ArrayIndexOutOfBoundsException in AccessibilityNodeInfo [68299168]

Duplicate

of 35626351

Bug

NeedsInfo

Status Update

No update yet.

Description

jo...@htc.com

created issue #1

Oct 26, 2017 10:23AM

Hello,

We meet an issue in AccessibilityServcie.

Android build
htc/ocmdugl_00999/htc_ocmdugl:8.0.0/OPR6.170623.013/990205.1:user/release-keys

Steps to reproduce
Hard to reproduce.

The problem might be:

We have an Ap that extends AccessibilityService and only get AccessibilityNodeInfo without modify it.
But we have an opportunity that AP will meet ArrayIndexOutOfBoundsException.
We review our code and it does not modify AccessibilityNodeInfo on one thread while reading it on another.
We have no idea how to resolve this exception in our Ap due to the crash access point is not in our Ap control side.
Our AccessibilityService sample is as attached file AccessibilityController.java.

--------- beginning of crash
10-25 16:05:17.993 4846 4846 E AndroidRuntime: FATAL EXCEPTION: main
10-25 16:05:17.993 4846 4846 E AndroidRuntime: Process: com.htc.screencapture, PID: 4846
10-25 16:05:17.993 4846 4846 E AndroidRuntime: java.lang.ArrayIndexOutOfBoundsException: src.length=7 srcPos=0 dst.length=7 dstPos=1 length=7
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at java.lang.System.arraycopy(Native Method)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at java.util.ArrayList.addAll(ArrayList.java:591)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at android.view.accessibility.AccessibilityNodeInfo.init(AccessibilityNodeInfo.java:3232)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at android.view.accessibility.AccessibilityNodeInfo.refresh(AccessibilityNodeInfo.java:887)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at android.view.accessibility.AccessibilityCache$AccessibilityNodeRefresher.refreshNode(AccessibilityCache.java:564)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at android.view.accessibility.AccessibilityCache.refreshCachedNodeLocked(AccessibilityCache.java:206)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at android.view.accessibility.AccessibilityCache.onAccessibilityEvent(AccessibilityCache.java:170)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at android.view.accessibility.AccessibilityInteractionClient.onAccessibilityEvent(AccessibilityInteractionClient.java:541)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at android.accessibilityservice.AccessibilityService$IAccessibilityServiceClientWrapper.executeMessage(AccessibilityService.java:1715)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at com.android.internal.os.HandlerCaller$MyHandler.handleMessage(HandlerCaller.java:37)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:105)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at android.os.Looper.loop(Looper.java:180)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at android.app.ActivityThread.main(ActivityThread.java:6950)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at com.android.internal.os.Zygote$MethodAndArgsCaller.run(Zygote.java:240)
10-25 16:05:17.993 4846 4846 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:835)

We also meet the same ArrayIndexOutOfBoundsException when another test ap using uiautomator for testing.
--------- beginning of crash
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: UiAutomatorHandlerThread
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: java.lang.ArrayIndexOutOfBoundsException: src.length=7 srcPos=0 dst.length=7 dstPos=1 length=7
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at java.lang.System.arraycopy(Native Method)
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at java.util.ArrayList.addAll(ArrayList.java:591)
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at android.view.accessibility.AccessibilityNodeInfo.init(AccessibilityNodeInfo.java:3212)
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at android.view.accessibility.AccessibilityNodeInfo.refresh(AccessibilityNodeInfo.java:867)
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at android.view.accessibility.AccessibilityCache$AccessibilityNodeRefresher.refreshNode(AccessibilityCache.java:564)
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at android.view.accessibility.AccessibilityCache.refreshCachedNodeLocked(AccessibilityCache.java:206)
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at android.view.accessibility.AccessibilityCache.onAccessibilityEvent(AccessibilityCache.java:170)
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at android.view.accessibility.AccessibilityInteractionClient.onAccessibilityEvent(AccessibilityInteractionClient.java:541)
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at android.accessibilityservice.AccessibilityService$IAccessibilityServiceClientWrapper.executeMessage(AccessibilityService.java:1709)
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at com.android.internal.os.HandlerCaller$MyHandler.handleMessage(HandlerCaller.java:37)
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:105)
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at android.os.Looper.loop(Looper.java:180)
10-07 17:15:10.073 root 8078 8162 E AndroidRuntime: at android.os.HandlerThread.run(HandlerThread.java:65)

