IssueTracker

When using a PopupMenu inside a BottomSheetDialogFragment, the app crashes if the PopupMenu item click dismisses the BottomSheetDialogFragment.

It only happens on some devices:

Devices I reproduced the crash on:

• Nvidia Shield
• Freebox Pop

I also have a more complete list on the Play Store.

Crash stack

2020-12-14 12:24:10.470 11000-11026/com.example.myapplication A/libc: Fatal signal 6 (SIGABRT), code -6 (SI_TKILL) in tid 11026 (RenderThread), pid 11000 (e.myapplication)
2020-12-14 12:24:10.526 11046-11046/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2020-12-14 12:24:10.526 11046-11046/? A/DEBUG: Build fingerprint: 'NVIDIA/darcy/darcy:9/PPR1.180610.011/5485876_2426.5720:user/release-keys'
2020-12-14 12:24:10.526 11046-11046/? A/DEBUG: Revision: '0'
2020-12-14 12:24:10.526 11046-11046/? A/DEBUG: ABI: 'arm64'
2020-12-14 12:24:10.526 11046-11046/? A/DEBUG: pid: 11000, tid: 11026, name: RenderThread  >>> com.example.myapplication <<<
2020-12-14 12:24:10.526 11046-11046/? A/DEBUG: signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
2020-12-14 12:24:10.527 11046-11046/? A/DEBUG: Abort message: 'Failed to set damage region on surface 0x236d4f6080, error=EGL_BAD_ACCESS'
2020-12-14 12:24:10.527 11046-11046/? A/DEBUG:     x0  0000000000000000  x1  0000000000002b12  x2  0000000000000006  x3  0000000000000008
2020-12-14 12:24:10.527 11046-11046/? A/DEBUG:     x4  feff71647164636d  x5  feff71647164636d  x6  feff71647164636d  x7  7f7f7f7f7f7f7f7f
2020-12-14 12:24:10.527 11046-11046/? A/DEBUG:     x8  0000000000000083  x9  91d56a1fd61caa08  x10 0000000000000000  x11 fffffffc7ffffbdf
2020-12-14 12:24:10.527 11046-11046/? A/DEBUG:     x12 0000000000000001  x13 ffffffffffffffff  x14 ffffffffff000000  x15 ffffffffffffffff
2020-12-14 12:24:10.527 11046-11046/? A/DEBUG:     x16 00000022de66f2b8  x17 00000022de5ad110  x18 0000000000000001  x19 0000000000002af8
2020-12-14 12:24:10.527 11046-11046/? A/DEBUG:     x20 0000000000002b12  x21 000000237e0fd588  x22 000000237e0fd1b0  x23 000000237de4a430
2020-12-14 12:24:10.527 11046-11046/? A/DEBUG:     x24 0000000000000000  x25 000000237de4a3a4  x26 000000237e0fd198  x27 000000237de4a3a2
2020-12-14 12:24:10.527 11046-11046/? A/DEBUG:     x28 0000000000000000  x29 000000237e0fcaf0
2020-12-14 12:24:10.527 11046-11046/? A/DEBUG:     sp  000000237e0fcab0  lr  00000022de5a1c3c  pc  00000022de5a1c64
2020-12-14 12:24:10.566 11046-11046/? A/DEBUG: backtrace:
2020-12-14 12:24:10.566 11046-11046/? A/DEBUG:     #00 pc 0000000000021c64  /system/lib64/libc.so (abort+116)
2020-12-14 12:24:10.566 11046-11046/? A/DEBUG:     #01 pc 0000000000008080  /system/lib64/liblog.so (__android_log_assert+304)
2020-12-14 12:24:10.566 11046-11046/? A/DEBUG:     #02 pc 000000000047f90c  /system/lib64/libhwui.so (android::uirenderer::renderthread::EglManager::damageFrame(android::uirenderer::renderthread::Frame const&, SkRect const&)+180)
2020-12-14 12:24:10.567 11046-11046/? A/DEBUG:     #03 pc 0000000000478bb0  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::SkiaOpenGLPipeline::draw(android::uirenderer::renderthread::Frame const&, SkRect const&, SkRect const&, android::uirenderer::FrameBuilder::LightGeometry const&, android::uirenderer::LayerUpdateQueue*, android::uirenderer::Rect const&, bool, bool, android::uirenderer::BakedOpRenderer::LightInfo const&, std::__1::vector<android::sp<android::uirenderer::RenderNode>, std::__1::allocator<android::sp<android::uirenderer::Re
2020-12-14 12:24:10.567 11046-11046/? A/DEBUG:     #04 pc 0000000000106e50  /system/lib64/libhwui.so (android::uirenderer::renderthread::CanvasContext::draw()+188)
2020-12-14 12:24:10.567 11046-11046/? A/DEBUG:     #05 pc 0000000000107578  /system/lib64/libhwui.so (android::uirenderer::renderthread::CanvasContext::prepareAndDraw(android::uirenderer::RenderNode*)+244)
2020-12-14 12:24:10.567 11046-11046/? A/DEBUG:     #06 pc 0000000000113ca8  /system/lib64/libhwui.so (android::uirenderer::renderthread::RenderThread::dispatchFrameCallbacks()+200)
2020-12-14 12:24:10.567 11046-11046/? A/DEBUG:     #07 pc 0000000000434c80  /system/lib64/libhwui.so (android::uirenderer::WorkQueue::process()+168)
2020-12-14 12:24:10.567 11046-11046/? A/DEBUG:     #08 pc 0000000000113e54  /system/lib64/libhwui.so (android::uirenderer::renderthread::RenderThread::threadLoop()+240)
2020-12-14 12:24:10.567 11046-11046/? A/DEBUG:     #09 pc 000000000000f9d8  /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+280)
2020-12-14 12:24:10.567 11046-11046/? A/DEBUG:     #10 pc 0000000000081978  /system/lib64/libc.so (__pthread_start(void*)+36)
2020-12-14 12:24:10.567 11046-11046/? A/DEBUG:     #11 pc 00000000000234b8  /system/lib64/libc.so (__start_thread+68)
2020-12-14 12:24:11.030 3493-3493/? E//system/bin/tombstoned: Tombstone written to: /data/tombstones/tombstone_05
2020-12-14 12:24:11.094 3674-3767/? E/InputDispatcher: channel '1dc869a com.example.myapplication/com.example.myapplication.MainActivity (server)' ~ Channel is unrecoverably broken and will be disposed!

Full bug report available here:

https://drive.google.com/file/d/1O1S9uqOvP3FM3xTGL_cU6yd6YrXkiDOy/view?usp=drive_web (bugreport-darcy-PPR1.180610.011-2020-12-14-12-30-06.zip)

Minimal sample: https://gitlab.com/nicolas.pomepuy/bottomsheet-popupmenu-crash (zip also available in attachment)

Steps to reproduce:

• tap the FAB
• a Bottom sheet appears
• the first button opens a PopupMenu
• Tap the "test" item

The app crashes. It may not, but will crash after some attempts.

The second button, without a PopupMenu won't crash the app