbackWrapper.dispatchTouchEvent(SourceFile:69)
at com.android.internal.policy.DecorView.dispatchTouchEvent(DecorView.java:530)
at android.view.View.dispatchPointerEvent(View.java:11004)
at android.view.ViewRootImpl$ViewPostImeInputStage.processPointerEvent(ViewRootImpl.java:5111)
at android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:4963)
at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:4494)
at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:4547)
at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:4513)
at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:4646)
at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:4521)
at android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:4703)
at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:4494)
at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:4547)
at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:4513)
at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:4521)
at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:4494)
at android.view.ViewRootImpl.deliverInputEvent(ViewRootImpl.java:7003)
at android.view.ViewRootImpl.doProcessInputEvents(ViewRootImpl.java:6934)
at android.view.ViewRootImpl.enqueueInputEvent(ViewRootImpl.java:6895)
at android.view.ViewRootImpl$WindowInputEventReceiver.onInputEvent(ViewRootImpl.java:7113)
at android.view.InputEventReceiver.dispatchInputEvent(InputEventReceiver.java:185)
at android.view.InputEventReceiver.nativeConsumeBatchedInputEvents(InputEventReceiver.java)
at android.view.InputEventReceiver.consumeBatchedInputEvents(InputEventReceiver.java:176)
at android.view.ViewRootImpl.doConsumeBatchedInput(ViewRootImpl.java:7077)
at android.view.ViewRootImpl$ConsumeBatchedInputRunnable.run(ViewRootImpl.java:7140)
at android.view.Choreographer$CallbackRecord.run(Choreographer.java:927)
at android.view.Choreographer.doCallbacks(Choreographer.java:702)
at android.view.Choreographer.doFrame(Choreographer.java:632)
at android.view.Choreographer$FrameDisplayEventReceiver.run(Choreographer.java:913)
at android.os.Handler.handleCallback(Handler.java:751)
at android.os.Handler.dispatchMessage(Handler.java:95)
at android.os.Looper.loop(Looper.java:154)
at android.app.ActivityThread.main(ActivityThread.java:6836)
at java.lang.reflect.Method.invoke(Method.java)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1520)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1410)

Comments

sm...@google.com <sm...@google.com> #2Apr 5, 2019 04:37PM

Do you know what device(s) this is happening on? Looks like it's crashing in the framework code perhaps in autogenerated binder code.

android.hardware.fingerprint.IFingerprintService$Stub$Proxy.authenticate(IFingerprintService.java:341)

ap...@google.com <ap...@google.com> #3Apr 8, 2019 08:47PM

So far seeing on:

LGE LM-Q710(FGN)
LGE LM-X220
LGE LM-X410(FG)
BlackBerry BBB100-1
TCL REVVL 2

je...@gmail.com <je...@gmail.com> #4Apr 10, 2019 02:26AM

We also observed similar crash in IFingerprintService.cancelAuthentication(IFingerprintService.java:320)

