1507513 - Crash in java.lang.NullPointerException: at android.view.View.populateVirtualStructure(View.java)

Status: VERIFIED FIXED

(Firefox for Android Graveyard :: General, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-9704d155-e55a-43f6-a2d3-e21ab0181115.
=============================================================

Seen while looking at nightly crashes, started in 20181115100056: https://bit.ly/2B76839. 14 crashes/5 installs so far.

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=073045259e75e0c8f7b8ffcd5e4bf72570f98f3e&tochange=dca9c72df68bb59692118595dea65b78cde5b371

Java stack trace:

java.lang.NullPointerException
	at android.view.View.populateVirtualStructure(View.java:8578)
	at android.view.View.onProvideVirtualStructureCompat(View.java:8077)
	at android.view.View.onProvideVirtualStructure(View.java:8058)
	at android.view.View.dispatchProvideStructureForAssistOrAutofill(View.java:8724)
	at android.view.View.dispatchProvideStructure(View.java:8671)
	at android.view.ViewGroup.dispatchProvideStructure(ViewGroup.java:3477)
	at android.view.ViewGroup.dispatchProvideStructure(ViewGroup.java:3550)
	at android.view.ViewGroup.dispatchProvideStructure(ViewGroup.java:3550)
	at android.view.ViewGroup.dispatchProvideStructure(ViewGroup.java:3550)
	at android.view.ViewGroup.dispatchProvideStructure(ViewGroup.java:3550)
	at android.view.ViewGroup.dispatchProvideStructure(ViewGroup.java:3550)
	at android.view.ViewGroup.dispatchProvideStructure(ViewGroup.java:3550)
	at android.view.ViewGroup.dispatchProvideStructure(ViewGroup.java:3550)
	at android.view.ViewGroup.dispatchProvideStructure(ViewGroup.java:3550)
	at android.app.assist.AssistStructure$WindowNode.<init>(AssistStructure.java:519)
	at android.app.assist.AssistStructure.<init>(AssistStructure.java:2047)
	at android.app.ActivityThread.handleRequestAssistContextExtras(ActivityThread.java:3301)
	at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1862)
	at android.os.Handler.dispatchMessage(Handler.java:106)
	at android.os.Looper.loop(Looper.java:193)
	at android.app.ActivityThread.main(ActivityThread.java:6863)
	at java.lang.reflect.Method.invoke(Native Method)
	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:537)
	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:858)

Comment 1

[Marcia Knous [:marcia]]

Here are some URLs:
*https://lifehacker.com/a-beginner-s-guide-to-mastodon-1828503235 
*https://smartasset.com/taxes/ohio-tax-calculator 
*https://www.russellvillearkansas.org/307/City-Council 
*https://www.humblebundle.com/store/search?sort=bestselling&search=R6 
*https://www.arpansa.gov.au/our-services/monitoring/ultraviolet-radiation-monitoring/ultraviolet-radiation-index

Comment 2

[Marcia Knous [:marcia]]

Pixels and Pixel 2's are in the device mix. I haven't been able to reproduce so far on Nightly. Perhaps someone in QA can have better luck.

Comment 3

[Liz Henry (:lizzard) (relman/hg->git project)]

snorp, does anything stand out for you here in the regression window as a possible cause? This is an abrupt crash spike from yesterday and it looks like a bunch of geckoview changes landed in that window. It is often but not always a startup crash.

Comment 4

[Adam Gashlin (he/him) [:agashlin] (ex-moco)]

I'm hitting this signature consistently on a Pixel (sailfish) when I hit Alt+Tab on a Bluetooth keyboard to switch apps:

https://crash-stats.mozilla.com/report/index/23cb80cf-7a56-4870-8713-0cb830181117
https://crash-stats.mozilla.com/report/index/e8c12fa9-430d-4049-8a5a-be9aa0181117
https://crash-stats.mozilla.com/report/index/c46db0dd-7818-4043-a722-7e79f0181117
https://crash-stats.mozilla.com/report/index/0dca0c2d-e957-4caa-be42-58d170181117
https://crash-stats.mozilla.com/report/index/fd80cee4-1042-41e4-9398-a8c330181117
https://crash-stats.mozilla.com/report/index/2486b008-51ec-4648-8728-3f5a20181117
https://crash-stats.mozilla.com/report/index/11de557b-37cb-405d-a050-4e7f70181117

Doesn't seem to happen on normal touchscreen app switching. Still happens with extensions disabled:

https://crash-stats.mozilla.com/report/index/d1de3b10-4a83-4477-96e9-6ce230181117

but I haven't tried with a clean profile.

Comment 5

[Jan Alexander Steffens [:heftig]]

I can reproduce this on a Pixel 3 XL by locking the device with Firefox up, waking the device by bringing up the assistant (e.g. by squeezing the active edges) and then unlocking to return to Firefox, which will have crashed.

It's independent of why URLs loaded.

Comment 6

[Jan Alexander Steffens [:heftig]]

Actually, just activating the assistant in any way (voice. holding the home button, active edges) while Firefox is up immediately crashes it.

Comment 7

[Maganth Seetharaman]

OnePlus 6T is having issues crashing...

https://crash-stats.mozilla.com/report/index/9e957a15-fa1a-4099-a08b-a839f0181118#allthreads

I am able to produce it when I use the app switcher using gestures, when I close and reopen the browser in short intervals.

Comment 8

[Marcia Knous [:marcia]]

This is averaging over 400 crashes/150 installations per nightly. It seems from some of the recent comments it is fairly easy to reproduce.

Comment 9

[Marcia Knous [:marcia]]

Attachment: logcat.rtf

I was able to reproduce it on my Pixel 3, attaching logcat in case it helps.

Comment 10

[Marcia Knous [:marcia]]

ni on :eitan as it seems 2 accessibility changes landed in the regression range, and there seems to be accessibility stuff coming up in the logcat.

Comment 11

[James Willcox (:snorp) ([e-mail]) (he/him)]

Yeah, this looks autofill/a11y related.

Comment 12

[Eitan Isaacson [:eeejay]]

This is interesting. Looks like Google Assistant has a newish setting where it retrieves info about the running app. It does this with the autofill API, and falls back to the a11y API. When it falls back, it expects an accessible node info, even though a11y is not enabled on the device. Looks like we should never return null.

We do support the autofill API as well, so it is worth looking into why it is not querying that instead and falling back to a11y.

Comment 13

[Eitan Isaacson [:eeejay]]

I think this crash will get resolved with the patch in bug 1507913.

Comment 15

[Eitan Isaacson [:eeejay]]

This should be fixed in nightly now. Works here, can someone else verify? Maybe Marcia?

Comment 16

[Marcia Knous [:marcia]]

Last crashes in this signature were in 20181119100115. I also cannot reproduce on my device using the latest nightly.

Comment 17

[Jan Alexander Steffens [:heftig]]

Can't reproduce anymore, either. Seems good now.

Comment 18

[Julien Cristau [:jcristau]]

Great, thanks.