Android 13: Crash in WindowOnBackInvokedDispatcher / OnBackPressedDispatcher [291869278]

Fixed

Bug

androidx-activity-1.8.0-alpha07

Status Update

No update yet.

Description

be...@airbnb.com

created issue #1

Jul 19, 2023 06:45PM

Since enabling android 13's enableOnBackInvokedCallback setting, our app has been experiencing a number of sporadic crashes originating in android only code.

Our app only uses OnBackPressedCallback, and registers using LifecycleOwners. (We do not change OnBackInvokedDispatcher).

java.lang.NullPointerException: Attempt to invoke virtual method 'android.os.Handler android.app.FragmentHostCallback.getHandler()' on a null object reference
        at android.app.FragmentManagerImpl.ensureExecReady(FragmentManager.java:2008)
        at android.app.FragmentManagerImpl.execPendingActions(FragmentManager.java:2061)
        at android.app.FragmentManagerImpl.popBackStackImmediate(FragmentManager.java:874)
        at android.app.FragmentManagerImpl.popBackStackImmediate(FragmentManager.java:835)
        at android.app.Activity.onBackPressed(Activity.java:4083)
        at androidx.activity.ComponentActivity.access$001(ComponentActivity.java:121)
        at androidx.activity.ComponentActivity$1.run(ComponentActivity.java:165)
        at androidx.activity.OnBackPressedDispatcher.onBackPressed(OnBackPressedDispatcher.kt:216)
        at androidx.activity.OnBackPressedDispatcher$2.invoke(OnBackPressedDispatcher.kt:102)
        at androidx.activity.OnBackPressedDispatcher$2.invoke(OnBackPressedDispatcher.kt:102)
        at androidx.activity.OnBackPressedDispatcher$Api33Impl.createOnBackInvokedCallback$lambda$0(OnBackPressedDispatcher:286)
        at androidx.activity.OnBackPressedDispatcher$Api33Impl$$InternalSyntheticLambda$1$5dea06066ea46437e84a2264f31c2ea84a3652ee19c7688a4a1451cf132e3013$0.onBackInvoked(OnBackPressedDispatcher:3)
        at android.window.WindowOnBackInvokedDispatcher$OnBackInvokedCallbackWrapper.lambda$onBackInvoked$3$android-window-WindowOnBackInvokedDispatcher$OnBackInvokedCallbackWrapper(WindowOnBackInvokedDispatcher.java:287)
        at android.window.WindowOnBackInvokedDispatcher$OnBackInvokedCallbackWrapper$$ExternalSyntheticLambda0.run(Unknown:2)
        at android.os.Handler.handleCallback(Handler.java:942)
        at android.os.Handler.dispatchMessage(Handler.java:99)
        at android.os.Looper.loopOnce(Looper.java:226)
        at android.os.Looper.loop(Looper.java:313)
        at android.app.ActivityThread.main(ActivityThread.java:8757)
        at java.lang.reflect.Method.invoke(Method.java:-2)
        at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:571)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1067)

I have not been able to create a reliable reproduction, however, have a hypothesis from reading through the source code.

The nature of the crash invoking the fallbackHandler implies that WindowOnBackInvokedDispatcher is invoking an OnBackPressedDispatcher with no enabled OnBackPressedCallbacks. The crash itself seems to imply the FragmentManager has been destroyed.
This appears somewhat unexpected from the platform, as in OnBackPressedDispatcher, there is logic to ensure when there are no active callbacks the window dispatcher is updated to not have the OnBackPressedDispatcher as the "topCallback". Instead the Activity's navigateBack is used. Notably, navigateBack does not perform a popBackStackImmediate which is different from the OnBackPressedDispatchers fallback which ultimately invokes onBackPress and popBackStackImmediate
The WindowOnBackInvokedDispatcher uses a weak reference to the proper back callback which is created via setTopOnBackInvokedCallback.
Since back presses are enqueued on a handler in WindowOnBackInvokedDispatcher, if there is a back-press enqueued while there is another message ahead of it which will cause WindowOnBackInvokedDispatcher to update it's topCallback, it can run on a stale callback.

This race condition ultimately means that Activity.onBackPressed is invoked instead of Activity.navigateBack, exposing the app to the crash in fragment manager's popBackStackImmediate.

This is just speculation, but from our crash breadcrumbs it does seem that this crash is also proceeded by the destroy event of an activity 5-100ms prior.

It would be much appreciated to have the perspective of someone more familiar with the platform code. We are seeing a steady increase in this crash as more users adopt android 13.

