Emoji: IndexOutOfBoundsException [216891011]

Fixed

Bug

Status Update

No update yet.

Description

ma...@bokhorst.biz

created issue #1

Jan 30, 2022 03:00PM

Component used: androidx.emoji2:emoji2

Version used: 1.0.1

Devices/Android versions reproduced on: Huawei BAH2-W19 and probably others

java.lang.IndexOutOfBoundsException: 247, -245
    at android.text.PackedIntVector.deleteAt(PackedIntVector.java:222)
    at android.text.DynamicLayout.reflow(DynamicLayout.java:317)
    at android.text.DynamicLayout.-wrap0(Unknown Source:0)
    at android.text.DynamicLayout$ChangeWatcher.reflow(DynamicLayout.java:750)
    at android.text.DynamicLayout$ChangeWatcher.onSpanChanged(DynamicLayout.java:779)
    at androidx.emoji2.text.SpannableBuilder$WatcherWrapper.onSpanChanged(SourceFile:2)
    at android.text.SpannableStringBuilder.sendSpanChanged(SpannableStringBuilder.java:1296)
    at android.text.SpannableStringBuilder.sendToSpanWatchers(SpannableStringBuilder.java:651)
    at android.text.SpannableStringBuilder.replace(SpannableStringBuilder.java:581)
    at androidx.emoji2.text.SpannableBuilder.replace(SourceFile:7)
    at android.text.SpannableStringBuilder.replace(SpannableStringBuilder.java:504)
    at androidx.emoji2.text.SpannableBuilder.replace(SourceFile:4)
    at androidx.emoji2.text.SpannableBuilder.replace(SourceFile:1)
    at android.view.inputmethod.BaseInputConnection.replaceText(BaseInputConnection.java:848)
    at android.view.inputmethod.BaseInputConnection.commitText(BaseInputConnection.java:197)
    at com.android.internal.widget.EditableInputConnection.commitText(EditableInputConnection.java:183)
    at android.view.inputmethod.InputConnectionWrapper.commitText(InputConnectionWrapper.java:158)
    at android.view.inputmethod.InputConnectionWrapper.commitText(InputConnectionWrapper.java:158)
    at com.android.internal.view.IInputConnectionWrapper.executeMessage(IInputConnectionWrapper.java:344)
    at com.android.internal.view.IInputConnectionWrapper$MyHandler.handleMessage(IInputConnectionWrapper.java:85)
    at android.os.Handler.dispatchMessage(Handler.java:108)
    at android.os.Looper.loop(Looper.java:166)
    at android.app.ActivityThread.main(ActivityThread.java:7529)
    at java.lang.reflect.Method.invoke(Native Method)
    at com.android.internal.os.Zygote$MethodAndArgsCaller.run(Zygote.java:245)
    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:921)

Comments

se...@google.com <se...@google.com> #2Jan 31, 2022 06:20PM

Project: platform/frameworks/support
Branch: androidx-master-dev

commit c60f33e229e31ab328ef6b59dab63b264954831c
Author: Alexandre Elias <aelias@google.com>
Date: Fri Jul 10 16:23:09 2020

Semantics no-op cleanups

Partly in response to lmr's broad code review, I did a pass of
superficial API/implementation cleanup. The main changes are:

- I changed each Boolean SemanticsProperty where false is equivalent to
not being present to take "Unit" instead. This is conceptually
clearer: it avoids questions like "can I cancel out a semantics from a
merged child by setting it to false?" Because "property = Unit" looks
weird, I also changed the style of these to "property()".

- I moved the Semantics id generator closer to where it's used, in
SemanticsModifierCore. I made it internal and an AtomicInt.
(Note that integer ids are heavily used in the Android
AccessibilityNodeInfo APIs so I can't simply remove them entirely.)

- I deleted dead code. Some examples include SemanticsHintOverrides,
a public API not connected to anything, and SemanticsPropertyKey
merge() open method which is never called. (In both cases I have
a different plan in mind for accessibility.)

Fixes: 145951226
Fixes: 145955412
Test: existing tests
Relnote: "Single-value semantics properties now use a calling style.
For example, 'semantics { hidden = true }' is now written as:
'semantics { hidden() }'."

