Emoji: IndexOutOfBoundsException [216891011]

Fixed

Bug

Status Update

No update yet.

Description

ma...@bokhorst.biz

created issue #1

Jan 30, 2022 03:00PM

Component used: androidx.emoji2:emoji2

Version used: 1.0.1

Devices/Android versions reproduced on: Huawei BAH2-W19 and probably others

java.lang.IndexOutOfBoundsException: 247, -245
    at android.text.PackedIntVector.deleteAt(PackedIntVector.java:222)
    at android.text.DynamicLayout.reflow(DynamicLayout.java:317)
    at android.text.DynamicLayout.-wrap0(Unknown Source:0)
    at android.text.DynamicLayout$ChangeWatcher.reflow(DynamicLayout.java:750)
    at android.text.DynamicLayout$ChangeWatcher.onSpanChanged(DynamicLayout.java:779)
    at androidx.emoji2.text.SpannableBuilder$WatcherWrapper.onSpanChanged(SourceFile:2)
    at android.text.SpannableStringBuilder.sendSpanChanged(SpannableStringBuilder.java:1296)
    at android.text.SpannableStringBuilder.sendToSpanWatchers(SpannableStringBuilder.java:651)
    at android.text.SpannableStringBuilder.replace(SpannableStringBuilder.java:581)
    at androidx.emoji2.text.SpannableBuilder.replace(SourceFile:7)
    at android.text.SpannableStringBuilder.replace(SpannableStringBuilder.java:504)
    at androidx.emoji2.text.SpannableBuilder.replace(SourceFile:4)
    at androidx.emoji2.text.SpannableBuilder.replace(SourceFile:1)
    at android.view.inputmethod.BaseInputConnection.replaceText(BaseInputConnection.java:848)
    at android.view.inputmethod.BaseInputConnection.commitText(BaseInputConnection.java:197)
    at com.android.internal.widget.EditableInputConnection.commitText(EditableInputConnection.java:183)
    at android.view.inputmethod.InputConnectionWrapper.commitText(InputConnectionWrapper.java:158)
    at android.view.inputmethod.InputConnectionWrapper.commitText(InputConnectionWrapper.java:158)
    at com.android.internal.view.IInputConnectionWrapper.executeMessage(IInputConnectionWrapper.java:344)
    at com.android.internal.view.IInputConnectionWrapper$MyHandler.handleMessage(IInputConnectionWrapper.java:85)
    at android.os.Handler.dispatchMessage(Handler.java:108)
    at android.os.Looper.loop(Looper.java:166)
    at android.app.ActivityThread.main(ActivityThread.java:7529)
    at java.lang.reflect.Method.invoke(Native Method)
    at com.android.internal.os.Zygote$MethodAndArgsCaller.run(Zygote.java:245)
    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:921)

Comments

se...@google.com <se...@google.com> #2Jan 31, 2022 06:20PM

Project: platform/frameworks/support
Branch: androidx-master-dev

commit b90079595f33f58fece04026a97faa0d243acdb1
Author: Yuichi Araki <yaraki@google.com>
Date: Wed Sep 18 16:55:49 2019

Change the way to detect mismatch between POJO and query

This fixes cursor mismatch warnings with expandProjection.

Bug: 140759491
Test: QueryMethodProcessorTest
Change-Id: I7659002e5e0d1ef60fc1af2a625c0c36da0664d8

M room/compiler/src/main/kotlin/androidx/room/processor/QueryMethodProcessor.kt
M room/compiler/src/main/kotlin/androidx/room/solver/TypeAdapterStore.kt
M room/compiler/src/main/kotlin/androidx/room/solver/query/result/PojoRowAdapter.kt
M room/compiler/src/test/kotlin/androidx/room/processor/QueryMethodProcessorTest.kt
M room/compiler/src/test/kotlin/androidx/room/testing/TestProcessor.kt

https://android-review.googlesource.com/1123258

https://goto.google.com/android-sha1/b90079595f33f58fece04026a97faa0d243acdb1

ma...@bokhorst.biz <ma...@bokhorst.biz> #3Jan 31, 2022 06:23PM

The following changes were cherrypicked through Coastguard (

https://android-build.googleplex.com/coastguard/)
Release Track: (

https://android-build.googleplex.com/coastguard/dashboard/6093116828680192/#/cherrypickHistory/all)
Created: 2019-10-14 17:23:42.610596+00:00
Changes: aosp/1123258

se...@google.com <se...@google.com> #4Jan 31, 2022 06:25PM

Project: platform/frameworks/support
Branch: androidx-master-dev

commit bdde5a1a970ddc9007b28de4aa29d60ffa588f08
Author: Yigit Boyar <yboyar@google.com>
Date: Thu Apr 16 16:47:05 2020

Re-factor how errors are dismissed when query is re-written

This CL changes how we handle errors/warnings if query is
re-written.
There was a bug in expandProjection where we would report warnings
for things that Room already fixes automatically (

b/140759491

).
The solution to that problem (I7659002e5e0d1ef60fc1af2a625c0c36da0664d8)
solved it by deferring validating of columns until after re-write
decision is made. Unfortunately, this required changing PojoRowAdapter
to have a dummy mapping until it is validating, make it hard to use
as it does have a non-null mapping which is not useful.

