Android 13: Crash in WindowOnBackInvokedDispatcher / OnBackPressedDispatcher [291869278]

Fixed

Bug

androidx-activity-1.8.0-alpha07

Status Update

No update yet.

Description

be...@airbnb.com

created issue #1

Jul 19, 2023 06:45PM

Since enabling android 13's enableOnBackInvokedCallback setting, our app has been experiencing a number of sporadic crashes originating in android only code.

Our app only uses OnBackPressedCallback, and registers using LifecycleOwners. (We do not change OnBackInvokedDispatcher).

java.lang.NullPointerException: Attempt to invoke virtual method 'android.os.Handler android.app.FragmentHostCallback.getHandler()' on a null object reference
        at android.app.FragmentManagerImpl.ensureExecReady(FragmentManager.java:2008)
        at android.app.FragmentManagerImpl.execPendingActions(FragmentManager.java:2061)
        at android.app.FragmentManagerImpl.popBackStackImmediate(FragmentManager.java:874)
        at android.app.FragmentManagerImpl.popBackStackImmediate(FragmentManager.java:835)
        at android.app.Activity.onBackPressed(Activity.java:4083)
        at androidx.activity.ComponentActivity.access$001(ComponentActivity.java:121)
        at androidx.activity.ComponentActivity$1.run(ComponentActivity.java:165)
        at androidx.activity.OnBackPressedDispatcher.onBackPressed(OnBackPressedDispatcher.kt:216)
        at androidx.activity.OnBackPressedDispatcher$2.invoke(OnBackPressedDispatcher.kt:102)
        at androidx.activity.OnBackPressedDispatcher$2.invoke(OnBackPressedDispatcher.kt:102)
        at androidx.activity.OnBackPressedDispatcher$Api33Impl.createOnBackInvokedCallback$lambda$0(OnBackPressedDispatcher:286)
        at androidx.activity.OnBackPressedDispatcher$Api33Impl$$InternalSyntheticLambda$1$5dea06066ea46437e84a2264f31c2ea84a3652ee19c7688a4a1451cf132e3013$0.onBackInvoked(OnBackPressedDispatcher:3)
        at android.window.WindowOnBackInvokedDispatcher$OnBackInvokedCallbackWrapper.lambda$onBackInvoked$3$android-window-WindowOnBackInvokedDispatcher$OnBackInvokedCallbackWrapper(WindowOnBackInvokedDispatcher.java:287)
        at android.window.WindowOnBackInvokedDispatcher$OnBackInvokedCallbackWrapper$$ExternalSyntheticLambda0.run(Unknown:2)
        at android.os.Handler.handleCallback(Handler.java:942)
        at android.os.Handler.dispatchMessage(Handler.java:99)
        at android.os.Looper.loopOnce(Looper.java:226)
        at android.os.Looper.loop(Looper.java:313)
        at android.app.ActivityThread.main(ActivityThread.java:8757)
        at java.lang.reflect.Method.invoke(Method.java:-2)
        at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:571)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1067)

I have not been able to create a reliable reproduction, however, have a hypothesis from reading through the source code.

The nature of the crash invoking the fallbackHandler implies that WindowOnBackInvokedDispatcher is invoking an OnBackPressedDispatcher with no enabled OnBackPressedCallbacks. The crash itself seems to imply the FragmentManager has been destroyed.
This appears somewhat unexpected from the platform, as in OnBackPressedDispatcher, there is logic to ensure when there are no active callbacks the window dispatcher is updated to not have the OnBackPressedDispatcher as the "topCallback". Instead the Activity's navigateBack is used. Notably, navigateBack does not perform a popBackStackImmediate which is different from the OnBackPressedDispatchers fallback which ultimately invokes onBackPress and popBackStackImmediate
The WindowOnBackInvokedDispatcher uses a weak reference to the proper back callback which is created via setTopOnBackInvokedCallback.
Since back presses are enqueued on a handler in WindowOnBackInvokedDispatcher, if there is a back-press enqueued while there is another message ahead of it which will cause WindowOnBackInvokedDispatcher to update it's topCallback, it can run on a stale callback.