Change-Id: Ic1afd12ea22c926babc9662f1804d80b33aa0cfc

M ui/integration-tests/benchmark/src/androidTest/java/androidx/ui/benchmark/test/LayoutNodeModifierBenchmark.kt
M ui/ui-core/api/0.1.0-dev15.txt
M ui/ui-core/api/current.txt
M ui/ui-core/api/public_plus_experimental_0.1.0-dev15.txt
M ui/ui-core/api/public_plus_experimental_current.txt
M ui/ui-core/api/restricted_0.1.0-dev15.txt
M ui/ui-core/api/restricted_current.txt
M ui/ui-core/src/androidAndroidTest/kotlin/androidx/ui/graphics/vector/VectorTest.kt
M ui/ui-core/src/androidAndroidTest/kotlin/androidx/ui/semantics/SemanticsTests.kt
M ui/ui-core/src/androidMain/kotlin/androidx/ui/core/AndroidActuals.kt
M ui/ui-core/src/androidMain/kotlin/androidx/ui/core/AndroidComposeView.kt
M ui/ui-core/src/androidMain/kotlin/androidx/ui/core/AndroidComposeViewAccessibilityDelegateCompat.kt
M ui/ui-core/src/androidMain/kotlin/androidx/ui/core/AndroidPopup.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/core/Expect.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/core/semantics/SemanticsConfiguration.kt
D ui/ui-core/src/commonMain/kotlin/androidx/ui/core/semantics/SemanticsHintOverrides.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/core/semantics/SemanticsModifier.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/core/semantics/SemanticsNode.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/core/semantics/SemanticsOwner.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/core/semantics/SemanticsWrapper.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/semantics/SemanticsProperties.kt
M ui/ui-foundation/api/0.1.0-dev15.txt
M ui/ui-foundation/api/current.txt
M ui/ui-foundation/api/public_plus_experimental_0.1.0-dev15.txt
M ui/ui-foundation/api/public_plus_experimental_current.txt
M ui/ui-foundation/api/restricted_0.1.0-dev15.txt
M ui/ui-foundation/api/restricted_current.txt
M ui/ui-foundation/src/main/java/androidx/ui/foundation/Clickable.kt
M ui/ui-foundation/src/main/java/androidx/ui/foundation/Dialog.kt
M ui/ui-foundation/src/main/java/androidx/ui/foundation/Scroller.kt
M ui/ui-foundation/src/main/java/androidx/ui/foundation/selection/Selectable.kt
M ui/ui-foundation/src/main/java/androidx/ui/foundation/selection/Toggleable.kt
M ui/ui-foundation/src/main/java/androidx/ui/foundation/semantics/FoundationSemanticsProperties.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/ButtonTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/CardTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/CheckboxScreenshotTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/RadioButtonScreenshotTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/ScaffoldTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/SnackbarTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/SurfaceTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/ripple/RippleIndicationTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/textfield/TextFieldScreenshotTest.kt
M ui/ui-material/src/main/java/androidx/ui/material/AppBar.kt
M ui/ui-material/src/main/java/androidx/ui/material/TextFieldImpl.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/AssertsTest.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/CallSemanticsActionTest.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/ErrorMessagesTest.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/FindersTest.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/PrintToStringTest.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/ScrollToTest.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/TextActionsTest.kt
M ui/ui-test/src/main/java/androidx/ui/test/Actions.kt
M ui/ui-test/src/main/java/androidx/ui/test/Filters.kt
M ui/ui-text/api/0.1.0-dev15.txt
M ui/ui-text/api/current.txt
M ui/ui-text/api/public_plus_experimental_0.1.0-dev15.txt
M ui/ui-text/api/public_plus_experimental_current.txt
M ui/ui-text/api/restricted_0.1.0-dev15.txt
M ui/ui-text/api/restricted_current.txt
M ui/ui-text/src/commonMain/kotlin/androidx/ui/text/CoreTextField.kt
M ui/ui-text/src/commonMain/kotlin/androidx/ui/text/TextSemanticsProperties.kt

https://android-review.googlesource.com/1360099

ma...@bokhorst.biz <ma...@bokhorst.biz> #3Jan 31, 2022 06:23PM

In any case Android 8.0.0 (SDK 26)

se...@google.com <se...@google.com> #4Jan 31, 2022 06:25PM

Thanks! Interesting, I had thought it might be an Android 12 thing. Exploring.