Caused by java.lang.NullPointerException: Attempt to invoke interface method 'int java.util.List.size()' on a null object reference
       at android.os.Parcel.readException(Parcel.java:2019)
       at android.os.Parcel.readException(Parcel.java:1959)
       at android.hardware.fingerprint.IFingerprintService$Stub$Proxy.cancelAuthentication(IFingerprintService.java:320)
       at android.hardware.fingerprint.FingerprintManager.cancelAuthentication(FingerprintManager.java:1020)
       at android.hardware.fingerprint.FingerprintManager.-wrap2(FingerprintManager.java)
       at android.hardware.fingerprint.FingerprintManager$OnAuthenticationCancelListener.onCancel(FingerprintManager.java:224)
       at android.os.CancellationSignal.cancel(CancellationSignal.java:77)
       at androidx.core.os.CancellationSignal.cancel(CancellationSignal.java:84)
       at androidx.biometric.FingerprintHelperFragment.cancel(FingerprintHelperFragment.java:301)
       at androidx.biometric.BiometricPrompt.dismissFingerprintFragments(BiometricPrompt.java:984)
       at androidx.biometric.BiometricPrompt.access$800(BiometricPrompt.java:67)
       at androidx.biometric.BiometricPrompt$2.onPause(BiometricPrompt.java:520)
       at java.lang.reflect.Method.invoke(Method.java)
       at androidx.lifecycle.ClassesInfoCache$MethodReference.invokeCallback(ClassesInfoCache.java:216)
       at androidx.lifecycle.ClassesInfoCache$CallbackInfo.invokeMethodsForEvent(ClassesInfoCache.java:194)
       at androidx.lifecycle.ClassesInfoCache$CallbackInfo.invokeCallbacks(ClassesInfoCache.java:185)
       at androidx.lifecycle.ReflectiveGenericLifecycleObserver.onStateChanged(ReflectiveGenericLifecycleObserver.java:36)
       at androidx.lifecycle.LifecycleRegistry$ObserverWithState.dispatchEvent(LifecycleRegistry.java:361)
       at androidx.lifecycle.LifecycleRegistry.backwardPass(LifecycleRegistry.java:316)
       at androidx.lifecycle.LifecycleRegistry.sync(LifecycleRegistry.java:334)
       at androidx.lifecycle.LifecycleRegistry.moveToState(LifecycleRegistry.java:145)
       at androidx.lifecycle.LifecycleRegistry.handleLifecycleEvent(LifecycleRegistry.java:131)
       at androidx.lifecycle.ReportFragment.dispatch(ReportFragment.java:123)
       at androidx.lifecycle.ReportFragment.onPause(ReportFragment.java:96)
       at android.app.Fragment.performPause(Fragment.java:2709)
       at android.app.FragmentManagerImpl.moveToState(FragmentManagerImpl.java:1334)
       at android.app.FragmentManagerImpl.moveFragmentToExpectedState(FragmentManagerImpl.java:1557)
       at android.app.FragmentManagerImpl.moveToState(FragmentManagerImpl.java:1618)
       at android.app.FragmentManagerImpl.dispatchMoveToState(FragmentManagerImpl.java:3027)
       at android.app.FragmentManagerImpl.dispatchPause(FragmentManagerImpl.java:2993)
       at android.app.FragmentController.dispatchPause(FragmentController.java:211)
       at android.app.Activity.performPause(Activity.java:7170)
       at android.app.Instrumentation.callActivityOnPause(Instrumentation.java:1409)
       at android.app.ActivityThread.performPauseActivityIfNeeded(ActivityThread.java:4026)
       at android.app.ActivityThread.performPauseActivity(ActivityThread.java:4003)
       at android.app.ActivityThread.performPauseActivity(ActivityThread.java:3977)
       at android.app.ActivityThread.handlePauseActivity(ActivityThread.java:3951)
       at android.app.ActivityThread.-wrap15(ActivityThread.java)
       at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1647)
       at android.os.Handler.dispatchMessage(Handler.java:106)
       at android.os.Looper.loop(Looper.java:175)
       at android.app.ActivityThread.main(ActivityThread.java:6724)
       at java.lang.reflect.Method.invoke(Method.java)
       at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:438)
       at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:810)

BUILD INFO

Device type: LG K11
OS version: 8.1.0
Biometric library version: androidx.biometric:biometric:1.0.1

je...@gmail.com <je...@gmail.com> #5Apr 10, 2019 02:32AM

We're also seeing this occasionally - we've seen the FingerprintHelperFragment stack trace reported above, as well as this slightly different one (they all have the same underlying cause):

Caused by java.lang.NullPointerException: Attempt to invoke interface method 'int java.util.List.size()' on a null object reference
       at android.os.Parcel.createException(Parcel.java:1959)
       at android.os.Parcel.readException(Parcel.java:1921)
       at android.os.Parcel.readException(Parcel.java:1871)
       at android.hardware.fingerprint.IFingerprintService$Stub$Proxy.authenticate(IFingerprintService.java:339)
       at android.hardware.fingerprint.FingerprintManager.authenticate(FingerprintManager.java:480)
       at android.hardware.fingerprint.FingerprintManager.authenticate(FingerprintManager.java:557)
       at android.hardware.biometrics.BiometricPrompt.authenticate(BiometricPrompt.java:435)
       at androidx.biometric.BiometricFragment.onCreateView(BiometricFragment.java:311)
       at androidx.fragment.app.Fragment.performCreateView(Fragment.java:2698)
       at androidx.fragment.app.FragmentStateManager.createView(FragmentStateManager.java:320)
       at androidx.fragment.app.FragmentManager.moveToState(FragmentManager.java:1187)
       at androidx.fragment.app.FragmentManager.moveToState(FragmentManager.java:1356)
       at androidx.fragment.app.FragmentManager.moveFragmentToExpectedState(FragmentManager.java:1434)
       at androidx.fragment.app.FragmentManager.moveToState(FragmentManager.java:1497)
       at androidx.fragment.app.FragmentManager.dispatchStateChange(FragmentManager.java:2625)
       at androidx.fragment.app.FragmentManager.dispatchPause(FragmentManager.java:2593)
       at androidx.fragment.app.FragmentController.dispatchPause(FragmentController.java:280)
       at androidx.fragment.app.FragmentActivity.onPause(FragmentActivity.java:419)
       at android.app.Activity.performPause(Activity.java:7663)
       at android.app.Instrumentation.callActivityOnPause(Instrumentation.java:1536)
       at android.app.ActivityThread.performPauseActivityIfNeeded(ActivityThread.java:4699)
       at android.app.ActivityThread.performPauseActivity(ActivityThread.java:4664)
       at android.app.ActivityThread.handlePauseActivity(ActivityThread.java:4599)
       at android.app.servertransaction.PauseActivityItem.execute(PauseActivityItem.java:45)
       at android.app.servertransaction.TransactionExecutor.executeLifecycleState(TransactionExecutor.java:145)
       at android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:70)
       at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2185)
       at android.os.Handler.dispatchMessage(Handler.java:112)
       at android.os.Looper.loop(Looper.java:216)
       at android.app.ActivityThread.main(ActivityThread.java:7593)
       at java.lang.reflect.Method.invoke(Method.java)
       at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:524)
       at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:987)

