IssueTracker

Since enabling android 13's enableOnBackInvokedCallback setting, our app has been experiencing a number of sporadic crashes originating in android only code.

Our app only uses OnBackPressedCallback, and registers using LifecycleOwners. (We do not change OnBackInvokedDispatcher).

java.lang.NullPointerException: Attempt to invoke virtual method 'android.os.Handler android.app.FragmentHostCallback.getHandler()' on a null object reference
        at android.app.FragmentManagerImpl.ensureExecReady(FragmentManager.java:2008)
        at android.app.FragmentManagerImpl.execPendingActions(FragmentManager.java:2061)
        at android.app.FragmentManagerImpl.popBackStackImmediate(FragmentManager.java:874)
        at android.app.FragmentManagerImpl.popBackStackImmediate(FragmentManager.java:835)
        at android.app.Activity.onBackPressed(Activity.java:4083)
        at androidx.activity.ComponentActivity.access$001(ComponentActivity.java:121)
        at androidx.activity.ComponentActivity$1.run(ComponentActivity.java:165)
        at androidx.activity.OnBackPressedDispatcher.onBackPressed(OnBackPressedDispatcher.kt:216)
        at androidx.activity.OnBackPressedDispatcher$2.invoke(OnBackPressedDispatcher.kt:102)
        at androidx.activity.OnBackPressedDispatcher$2.invoke(OnBackPressedDispatcher.kt:102)
        at androidx.activity.OnBackPressedDispatcher$Api33Impl.createOnBackInvokedCallback$lambda$0(OnBackPressedDispatcher:286)
        at androidx.activity.OnBackPressedDispatcher$Api33Impl$$InternalSyntheticLambda$1$5dea06066ea46437e84a2264f31c2ea84a3652ee19c7688a4a1451cf132e3013$0.onBackInvoked(OnBackPressedDispatcher:3)
        at android.window.WindowOnBackInvokedDispatcher$OnBackInvokedCallbackWrapper.lambda$onBackInvoked$3$android-window-WindowOnBackInvokedDispatcher$OnBackInvokedCallbackWrapper(WindowOnBackInvokedDispatcher.java:287)
        at android.window.WindowOnBackInvokedDispatcher$OnBackInvokedCallbackWrapper$$ExternalSyntheticLambda0.run(Unknown:2)
        at android.os.Handler.handleCallback(Handler.java:942)
        at android.os.Handler.dispatchMessage(Handler.java:99)
        at android.os.Looper.loopOnce(Looper.java:226)
        at android.os.Looper.loop(Looper.java:313)
        at android.app.ActivityThread.main(ActivityThread.java:8757)
        at java.lang.reflect.Method.invoke(Method.java:-2)
        at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:571)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1067)

I have not been able to create a reliable reproduction, however, have a hypothesis from reading through the source code.

1. The nature of the crash invoking the fallbackHandler implies that WindowOnBackInvokedDispatcher is invoking an OnBackPressedDispatcher with no enabled OnBackPressedCallbacks. The crash itself seems to imply the FragmentManager has been destroyed.
2. This appears somewhat unexpected from the platform, as in OnBackPressedDispatcher, there is logic to ensure when there are no active callbacks the window dispatcher is updated to not have the OnBackPressedDispatcher as the "topCallback". Instead the Activity's navigateBack is used. Notably, navigateBack does not perform a popBackStackImmediate which is different from the OnBackPressedDispatchers fallback which ultimately invokes onBackPress and popBackStackImmediate
3. The WindowOnBackInvokedDispatcher uses a weak reference to the proper back callback which is created via setTopOnBackInvokedCallback.
4. Since back presses are enqueued on a handler in WindowOnBackInvokedDispatcher, if there is a back-press enqueued while there is another message ahead of it which will cause WindowOnBackInvokedDispatcher to update it's topCallback, it can run on a stale callback.

This race condition ultimately means that Activity.onBackPressed is invoked instead of Activity.navigateBack, exposing the app to the crash in fragment manager's popBackStackImmediate.

This is just speculation, but from our crash breadcrumbs it does seem that this crash is also proceeded by the destroy event of an activity 5-100ms prior.

It would be much appreciated to have the perspective of someone more familiar with the platform code. We are seeing a steady increase in this crash as more users adopt android 13.