1243662 - crash in java.lang.NullPointerException: Attempt to invoke virtual method ''java.lang.String android.content.ComponentName.getPackageName()'' on a null object reference at android.os.Parcel.readException(Parcel.java)

Status: RESOLVED WONTFIX

(Firefox for Android Graveyard :: General, defect)

Description

[Kevin Brosnan [Ex-Mozilla]]

This bug was filed from the Socorro interface and is 
report bp-d3f4c982-67c9-4771-9490-59ea32160127.
=============================================================

 	

java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.String android.content.ComponentName.getPackageName()' on a null object reference
	at android.os.Parcel.readException(Parcel.java:1626)
	at android.os.Parcel.readException(Parcel.java:1573)
	at android.app.ActivityManagerProxy.startActivity(ActivityManagerNative.java:2667)
	at android.app.Instrumentation.execStartActivity(Instrumentation.java:1509)
	at android.app.Activity.startActivityForResult(Activity.java:3930)
	at android.app.Activity.startActivityForResult(Activity.java:3890)
	at android.support.v4.app.FragmentActivity.startActivityForResult(Unknown Source)
	at org.mozilla.gecko.GeckoActivity.startActivityForResult(GeckoActivity.java:68)
	at android.app.Activity.startActivity(Activity.java:4213)
	at android.app.Activity.startActivity(Activity.java:4181)
	at org.mozilla.gecko.GeckoActivity.startActivity(GeckoActivity.java:62)
	at org.mozilla.gecko.GeckoAppShell.openUriExternal(GeckoAppShell.java:1062)
	at org.mozilla.gecko.mozglue.GeckoLoader.nativeRun(Native Method)
	at org.mozilla.gecko.GeckoThread.run(GeckoThread.java:436)

Mfg.       Model   And. API    CPU ABI    #      
samsung  GT-I9300  23 (REL)  armeabi-v7a  21  13.7%
oneplus  A0001     23 (REL)  armeabi-v7a  16  10.5%
samsung  GT-I9505  23 (REL)  armeabi-v7a  14   9.2%
samsung  SM-G900F  23 (REL)  armeabi-v7a  12   7.8%
lge      Nexus 5   23 (REL)  armeabi-v7a  10   6.5%

Comment 1

[Michael Comella (:mcomella) [NI reported issues only: ex-Mozilla]]

110 crashes this week, FF43-46.

Comment 2

[:Margaret Leibovic]

I'm hoping this will be straightforward to fix, let's see if we can get a patch.

liuche, asking you to help out so that ahunt isn't the only person on top of all these crashes :)

Comment 3

[:Margaret Leibovic]

Just want to poke this bug, since it's tracking 45...

Comment 4

[Chenxia Liu [:liuche]]

I think this is happening because when you call startActivity (instead of startActivityForResult) the callingPackage is null (because no result is expected to be passed back). [1]

It looks like in the stack trace, the call is switching from startActivity to startActivityForResult, and maybe we're overwriting the resultCode from -1 (which means no activityForResult) to some other code?

This bug is on 23 only (and has a good number of cyanogen users), and I haven't been able to repro it - it *looks* like an external link is being opened in private browsing that has an intent that leaves Fennec (like flipkart.com) which pops up a "leaving private browsing" dialog, but as far as I can tell we removed the "open external links in PB" pref and there are no other ways to open an external link in PB. There have been a bunch of recent changes to the code calling ExternalIntentDuringPrivateBrowsingPromptFragment [2] but I don't think they cause problems. (flipkart.com was also mentioned in the string of previous bugs changing this code.)

Maybe this is from handling Intent:OpenNoHandler code? [3] but I'm not really sure how that gets called without a package.

Alternatively, and this is a stretch, the 23 only makes me wonder if this is somehow related to our M-specific code, and it looks like when we launch permissions/settings from a Tab Queue action we do call startActivityForResult with a resultCode [4] but that doesn't come from Private Browsing, so the ExternalIntentDuringPrivateBrowsing wouldn't get kicked off. There is also some explicit "set package in data" code there, but again I don't know how that would kick off in Private Browsing.

Sebastian, do you have any ideas about this bug? I feel like it should be pretty simple because we only call ExternalIntentFromPrivateBrowsing from two places.

[1] http://developer.android.com/reference/android/app/Activity.html#getCallingPackage%28%29
[2] http://hg.mozilla.org/mozilla-central/diff/a0e7d1e3945e/mobile/android/base/java/org/mozilla/gecko/GeckoAppShell.java#l1062
[3] http://mxr.mozilla.org/mozilla-central/source/mobile/android/components/ContentDispatchChooser.js#61
[4] http://mxr.mozilla.org/mozilla-central/source/mobile/android/base/java/org/mozilla/gecko/tabqueue/TabQueuePrompt.java#162

Comment 5

[Sebastian Kaspari (:sebastian; :pocmo)]

The stack trace in comment 0 is a bit confusing when looking at the current code. That's one from a more recent version (truncated):