Can you share a bit about how to repro? It looks like an IME command, what actions are you taking to trigger this?

ma...@bokhorst.biz <ma...@bokhorst.biz> #5Jan 31, 2022 06:28PM

This bug report is based on a crash report sent to me.

I guess this might be helpful:

https://github.com/M66B/FairEmail/blob/c62f616148fb50d55b97396f08b4dcc6fca65f15/app/src/main/java/eu/faircode/email/EditTextPlain.java#L70

se...@google.com <se...@google.com> #6Jan 31, 2022 06:36PM

Thanks for the info! Will take a look.

se...@google.com <se...@google.com> Feb 1, 2022 12:57AM

Reassigned to se...@google.com.

ma...@bokhorst.biz <ma...@bokhorst.biz> #7Feb 1, 2022 06:12AM

This crash is taking apps down (not mine anymore, which was confirmed by the reporter of the crash). So, I think this issue deserves at least some attention.

se...@google.com <se...@google.com> #8Mar 8, 2022 06:41PM

Related b/67926915

se...@google.com <se...@google.com> #9Mar 8, 2022 07:26PM

Test case that reproduces crash prior to P

    @Test
    //@SdkSuppress(maxSdkVersion = 27) /* this is for testing before P crash */
    public void testSpanRangeOldValueCalculation() throws Exception {
        // this test is ported from CTS
        // DynamicLayoutTest.testReflow_afterSpanChangedShouldNotThrowException
        String className = "android.text.DynamicLayout$ChangeWatcher";
        Class<?> watcherClass = Class.forName(className, false,
                getClass().getClassLoader());
        SpannableBuilder builder = new SpannableBuilder(watcherClass, "crash crash crash!!");

        TypefaceSpan span = mock(TypefaceSpan.class);
        builder.setSpan(span, 1, 4, SPAN_EXCLUSIVE_EXCLUSIVE);

        // this DynamicLayout causes the replace/insert before position 1 below to crash prior to P
        new DynamicLayout(builder, new TextPaint(), Integer.MAX_VALUE,
                Layout.Alignment.ALIGN_NORMAL, 1.0f, 1.0f, true);
        try {
            builder.replace(1, 1, "Hello there\n\n");
        } catch (Throwable e) {
            throw new RuntimeException("Inserting text into DynamicLayout should not crash", e);
        }
    }

ma...@bokhorst.biz <ma...@bokhorst.biz> #10Mar 8, 2022 07:29PM

I see good progress here ;-)

se...@google.com <se...@google.com> #11Mar 8, 2022 09:27PM

Fix coming in the next release.

It's a platform DynamicLayout bug, but since it's running through emoji2 we have an opportunity to backport it prior to P :party:.

ap...@google.com <ap...@google.com> #12Mar 8, 2022 10:30PM

Marked as fixed.

Project: platform/frameworks/support
Branch: androidx-main

commit 96445c4b96e57ac060ea06c88e477622f28a2e00
Author: Sean McQuillan <seanmcq@google.com>
Date: Tue Mar 08 12:35:32 2022

Backport platform DynamicLayout crashfix to emoji2

Backport of Android P crashfix (

b/67926915

) to emoji2.

This causes insert and replace calls to not crash when they happen
adjacent to spans that are EXCLUSIVE_EXCLUSIVE.

Previously, the range would be negative which would cause incorrect
integer math inside of DynamicLayout. The new behavior is to never pass
negative ranges by ressetting start to 0 before passing to DynamicLayout
which causes more reflow and avoids a crash.

This was previously fixed on platform and is covered by CTS test
DynamicLayoutTest#testReflow_afterSpanChangedShouldNotThrowException()

Fixes:

b/216891011

Test: ./gradlew :e2:e2:cAT
Relnote: "Backport editor crash fix from Android P to EditText that is
configured to use emoji2 (platform bug