This race condition ultimately means that Activity.onBackPressed is invoked instead of Activity.navigateBack, exposing the app to the crash in fragment manager's popBackStackImmediate.

This is just speculation, but from our crash breadcrumbs it does seem that this crash is also proceeded by the destroy event of an activity 5-100ms prior.

It would be much appreciated to have the perspective of someone more familiar with the platform code. We are seeing a steady increase in this crash as more users adopt android 13.

Comments

su...@google.com <su...@google.com> Jul 20, 2023 07:37AM

Assigned to su...@google.com.

su...@google.com <su...@google.com> #2Jul 20, 2023 09:02AM

Hi Ed, Thank you so much for these suggestions. I've been reviewing them and merging them in. Hopefully it should be live. I've included a thank you note too in the article.

kj...@gmail.com <kj...@gmail.com> #3Jul 20, 2023 06:59PM

Great! Thanks a lot, I'll look for the live updates soon!

lo...@gmail.com <lo...@gmail.com> #4Jul 23, 2023 07:16PM

Fingerprint is not working and fingerprint is not show in setting

be...@airbnb.com <be...@airbnb.com> #5Jul 24, 2023 04:46PM

I am unfortunately not able to reproduce the issue. We are seeing this crash affect ~0.05% of sessions (across random screen), so it does seem to be an extremely nuanced race condition.

I understand if you are unable to proceed without full debug logs, however, I think I provided a compelling argument of what causes the bug in the initial ticket.

We have been able to mitigate the issue by installing a back pressed dispatcher when which by the nature of being invoked whenever OnBackPressedDispatcher would have been invoked, has the opportunity to catch the exception in the android framework.

// Register in onCreate / remove in onDestroy of any activity that has an unconditionally enabled `OnBackPressedCallbacks`
 val callback = OnBackInvokedCallback {
                try {
                    // Delegate to the "normal" back pressed dispatcher flow.
                    onBackPressedDispatcher.onBackPressed()
                } catch (exception: NullPointerException) {
                    if (exception.message?.contains("android.os.Handler android.app.FragmentHostCallback.getHandler()") == true) {
                        throwOrNotify("Api33 back-press dispatcher failed to invoke", exception)
                        finish()
                    } else {
                        throw exception
                    }
                }
            }

fe...@gmail.com <fe...@gmail.com> #6Jul 26, 2023 05:08PM

Remover in onDestroy off

su...@google.com <su...@google.com> Aug 3, 2023 02:34PM

Status: New

il...@google.com <il...@google.com> #7Aug 4, 2023 10:00PM

Assigned to sa...@google.com.

The underlying root cause for this issue is that the framework would continue to send OnBackInvokedCallback callbacks for an ongoing gesture even after the activity is destroyed mid-gesture. This has already been fixed for Android 14.

We already handle one exception thrown by the framework, so we'll leave this open to provide a similar workaround specifically for Android 13 devices.

il...@google.com <il...@google.com> Aug 16, 2023 11:23PM

Reassigned to jb...@google.com.

ap...@google.com <ap...@google.com> #8Aug 17, 2023 12:49AM

Project: platform/frameworks/support
Branch: androidx-main

commit d933f4c0ecd6d16970114811f4bfb3f3a95647a6
Author: Jeremy Woods <jbwoods@google.com>
Date: Wed Aug 16 23:59:35 2023

Avoid NPE when calling onBackPressed on Android 13

There is a bug in Android 13 where the on BackPressedDisptacher will
still deliver an onBackPressed signal after an Activity has been
DESTROYED.

As a work around we can catch that error and keep the crash from
happening.

RelNote: "ComponentActivity will no longer show a NPE on Android 13 when
a it gets an `onBackPressed()` callback when `DESTROYED`."
Test: Added test
Bug: 291869278

Change-Id: Idb0555c76dd63173a1fa93e34b8bc622500b9176

M activity/activity/src/androidTest/java/androidx/activity/OnBackPressedDispatcherTest.kt
M activity/activity/src/main/java/androidx/activity/ComponentActivity.java

https://android-review.googlesource.com/2713594

jb...@google.com <jb...@google.com> #9Aug 17, 2023 12:57AM

Marked as fixed.

This has been fixed internally and will be available in Activity 1.8.0-alpha07.