Comments

su...@google.com <su...@google.com> Jul 20, 2023 07:37AM

Assigned to su...@google.com.

su...@google.com <su...@google.com> #2Jul 20, 2023 09:02AM

Project: platform/frameworks/support
Branch: androidx-master-dev

commit c60f33e229e31ab328ef6b59dab63b264954831c
Author: Alexandre Elias <aelias@google.com>
Date: Fri Jul 10 16:23:09 2020

Semantics no-op cleanups

Partly in response to lmr's broad code review, I did a pass of
superficial API/implementation cleanup. The main changes are:

- I changed each Boolean SemanticsProperty where false is equivalent to
not being present to take "Unit" instead. This is conceptually
clearer: it avoids questions like "can I cancel out a semantics from a
merged child by setting it to false?" Because "property = Unit" looks
weird, I also changed the style of these to "property()".

- I moved the Semantics id generator closer to where it's used, in
SemanticsModifierCore. I made it internal and an AtomicInt.
(Note that integer ids are heavily used in the Android
AccessibilityNodeInfo APIs so I can't simply remove them entirely.)

- I deleted dead code. Some examples include SemanticsHintOverrides,
a public API not connected to anything, and SemanticsPropertyKey
merge() open method which is never called. (In both cases I have
a different plan in mind for accessibility.)

Fixes: 145951226
Fixes: 145955412
Test: existing tests
Relnote: "Single-value semantics properties now use a calling style.
For example, 'semantics { hidden = true }' is now written as:
'semantics { hidden() }'."

Change-Id: Ic1afd12ea22c926babc9662f1804d80b33aa0cfc

M ui/integration-tests/benchmark/src/androidTest/java/androidx/ui/benchmark/test/LayoutNodeModifierBenchmark.kt
M ui/ui-core/api/0.1.0-dev15.txt
M ui/ui-core/api/current.txt
M ui/ui-core/api/public_plus_experimental_0.1.0-dev15.txt
M ui/ui-core/api/public_plus_experimental_current.txt
M ui/ui-core/api/restricted_0.1.0-dev15.txt
M ui/ui-core/api/restricted_current.txt
M ui/ui-core/src/androidAndroidTest/kotlin/androidx/ui/graphics/vector/VectorTest.kt
M ui/ui-core/src/androidAndroidTest/kotlin/androidx/ui/semantics/SemanticsTests.kt
M ui/ui-core/src/androidMain/kotlin/androidx/ui/core/AndroidActuals.kt
M ui/ui-core/src/androidMain/kotlin/androidx/ui/core/AndroidComposeView.kt
M ui/ui-core/src/androidMain/kotlin/androidx/ui/core/AndroidComposeViewAccessibilityDelegateCompat.kt
M ui/ui-core/src/androidMain/kotlin/androidx/ui/core/AndroidPopup.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/core/Expect.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/core/semantics/SemanticsConfiguration.kt
D ui/ui-core/src/commonMain/kotlin/androidx/ui/core/semantics/SemanticsHintOverrides.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/core/semantics/SemanticsModifier.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/core/semantics/SemanticsNode.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/core/semantics/SemanticsOwner.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/core/semantics/SemanticsWrapper.kt
M ui/ui-core/src/commonMain/kotlin/androidx/ui/semantics/SemanticsProperties.kt
M ui/ui-foundation/api/0.1.0-dev15.txt
M ui/ui-foundation/api/current.txt
M ui/ui-foundation/api/public_plus_experimental_0.1.0-dev15.txt
M ui/ui-foundation/api/public_plus_experimental_current.txt
M ui/ui-foundation/api/restricted_0.1.0-dev15.txt
M ui/ui-foundation/api/restricted_current.txt
M ui/ui-foundation/src/main/java/androidx/ui/foundation/Clickable.kt
M ui/ui-foundation/src/main/java/androidx/ui/foundation/Dialog.kt
M ui/ui-foundation/src/main/java/androidx/ui/foundation/Scroller.kt
M ui/ui-foundation/src/main/java/androidx/ui/foundation/selection/Selectable.kt
M ui/ui-foundation/src/main/java/androidx/ui/foundation/selection/Toggleable.kt
M ui/ui-foundation/src/main/java/androidx/ui/foundation/semantics/FoundationSemanticsProperties.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/ButtonTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/CardTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/CheckboxScreenshotTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/RadioButtonScreenshotTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/ScaffoldTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/SnackbarTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/SurfaceTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/ripple/RippleIndicationTest.kt
M ui/ui-material/src/androidTest/java/androidx/ui/material/textfield/TextFieldScreenshotTest.kt
M ui/ui-material/src/main/java/androidx/ui/material/AppBar.kt
M ui/ui-material/src/main/java/androidx/ui/material/TextFieldImpl.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/AssertsTest.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/CallSemanticsActionTest.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/ErrorMessagesTest.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/FindersTest.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/PrintToStringTest.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/ScrollToTest.kt
M ui/ui-test/src/androidTest/java/androidx/ui/test/TextActionsTest.kt
M ui/ui-test/src/main/java/androidx/ui/test/Actions.kt
M ui/ui-test/src/main/java/androidx/ui/test/Filters.kt
M ui/ui-text/api/0.1.0-dev15.txt
M ui/ui-text/api/current.txt
M ui/ui-text/api/public_plus_experimental_0.1.0-dev15.txt
M ui/ui-text/api/public_plus_experimental_current.txt
M ui/ui-text/api/restricted_0.1.0-dev15.txt
M ui/ui-text/api/restricted_current.txt
M ui/ui-text/src/commonMain/kotlin/androidx/ui/text/CoreTextField.kt
M ui/ui-text/src/commonMain/kotlin/androidx/ui/text/TextSemanticsProperties.kt

