NPE race condition between Snapshot.sendApplyNotifications() and reading state value [192677711]

Fixed

Bug

Status Update

No update yet.

Description

ig...@jetbrains.com

created issue #1

Jul 5, 2021 11:29AM

Component used: Snapshot, SnapshotStateObserver, mutableStateOf

Version used: a02b52bd (androidx-main, 01 Jul 2021)

There is a race condition when we apply snapshot in one thread and try to read the snapshot value in another.

This code:

import androidx.compose.runtime.getValue
import androidx.compose.runtime.mutableStateOf
import androidx.compose.runtime.setValue
import androidx.compose.runtime.snapshots.Snapshot
import androidx.compose.runtime.snapshots.SnapshotStateObserver
import kotlin.concurrent.thread

fun main() {
    println("START")

    thread {
        while (true) {
            Snapshot.sendApplyNotifications()
        }
    }

    for (i in 1..10000) {
        val state1 by mutableStateOf(0)
        var state2 by mutableStateOf(true)
        val observer = SnapshotStateObserver({}).apply {
            start()
        }
        repeat(1000) {
            observer.observeReads(Unit, {}) {
                state1
                if (state2) {
                    state2 = false
                }
            }
        }
    }
}

crashes with exception:

Exception in thread “Thread-1” java.lang.NullPointerException
	at androidx.compose.runtime.collection.IdentityScopeMap.find(IdentityScopeMap.kt:319)
	at androidx.compose.runtime.collection.IdentityScopeMap.access$find(IdentityScopeMap.kt:26)
	at androidx.compose.runtime.snapshots.SnapshotStateObserver$applyObserver$1.invoke(SnapshotStateObserver.kt:284)
	at androidx.compose.runtime.snapshots.SnapshotStateObserver$applyObserver$1.invoke(SnapshotStateObserver.kt:26)
	at androidx.compose.runtime.snapshots.SnapshotKt.advanceGlobalSnapshot(Snapshot.kt:1440)
	at androidx.compose.runtime.snapshots.SnapshotKt.advanceGlobalSnapshot(Snapshot.kt:1459)
	at androidx.compose.runtime.snapshots.SnapshotKt.access$advanceGlobalSnapshot(Snapshot.kt:1)
	at androidx.compose.runtime.snapshots.Snapshot$Companion.sendApplyNotifications(Snapshot.kt:462)
	at androidx.compose.desktop.examples.example1.Main_jvmKt$main$1.invoke(Main.jvm.kt:28)
	at androidx.compose.desktop.examples.example1.Main_jvmKt$main$1.invoke(Main.jvm.kt:26)
	at kotlin.concurrent.ThreadsKt$thread$thread$1.run(Thread.kt:30)

The race condition is probably between map.removeValueIf { scope -> scope in invalidated } and currentMap!!.addValue(state) in SnapshotStateObserver

Comments

ig...@jetbrains.com <ig...@jetbrains.com> #2Jul 5, 2021 11:30AM

Project: platform/frameworks/support
Branch: androidx-main

commit a330c0d3bcdd41326f37968a60e6084ad4a2e32c
Author: Chet Haase <chet@google.com>
Date: Wed Jul 05 07:26:46 2023

Convert APIs using PointF to use Float instead

PointF is a convenient mechanism for passing around x.y values
representing 2D points. But there are downsides, including:
- Converting to PointF: You may not have the data in PointF form
to begin with, so using an API which takes PointF requires converting
the data to that form (including allocating a PointF object every time)
- Mutability: Point structures can be mutated internally, causing
unpredictability in what that mutation means. Should the library
react to those changes? Ignore them? Do defensive copies (requiring
even more allocations)? Using primitive types like Float make the
behavior more obvious (by making the data inherently immutable).
- Allocations: Whenever we use object types, there are necessarily
allocations on the Java heap for them. This puts pressure on the GC
at both allocation and collection time. Given the amount of points
being passed around (especially at morph creation time, when curves
are being split and created), this causes a lot of PointF objects to
be allocated (even temporarily). Using Float avoids that problem.

Also fixed bug with unclosed paths causing discontinuity at the
start/end point.

Bug: 276466399
Bug: 290254314
Test: integration and unit tests pass
Relnote: PointF parameters changed to Float pairs
Change-Id: Id4705d27c7be31b26ade8186b99fffe2e2f8450e

M graphics/graphics-shapes/api/current.txt
M graphics/graphics-shapes/api/restricted_current.txt
M graphics/graphics-shapes/src/androidTest/java/androidx/graphics/shapes/CubicShapeTest.kt
M graphics/graphics-shapes/src/androidTest/java/androidx/graphics/shapes/CubicTest.kt
M graphics/graphics-shapes/src/androidTest/java/androidx/graphics/shapes/PolygonMeasureTest.kt
M graphics/graphics-shapes/src/androidTest/java/androidx/graphics/shapes/PolygonTest.kt
M graphics/graphics-shapes/src/androidTest/java/androidx/graphics/shapes/RoundedPolygonTest.kt
M graphics/graphics-shapes/src/androidTest/java/androidx/graphics/shapes/ShapesTest.kt
M graphics/graphics-shapes/src/androidTest/java/androidx/graphics/shapes/TestUtils.kt
M graphics/graphics-shapes/src/main/java/androidx/graphics/shapes/Cubic.kt
M graphics/graphics-shapes/src/main/java/androidx/graphics/shapes/CubicShape.kt
M graphics/graphics-shapes/src/main/java/androidx/graphics/shapes/FeatureMapping.kt
M graphics/graphics-shapes/src/main/java/androidx/graphics/shapes/FloatMapping.kt
M graphics/graphics-shapes/src/main/java/androidx/graphics/shapes/Morph.kt
M graphics/graphics-shapes/src/main/java/androidx/graphics/shapes/PolygonMeasure.kt
M graphics/graphics-shapes/src/main/java/androidx/graphics/shapes/RoundedPolygon.kt
M graphics/graphics-shapes/src/main/java/androidx/graphics/shapes/Shapes.kt
M graphics/graphics-shapes/src/main/java/androidx/graphics/shapes/Utils.kt
M graphics/integration-tests/testapp-compose/src/main/java/androidx/graphics/shapes/testcompose/DebugDraw.kt
M graphics/integration-tests/testapp-compose/src/main/java/androidx/graphics/shapes/testcompose/ShapeEditor.kt
M graphics/integration-tests/testapp/src/main/java/androidx/graphics/shapes/test/MaterialShapes.kt