In order to find the root cause, we added debug log in AccessibilityNodeInfo.java to trace multi-thread access.
The modified is as attached file AccessibilityNodeInfo.java.diff.

We found that there is a possibility of concurrent access on the same node while one thread get node from AccessibilityCache and the other get node from pool.

//Get Node from AccessibilityCache
private void refreshCachedNodeLocked(int windowId, long sourceId) {
...
LongSparseArray<AccessibilityNodeInfo> nodes = mNodeCache.get(windowId);
...
if (mAccessibilityNodeRefresher.refreshNode(cachedInfo, true)) {
return;
}
...
}
public static class AccessibilityNodeRefresher {
public boolean refreshNode(AccessibilityNodeInfo info, boolean bypassCache) {
return info.refresh(null, bypassCache);
}
}
10-11 13:27:17.117 10147 10193 D AccessibilityNodeInfo: mt @[AccessibilityAction: ACTION_SELECT - null, AccessibilityAction: ACTION_CLEAR_SELECTION - null, AccessibilityAction: ACTION_ACCESSIBILITY_FOCUS - null, AccessibilityAction: ACTION_NEXT_AT_MOVEMENT_GRANULARITY - null, AccessibilityAction: ACTION_PREVIOUS_AT_MOVEMENT_GRANULARITY - null, AccessibilityAction: ACTION_SET_SELECTION - null, AccessibilityAction: ACTION_SHOW_ON_SCREEN - null]
android.view.accessibility.AccessibilityNodeInfo$DebugArrayList.addAll:699
android.view.accessibility.AccessibilityNodeInfo.init:3315
android.view.accessibility.AccessibilityNodeInfo.refresh:958
android.view.accessibility.AccessibilityCache$AccessibilityNodeRefresher.refreshNode:564
android.view.accessibility.AccessibilityCache.refreshCachedNodeLocked:206
android.view.accessibility.AccessibilityCache.onAccessibilityEvent:170
android.view.accessibility.AccessibilityInteractionClient.onAccessibilityEvent:541
android.accessibilityservice.AccessibilityService$IAccessibilityServiceClientWrapper.executeMessage:1715
com.android.internal.os.HandlerCaller$MyHandler.handleMessage:37

//get node from pool
public static final Parcelable.Creator<AccessibilityNodeInfo> CREATOR =
new Parcelable.Creator<AccessibilityNodeInfo>() {
@Override
public AccessibilityNodeInfo createFromParcel(Parcel parcel) {
AccessibilityNodeInfo info = AccessibilityNodeInfo.obtain();
info.initFromParcel(parcel);
return info;
}
}
public static AccessibilityNodeInfo obtain() {
AccessibilityNodeInfo info = sPool.acquire();
if (sNumInstancesInUse != null) {
sNumInstancesInUse.incrementAndGet();
}
return (info != null) ? info : new AccessibilityNodeInfo();
}
10-11 13:27:17.117 10147 10177 D AccessibilityNodeInfo: mt @[AccessibilityAction: ACTION_SELECT - null, AccessibilityAction: ACTION_CLEAR_SELECTION - null, AccessibilityAction: ACTION_ACCESSIBILITY_FOCUS - null, AccessibilityAction: ACTION_NEXT_AT_MOVEMENT_GRANULARITY - null, AccessibilityAction: ACTION_PREVIOUS_AT_MOVEMENT_GRANULARITY - null, AccessibilityAction: ACTION_SET_SELECTION - null, AccessibilityAction: ACTION_SHOW_ON_SCREEN - null]
android.view.accessibility.AccessibilityNodeInfo$DebugArrayList.remove:705
android.view.accessibility.AccessibilityNodeInfo.addActionUnchecked:1251
android.view.accessibility.AccessibilityNodeInfo.initFromParcel:3397
android.view.accessibility.AccessibilityNodeInfo.-wrap1:0
android.view.accessibility.AccessibilityNodeInfo$1.createFromParcel:4723
android.view.accessibility.AccessibilityNodeInfo$1.createFromParcel:4720
android.os.Parcel.readParcelable:2790
android.view.accessibility.AccessibilityEvent.readAccessibilityRecordFromParcel:1116
android.view.accessibility.AccessibilityEvent.initFromParcel:1076