> java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.String android.content.ComponentName.getPackageName()' on a null object reference
> [..]
>	at android.app.Instrumentation.execStartActivity(Instrumentation.java:1509)
>	at android.app.Activity.startActivityForResult(Activity.java:3930)
>	at android.app.Activity.startActivityForResult(Activity.java:3890)
>	at android.support.v4.app.FragmentActivity.startActivityForResult(Unknown Source)
>	at org.mozilla.gecko.GeckoActivity.startActivityForResult(GeckoActivity.java:68)
>	at android.app.Activity.startActivity(Activity.java:4213)
>	at android.app.Activity.startActivity(Activity.java:4181)
>	at org.mozilla.gecko.GeckoActivity.startActivity(GeckoActivity.java:62)
>	at org.mozilla.gecko.ActivityHandlerHelper.startIntentAndCatch(ActivityHandlerHelper.java:37)
>	at org.mozilla.gecko.widget.ExternalIntentDuringPrivateBrowsingPromptFragment.showDialogOrAndroidChooser(ExternalIntentDuringPrivateBrowsingPromptFragment.java:66)
>	at org.mozilla.gecko.GeckoAppShell.openUriExternal(GeckoAppShell.java:1163)
>	at org.mozilla.gecko.GeckoAppShell.openUriExternal(GeckoAppShell.java:1104)
>	at org.mozilla.gecko.mozglue.GeckoLoader.nativeRun(Native Method)
>	at org.mozilla.gecko.GeckoThread.run(GeckoThread.java:435)

https://crash-stats.mozilla.com/report/index/0539c380-09d4-4598-aad4-d826c2160310

(In reply to Chenxia Liu [:liuche] from comment #4)
> This bug is on 23 only (and has a good number of cyanogen users), and I
> haven't been able to repro it - it *looks* like an external link is being
> opened in private browsing that has an intent that leaves Fennec (like
> flipkart.com) which pops up a "leaving private browsing" dialog, but as far
> as I can tell we removed the "open external links in PB" pref and there are
> no other ways to open an external link in PB. There have been a bunch of
> recent changes to the code calling

Yeah, this should be a link that leaves Fennec to open a different app. But this should be unrelated to "open external links in PB"?

Mike has a test site for those links:
https://people.mozilla.org/~mcomella/test/uri.html

Unfortunately I can't reproduce the issue on Android 6.0 with that.


> Alternatively, and this is a stretch, the 23 only makes me wonder if this is
> somehow related to our M-specific code, and it looks like when we launch
> permissions/settings from a Tab Queue action we do call
> startActivityForResult with a resultCode [4] but that doesn't come from
> Private Browsing, so the ExternalIntentDuringPrivateBrowsing wouldn't get
> kicked off.

Yeah, all crashes are on 23 and on various devices. Also some Nexus devices (but no 5X or 6P yet). Maybe there's a change in the platform that makes this crash more likely. It could be our 23-only code too, but I don't see anything in this stack trace.

It's also worth noting that the crashes I looked at go through ExternalIntentDuringPrivateBrowsingPromptFragment but always directly start an activity. This means the user is NOT in private browsing and instead we either open the third-party app directly or show a chooser - we are not showing the dialog fragment. Showing the chooser is something I did not test yet, I'll try that next.


Also: In GeckoAppShell.getOpenURIIntentInner() we are setting the component explicitly to "null".
https://dxr.mozilla.org/mozilla-central/source/mobile/android/base/java/org/mozilla/gecko/GeckoAppShell.java#1279

Comment 6

[Sebastian Kaspari (:sebastian; :pocmo)]

(In reply to Sebastian Kaspari (:sebastian) from comment #5)
> Showing the chooser is something I did not test
> yet, I'll try that next.

No luck with that. Still not reproducible.

Comment 7

[Sebastian Kaspari (:sebastian; :pocmo)]

I read through Android's code to understand what's happening here.

You end up here, where readException is called:
http://androidxref.com/6.0.1_r10/xref/frameworks/base/core/java/android/app/ActivityManagerNative.java#2631

Then you get to here:
http://androidxref.com/6.0.1_r10/xref/frameworks/base/core/java/android/os/Parcel.java#1569

If the Parcel returned by mRemote.transact(START_ACTIVITY_TRANSACTION, data, reply, 0) contains an exception code then this exception is recreated and rethrown here:
http://androidxref.com/6.0.1_r10/xref/frameworks/base/core/java/android/os/Parcel.java#1617

From that I assume that this exception is actually coming either from something inside the Android framework or actually from the other activity we are launching.
Furthermore this means that any of those exceptions re-thrown here can occur when startActivity() is called:
http://androidxref.com/6.0.1_r10/xref/frameworks/base/core/java/android/os/Parcel.java#1617

For testing I tried to launch into a crashing activity from within Fennec and this actually killed our process too. But not with that stack trace. So I still can't verify that. There has to be a reason why this is only on API level 23 but so far I only looked into Android 6.0 code. However it could also be that nothing changed and it's the other app that is crashing for some reason on API 23. But we don't know which app that might be.

Comment 8

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.