https://android-review.googlesource.com/2649119

an...@google.com <an...@google.com> Jul 6, 2021 01:16PM

Assigned to ch...@google.com.

ch...@google.com <ch...@google.com> Jul 7, 2021 06:02PM

Accepted by ch...@google.com.

ap...@google.com <ap...@google.com> #3Jul 8, 2021 05:38PM

Marked as fixed.

PointF was the main (possibly only) mutability issue, marking this as fixed

ig...@jetbrains.com <ig...@jetbrains.com> #4Jul 9, 2021 08:57AM

The following release(s) address this bug.It is possible this bug has only been partially addressed:

androidx.graphics:graphics-shapes:1.0.0-alpha04

ch...@google.com <ch...@google.com> #5Jul 9, 2021 05:40PM

Status: Assigned (reopened)

I am re-opening the bug as the above exception indicates that there is still a missing synchronize call.

If you can narrow it down I would really appreciate it!

ig...@jetbrains.com <ig...@jetbrains.com> #6Jul 12, 2021 07:18AM

I reproduced the new exception with this code:

import androidx.compose.runtime.getValue
import androidx.compose.runtime.mutableStateOf
import androidx.compose.runtime.setValue
import androidx.compose.runtime.snapshots.Snapshot
import androidx.compose.runtime.snapshots.SnapshotStateObserver
import kotlin.concurrent.thread

fun main() {
    println("START")

    thread {
        while (true) {
            Snapshot.sendApplyNotifications()
        }
    }

    for (i in 1..10000) {
        val state1 by mutableStateOf(0)
        var state2 by mutableStateOf(true)
        val observer = SnapshotStateObserver({}).apply {
            start()
        }
        observer.observeReads(Unit, {}) {
            repeat(1000) {
                state1
                if (state2) {
                    state2 = false
                }
            }
        }
    }
}

Exception in thread "main" java.lang.NullPointerException: null cannot be cast to non-null type T of androidx.compose.runtime.collection.IdentityArraySet
	at androidx.compose.runtime.collection.IdentityArraySet.get(IdentityArraySet.kt:44)
	at androidx.compose.runtime.collection.IdentityArraySet.find(IdentityArraySet.kt:174)
	at androidx.compose.runtime.collection.IdentityArraySet.add(IdentityArraySet.kt:53)
	at androidx.compose.runtime.collection.IdentityScopeMap.add(IdentityScopeMap.kt:77)
	at androidx.compose.runtime.snapshots.SnapshotStateObserver$ApplyMap.addValue(SnapshotStateObserver.kt:264)
	at androidx.compose.runtime.snapshots.SnapshotStateObserver$readObserver$1.invoke(SnapshotStateObserver.kt:56)
	at androidx.compose.runtime.snapshots.SnapshotStateObserver$readObserver$1.invoke(SnapshotStateObserver.kt:54)
	at androidx.compose.runtime.snapshots.SnapshotKt.readable(Snapshot.kt:1513)
	at androidx.compose.runtime.snapshots.SnapshotKt.readable(Snapshot.kt:1505)
	at androidx.compose.runtime.SnapshotMutableStateImpl.getValue(SnapshotState.kt:143)
	at androidx.compose.desktop.examples.example1.Main_jvmKt.main$lambda-1(Main.jvm.kt:51)
	at androidx.compose.desktop.examples.example1.Main_jvmKt.access$main$lambda-1(Main.jvm.kt:1)
	at androidx.compose.desktop.examples.example1.Main_jvmKt$main$3.invoke(Main.jvm.kt:43)
	at androidx.compose.desktop.examples.example1.Main_jvmKt$main$3.invoke(Main.jvm.kt:40)
	at androidx.compose.runtime.snapshots.Snapshot$Companion.observe(Snapshot.kt:1776)
	at androidx.compose.runtime.snapshots.SnapshotStateObserver.observeReads(SnapshotStateObserver.kt:121)
	at androidx.compose.desktop.examples.example1.Main_jvmKt.main(Main.jvm.kt:40)
	at androidx.compose.desktop.examples.example1.Main_jvmKt.main(Main.jvm.kt)

ch...@google.com <ch...@google.com> #7Jul 12, 2021 04:27PM

Can you try https://android-review.googlesource.com/c/platform/frameworks/support/+/1763445 with the original example?

ig...@jetbrains.com <ig...@jetbrains.com> #8Jul 12, 2021 04:35PM