Android 13: Crash in WindowOnBackInvokedDispatcher / OnBackPressedDispatcher [291869278]

Fixed

Bug

androidx-activity-1.8.0-alpha07

Status Update

No update yet.

Description

be...@airbnb.com

created issue #1

Jul 19, 2023 06:45PM

Since enabling android 13's enableOnBackInvokedCallback setting, our app has been experiencing a number of sporadic crashes originating in android only code.

Our app only uses OnBackPressedCallback, and registers using LifecycleOwners. (We do not change OnBackInvokedDispatcher).

java.lang.NullPointerException: Attempt to invoke virtual method 'android.os.Handler android.app.FragmentHostCallback.getHandler()' on a null object reference
        at android.app.FragmentManagerImpl.ensureExecReady(FragmentManager.java:2008)
        at android.app.FragmentManagerImpl.execPendingActions(FragmentManager.java:2061)
        at android.app.FragmentManagerImpl.popBackStackImmediate(FragmentManager.java:874)
        at android.app.FragmentManagerImpl.popBackStackImmediate(FragmentManager.java:835)
        at android.app.Activity.onBackPressed(Activity.java:4083)
        at androidx.activity.ComponentActivity.access$001(ComponentActivity.java:121)
        at androidx.activity.ComponentActivity$1.run(ComponentActivity.java:165)
        at androidx.activity.OnBackPressedDispatcher.onBackPressed(OnBackPressedDispatcher.kt:216)
        at androidx.activity.OnBackPressedDispatcher$2.invoke(OnBackPressedDispatcher.kt:102)
        at androidx.activity.OnBackPressedDispatcher$2.invoke(OnBackPressedDispatcher.kt:102)
        at androidx.activity.OnBackPressedDispatcher$Api33Impl.createOnBackInvokedCallback$lambda$0(OnBackPressedDispatcher:286)
        at androidx.activity.OnBackPressedDispatcher$Api33Impl$$InternalSyntheticLambda$1$5dea06066ea46437e84a2264f31c2ea84a3652ee19c7688a4a1451cf132e3013$0.onBackInvoked(OnBackPressedDispatcher:3)
        at android.window.WindowOnBackInvokedDispatcher$OnBackInvokedCallbackWrapper.lambda$onBackInvoked$3$android-window-WindowOnBackInvokedDispatcher$OnBackInvokedCallbackWrapper(WindowOnBackInvokedDispatcher.java:287)
        at android.window.WindowOnBackInvokedDispatcher$OnBackInvokedCallbackWrapper$$ExternalSyntheticLambda0.run(Unknown:2)
        at android.os.Handler.handleCallback(Handler.java:942)
        at android.os.Handler.dispatchMessage(Handler.java:99)
        at android.os.Looper.loopOnce(Looper.java:226)
        at android.os.Looper.loop(Looper.java:313)
        at android.app.ActivityThread.main(ActivityThread.java:8757)
        at java.lang.reflect.Method.invoke(Method.java:-2)
        at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:571)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1067)

I have not been able to create a reliable reproduction, however, have a hypothesis from reading through the source code.

The nature of the crash invoking the fallbackHandler implies that WindowOnBackInvokedDispatcher is invoking an OnBackPressedDispatcher with no enabled OnBackPressedCallbacks. The crash itself seems to imply the FragmentManager has been destroyed.
This appears somewhat unexpected from the platform, as in OnBackPressedDispatcher, there is logic to ensure when there are no active callbacks the window dispatcher is updated to not have the OnBackPressedDispatcher as the "topCallback". Instead the Activity's navigateBack is used. Notably, navigateBack does not perform a popBackStackImmediate which is different from the OnBackPressedDispatchers fallback which ultimately invokes onBackPress and popBackStackImmediate
The WindowOnBackInvokedDispatcher uses a weak reference to the proper back callback which is created via setTopOnBackInvokedCallback.
Since back presses are enqueued on a handler in WindowOnBackInvokedDispatcher, if there is a back-press enqueued while there is another message ahead of it which will cause WindowOnBackInvokedDispatcher to update it's topCallback, it can run on a stale callback.

This race condition ultimately means that Activity.onBackPressed is invoked instead of Activity.navigateBack, exposing the app to the crash in fragment manager's popBackStackImmediate.