deleted

Restricted

0 B

deleted

Restricted

0 B

deleted

Restricted

0 B

Comments

dn...@google.com <dn...@google.com> #2Oct 26, 2017 01:44PM

Assigned to dn...@google.com.

I'm also seeing this issue, specifically under low-memory conditions and only on a Nexus 5x running Nougat. I was trying to launch a camera intent from a fragment. I've attached my log as well.

pw...@google.com <pw...@google.com> #3Oct 26, 2017 05:05PM

Status: Duplicate of

35626351

I'm seeing this crash too, specifically on build NBD90W of Android on the nexus 5x (october security patches). We're not using a camera intent, but we're using the camera API directly.

pw...@google.com <pw...@google.com> #4Oct 26, 2017 05:12PM

Oh, good point -- I, too, am running build NBD90W with the October 5 security patches.

[Deleted User] <[Deleted User]> #5Feb 15, 2018 02:10PM

Same here and my app uses Google Maps and a few images. It only crashes upon exit. My device is also Nexus 5X w/ build number NBD90W.

[Deleted User] <[Deleted User]> #6Apr 9, 2018 09:19AM

I am on NBD90W as well.

ja...@keepersecurity.com <ja...@keepersecurity.com> #7May 16, 2018 07:51PM

I was the reporter for the question on Stackoverflow -- I'm definitely glad other people are having this issue. Hopefully it can be resolved!

ka...@gmail.com <ka...@gmail.com> #8May 24, 2018 07:28AM

Can you provide the below requested information to better understand the issue:

Steps to reproduce
What steps do others need to take in order to reproduce the issue themselves?
Please attach sample project to reproduce the issue.

Frequency
How frequently does this issue occur? (e.g 100% of the time, 10% of the time)

Expected output
What do you expect to occur?

Current output
What do you see instead?

Android bug report:
After reproducing the issue, navigate to developer settings, ensure ‘USB debugging’ is enabled, then enable ‘Bug report shortcut’. To take bug report, hold the power button and select the ‘Take bug report’ option.

Note: Please upload the files to google drive and share the folder to android-bugreport@google.com, then share the link here.

st...@gmail.com <st...@gmail.com> #9Jun 25, 2018 12:37PM

Seeing the same crash here, I am using Android 7 and Nexus 5x.

Issue 68299168

Description

Issue summary

Comments

dn...@google.com <dn...@google.com> #2Oct 26, 2017 01:44PM

pw...@google.com <pw...@google.com> #3Oct 26, 2017 05:05PM

pw...@google.com <pw...@google.com> #4Oct 26, 2017 05:12PM

[Deleted User] <[Deleted User]> #5Feb 15, 2018 02:10PM

[Deleted User] <[Deleted User]> #6Apr 9, 2018 09:19AM

ja...@keepersecurity.com <ja...@keepersecurity.com> #7May 16, 2018 07:51PM

ka...@gmail.com <ka...@gmail.com> #8May 24, 2018 07:28AM

st...@gmail.com <st...@gmail.com> #9Jun 25, 2018 12:37PM

Add comment

Issue metadata