We've only rolled this out to 10% of our user base so far, but here's our current list of affected devices:

Count	Device
4	INFINIX MOBILITY LIMITED Infinix X606D (Android 8.1.0)
2	Sony G8441 (Android 9)
2	Xiaomi Mi A1 (Android 9)
2	HUAWEI LLD-L21 (Android 9)
2	samsung SM-G935F (Android 8.0.0)
2	vivo vivo 1904 (Android 9)
2	HUAWEI FIG-LX1 (Android 9)
1	HUAWEI LDN-L01 (Android 8.0.0)
1	HUAWEI ANE-LX1 (Android 9)

There's some discussion of the underlying framework bug in this Github issue, which I believe is now fixed. Ultimately they ended up working around it by catching the NPE - it'd be great if androidx.biometric could implement a similar workaround, as unpleasant as it may be.

screen-20190409-212524.mp4

1.5 MB

Download

ap...@google.com <ap...@google.com> #6May 14, 2019 07:04PM

Project: platform/frameworks/support
Branch: androidx-master-dev

commit 7e9dd629009e348407a00e936f7b0927dbee7c30
Author: Grace Cheng <graciecheng@google.com>
Date: Tue Oct 06 11:52:41 2020

Address uncaught NPE during fingerprint authentication

Updates androidx.biometric.BiometricFragment to catch potential NullPointerException in autogenerated binder code from FingerprintManagerCompat authenticate call

Test: ./gradlew biometric:biometric:test
Test: ./gradlew biometric:biometric:connectedAndroidTest
Test: ./gradlew biometric:integration-tests:testapp:connectedAndroidTest

Bug: 151316421
Change-Id: I713d529fecd08a396e998f8ccf6a3d83e46bf508

M biometric/biometric/src/main/java/androidx/biometric/BiometricFragment.java
M biometric/biometric/src/test/java/androidx/biometric/BiometricFragmentTest.java

https://android-review.googlesource.com/1453556

sm...@google.com <sm...@google.com> #7May 14, 2019 07:07PM

Re-assigning to curtis, since Grace merged a fix for the original bug. I think Curtis is adding some additional NPE checks before closing

sm...@google.com <sm...@google.com> #8May 14, 2019 07:08PM

Project: platform/frameworks/support
Branch: androidx-master-dev

commit 619b21f179cbf6194a9f4084f90a26fd75c0abd2
Author: Curtis Belmonte <curtislb@google.com>
Date: Fri Oct 09 15:03:31 2020

Catch more NPEs from framework biometric methods

Adds more checks to catch and handle NullPointerExceptions that may be
thrown by framework biometric methods, such as authenticate() or
cancelAuthentication().

Test: Biometric integration test app on API 27-30.
Test: ./gradlew biometric:biometric:test
Test: ./gradlew biometric:biometric:connectedAndroidTest
Test: ./gradlew biometric:integration-tests:testapp:connectedAndroidTest

Fixes: 151316421
Change-Id: I7d1b60ee727311c2bb1257942bd66beb4dd044e5

M biometric/biometric/src/main/java/androidx/biometric/BiometricFragment.java
M biometric/biometric/src/main/java/androidx/biometric/CancellationSignalProvider.java
M biometric/biometric/src/test/java/androidx/biometric/BiometricFragmentTest.java
M biometric/biometric/src/test/java/androidx/biometric/CancellationSignalProviderTest.java

https://android-review.googlesource.com/1456459

sh...@google.com <sh...@google.com> May 14, 2019 07:13PM

Marked as fixed, reassigned to sm...@google.com.

al...@gmail.com <al...@gmail.com> #9Jul 7, 2019 09:01PM

This isn't fixed in alpha 6 :(. It's easily reproducible by starting a drag with one finger and then tapping somewhere else (think back button) which calls clearSelection().

PS: this issue is a duplicate:

https://issuetracker.google.com/issues/130707991

sm...@google.com <sm...@google.com> #10Aug 16, 2019 05:22PM

Thanks for the repo steps. I don't have permissions to re-open this bug, but will followup on

b/130707991