This is just speculation, but from our crash breadcrumbs it does seem that this crash is also proceeded by the destroy event of an activity 5-100ms prior.

It would be much appreciated to have the perspective of someone more familiar with the platform code. We are seeing a steady increase in this crash as more users adopt android 13.

Comments

su...@google.com <su...@google.com> Jul 20, 2023 07:37AM

Assigned to su...@google.com.

su...@google.com <su...@google.com> #2Jul 20, 2023 09:02AM

Yigit, do you have time to fix it?

reemission of the same liveData is racy

kj...@gmail.com <kj...@gmail.com> #3Jul 20, 2023 06:59PM

yea i'll take it.

lo...@gmail.com <lo...@gmail.com> #4Jul 23, 2023 07:16PM

Thanks for the detailed analysis. This may not be an issue anymore since we've started using Main.immediate there but I' not sure; I'll try to create a test case.

be...@airbnb.com <be...@airbnb.com> #5Jul 24, 2023 04:46PM

just emitting same live data reproduces the issue.

@Test
fun raceTest() {
val subLiveData = MutableLiveData(1)
val subject = liveData(testScope.coroutineContext) {
emitSource(subLiveData)
emitSource(subLiveData) //crashes
}
subject.addObserver().apply {
testScope.advanceUntilIdle()
}
}

fe...@gmail.com <fe...@gmail.com> #6Jul 26, 2023 05:08PM

With 2.2.0-alpha04 (that use Main.immediate), the issue seems to be still there (I tested it by calling emitSource() twice, like your test case)

su...@google.com <su...@google.com> Aug 3, 2023 02:34PM

Status: New

il...@google.com <il...@google.com> #7Aug 4, 2023 10:00PM

Assigned to sa...@google.com.

yea sorry immediate does not fix it.
I actually have a WIP fix for it:

https://android-review.googlesource.com/c/platform/frameworks/support/+/1112186

if your case is the one i found (emitting same LiveData multiple times, as shown in #5) you can work around it by adding a dummy transformation.

val subLiveData = MutableLiveData(1)
val subject = liveData(testScope.coroutineContext) {
emitSource(subLiveData.map {it })
emitSource(subLiveData.map {it} )
}

il...@google.com <il...@google.com> Aug 16, 2023 11:23PM

Reassigned to jb...@google.com.

ap...@google.com <ap...@google.com> #8Aug 17, 2023 12:49AM

Project: platform/frameworks/support
Branch: androidx-master-dev

commit af12e75e6b4110f48e44ca121466943909de8f06
Author: Yigit Boyar <yboyar@google.com>
Date: Tue Sep 03 12:58:11 2019

Fix coroutine livedata race condition

This CL fixes a bug in liveData builder where emitting same
LiveData source twice would make it crash because the second
emission registry could possibly happen before first one is
removed as source.

We fix it by using a suspending dispose function. It does feel
a bit hacky but we cannot make DisposableHandle.dispose async
and we do not want to block there. This does not mean that there
is a problem if developer disposes it manually since our emit
functions take care of making sure it disposes (and there is
no other way to add source to the underlying MediatorLiveData)

Bug: 140249349
Test: BuildLiveDataTest#raceTest_*

Change-Id: I0b464c242a583da4669af195cf2504e2adc4de40

M lifecycle/lifecycle-livedata-ktx/api/2.2.0-alpha05.txt
M lifecycle/lifecycle-livedata-ktx/api/current.txt
M lifecycle/lifecycle-livedata-ktx/api/public_plus_experimental_2.2.0-alpha05.txt
M lifecycle/lifecycle-livedata-ktx/api/public_plus_experimental_current.txt
M lifecycle/lifecycle-livedata-ktx/api/restricted_2.2.0-alpha05.txt
M lifecycle/lifecycle-livedata-ktx/api/restricted_current.txt
M lifecycle/lifecycle-livedata-ktx/src/main/java/androidx/lifecycle/CoroutineLiveData.kt
M lifecycle/lifecycle-livedata-ktx/src/test/java/androidx/lifecycle/BuildLiveDataTest.kt

https://android-review.googlesource.com/1112186

https://goto.google.com/android-sha1/af12e75e6b4110f48e44ca121466943909de8f06

jb...@google.com <jb...@google.com> #9Aug 17, 2023 12:57AM

Marked as fixed.

This has been fixed internally and will be available in Activity 1.8.0-alpha07.