https://android-review.googlesource.com/1360099

kj...@gmail.com <kj...@gmail.com> #3Jul 20, 2023 06:59PM

Getting hang

lo...@gmail.com <lo...@gmail.com> #4Jul 23, 2023 07:16PM

Fingerprint is not working and fingerprint is not show in setting

be...@airbnb.com <be...@airbnb.com> #5Jul 24, 2023 04:46PM

I am unfortunately not able to reproduce the issue. We are seeing this crash affect ~0.05% of sessions (across random screen), so it does seem to be an extremely nuanced race condition.

I understand if you are unable to proceed without full debug logs, however, I think I provided a compelling argument of what causes the bug in the initial ticket.

We have been able to mitigate the issue by installing a back pressed dispatcher when which by the nature of being invoked whenever OnBackPressedDispatcher would have been invoked, has the opportunity to catch the exception in the android framework.

// Register in onCreate / remove in onDestroy of any activity that has an unconditionally enabled `OnBackPressedCallbacks`
 val callback = OnBackInvokedCallback {
                try {
                    // Delegate to the "normal" back pressed dispatcher flow.
                    onBackPressedDispatcher.onBackPressed()
                } catch (exception: NullPointerException) {
                    if (exception.message?.contains("android.os.Handler android.app.FragmentHostCallback.getHandler()") == true) {
                        throwOrNotify("Api33 back-press dispatcher failed to invoke", exception)
                        finish()
                    } else {
                        throw exception
                    }
                }
            }

fe...@gmail.com <fe...@gmail.com> #6Jul 26, 2023 05:08PM

Remover in onDestroy off

su...@google.com <su...@google.com> Aug 3, 2023 02:34PM

Status: New

il...@google.com <il...@google.com> #7Aug 4, 2023 10:00PM

Assigned to sa...@google.com.

The underlying root cause for this issue is that the framework would continue to send OnBackInvokedCallback callbacks for an ongoing gesture even after the activity is destroyed mid-gesture. This has already been fixed for Android 14.

We already handle one exception thrown by the framework, so we'll leave this open to provide a similar workaround specifically for Android 13 devices.

il...@google.com <il...@google.com> Aug 16, 2023 11:23PM

Reassigned to jb...@google.com.

ap...@google.com <ap...@google.com> #8Aug 17, 2023 12:49AM

Project: platform/frameworks/support
Branch: androidx-main

commit d933f4c0ecd6d16970114811f4bfb3f3a95647a6
Author: Jeremy Woods <jbwoods@google.com>
Date: Wed Aug 16 23:59:35 2023

Avoid NPE when calling onBackPressed on Android 13

There is a bug in Android 13 where the on BackPressedDisptacher will
still deliver an onBackPressed signal after an Activity has been
DESTROYED.

As a work around we can catch that error and keep the crash from
happening.

RelNote: "ComponentActivity will no longer show a NPE on Android 13 when
a it gets an `onBackPressed()` callback when `DESTROYED`."
Test: Added test
Bug: 291869278

Change-Id: Idb0555c76dd63173a1fa93e34b8bc622500b9176

M activity/activity/src/androidTest/java/androidx/activity/OnBackPressedDispatcherTest.kt
M activity/activity/src/main/java/androidx/activity/ComponentActivity.java

https://android-review.googlesource.com/2713594

jb...@google.com <jb...@google.com> #9Aug 17, 2023 12:57AM

Marked as fixed.

This has been fixed internally and will be available in Activity 1.8.0-alpha07.