This CL partially reverts that change and instead rely on the log
deferring logic we have in Context. This way, we don't need to break
the stability of PojoRowAdapter while still having the ability to
drop warnings that room fixes. This will also play nicer when we
have different query re-writing options that can use more information
about the query results.

Bug: 153387066
Bug: 140759491
Test: existing tests pass
Change-Id: I2ec967c763d33d7a3ff02c1a13c6953b460d1e5f

M room/compiler/src/main/kotlin/androidx/room/log/RLog.kt
M room/compiler/src/main/kotlin/androidx/room/processor/QueryMethodProcessor.kt
M room/compiler/src/main/kotlin/androidx/room/solver/TypeAdapterStore.kt
M room/compiler/src/main/kotlin/androidx/room/solver/query/result/PojoRowAdapter.kt

https://android-review.googlesource.com/1288456

ma...@bokhorst.biz <ma...@bokhorst.biz> #5Jan 31, 2022 06:28PM

This bug report is based on a crash report sent to me.

I guess this might be helpful:

https://github.com/M66B/FairEmail/blob/c62f616148fb50d55b97396f08b4dcc6fca65f15/app/src/main/java/eu/faircode/email/EditTextPlain.java#L70

se...@google.com <se...@google.com> #6Jan 31, 2022 06:36PM

Thanks for the info! Will take a look.

se...@google.com <se...@google.com> Feb 1, 2022 12:57AM

Reassigned to se...@google.com.

ma...@bokhorst.biz <ma...@bokhorst.biz> #7Feb 1, 2022 06:12AM

This crash is taking apps down (not mine anymore, which was confirmed by the reporter of the crash). So, I think this issue deserves at least some attention.

se...@google.com <se...@google.com> #8Mar 8, 2022 06:41PM

Related b/67926915

se...@google.com <se...@google.com> #9Mar 8, 2022 07:26PM

Test case that reproduces crash prior to P

    @Test
    //@SdkSuppress(maxSdkVersion = 27) /* this is for testing before P crash */
    public void testSpanRangeOldValueCalculation() throws Exception {
        // this test is ported from CTS
        // DynamicLayoutTest.testReflow_afterSpanChangedShouldNotThrowException
        String className = "android.text.DynamicLayout$ChangeWatcher";
        Class<?> watcherClass = Class.forName(className, false,
                getClass().getClassLoader());
        SpannableBuilder builder = new SpannableBuilder(watcherClass, "crash crash crash!!");

        TypefaceSpan span = mock(TypefaceSpan.class);
        builder.setSpan(span, 1, 4, SPAN_EXCLUSIVE_EXCLUSIVE);

        // this DynamicLayout causes the replace/insert before position 1 below to crash prior to P
        new DynamicLayout(builder, new TextPaint(), Integer.MAX_VALUE,
                Layout.Alignment.ALIGN_NORMAL, 1.0f, 1.0f, true);
        try {
            builder.replace(1, 1, "Hello there\n\n");
        } catch (Throwable e) {
            throw new RuntimeException("Inserting text into DynamicLayout should not crash", e);
        }
    }

ma...@bokhorst.biz <ma...@bokhorst.biz> #10Mar 8, 2022 07:29PM

I see good progress here ;-)

se...@google.com <se...@google.com> #11Mar 8, 2022 09:27PM

Fix coming in the next release.

It's a platform DynamicLayout bug, but since it's running through emoji2 we have an opportunity to backport it prior to P :party:.

ap...@google.com <ap...@google.com> #12Mar 8, 2022 10:30PM

Marked as fixed.

Project: platform/frameworks/support
Branch: androidx-main

commit 96445c4b96e57ac060ea06c88e477622f28a2e00
Author: Sean McQuillan <seanmcq@google.com>
Date: Tue Mar 08 12:35:32 2022

Backport platform DynamicLayout crashfix to emoji2

Backport of Android P crashfix (

b/67926915

) to emoji2.

This causes insert and replace calls to not crash when they happen
adjacent to spans that are EXCLUSIVE_EXCLUSIVE.

Previously, the range would be negative which would cause incorrect
integer math inside of DynamicLayout. The new behavior is to never pass
negative ranges by ressetting start to 0 before passing to DynamicLayout
which causes more reflow and avoids a crash.

This was previously fixed on platform and is covered by CTS test
DynamicLayoutTest#testReflow_afterSpanChangedShouldNotThrowException()

Fixes:

b/216891011

Test: ./gradlew :e2:e2:cAT
Relnote: "Backport editor crash fix from Android P to EditText that is
configured to use emoji2 (platform bug