1781780 - Adding private activities to the list of custom actions in the floating menu can crash Fenix. Crash in [@ android.util.AndroidRuntimeException: at android.app.ContextImpl.startActivity(ContextImpl.java) ]

Status: VERIFIED FIXED

(GeckoView :: General, defect, P2)

Description

[Petru-Mugurel Lingurar [:petru]]

Issue reported on Fenix - https://github.com/mozilla-mobile/fenix/issues/23009

Easy to reproduce if having the Microsoft launcher app installed.

Seems like it has a com.microsoft.bing.ProcessTextSearch activity set as

<intent-filter>
    <action android:name="android.intent.action.PROCESS_TEXT"/>
    <category android:name="android.intent.category.DEFAULT"/>
    <data android:mimeType="text/plain"/>
</intent-filter>

which matches the details we require for adding a custom action for processing text, in this case named "Search".

But it is also marked as exported=false and we can use this to exclude it from the list of custom actions with such a check maybe around here.

Comment 1

[Chris Peterson [:cpeterson]]

A reproducible crash is bad. Let's add this to our Q3 bug list.

Comment 2

[Chris Peterson [:cpeterson]]

Crash signature from https://github.com/mozilla-mobile/fenix/issues/23009#issuecomment-1002698180

android.util.AndroidRuntimeException: Calling startActivity() from outside of an Activity  context requires the FLAG_ACTIVITY_NEW_TASK flag. Is this really what you want?
	at android.app.ContextImpl.startActivity(ContextImpl.java:931)
	at android.app.ContextImpl.startActivity(ContextImpl.java:907)
	at android.content.ContextWrapper.startActivity(ContextWrapper.java:379)
	at android.content.ContextWrapper.startActivity(ContextWrapper.java:379)
	at com.android.internal.view.menu.MenuItemImpl.invoke(MenuItemImpl.java:159)
	at com.android.internal.view.menu.MenuBuilder.performItemAction(MenuBuilder.java:923)
	at com.android.internal.view.menu.MenuBuilder.performItemAction(MenuBuilder.java:913)
	at com.android.internal.view.FloatingActionMode.lambda$setFloatingToolbar$0(FloatingActionMode.java:129)
	at com.android.internal.view.-$$Lambda$FloatingActionMode$LU5MpPuKYDtwlFAuYhXYfzgLNLE.onMenuItemClick(Unknown Source:2)
	at com.android.internal.widget.FloatingToolbar$FloatingToolbarPopup$2.onClick(FloatingToolbar.java:509)
	at android.view.View.performClick(View.java:6643)
	at android.view.View.performClickInternal(View.java:6620)
	at android.view.View.access$3100(View.java:790)
	at android.view.View$PerformClick.run(View.java:26217)
	at android.os.Handler.handleCallback(Handler.java:873)
	at android.os.Handler.dispatchMessage(Handler.java:99)
	at android.os.Looper.loop(Looper.java:224)
	at android.app.ActivityThread.main(ActivityThread.java:7134)
	at java.lang.reflect.Method.invoke(Native Method)
	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:604)
	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:876)

Comment 3

[Zac McKenney [:zmckenney]]

This still occurs in latest nightly build, any non exported activities will crash the app. I created test apps with this intent filter to test GV and walk through the code. A couple things to note:

If the action is ACTION_PROCESS_TEXT the check for action availability is skipped - HERE

When the ACTION_PROCESS_TEXT menu items are added menu.addIntentOptions is called which uses .queryIntentActivityOptions so they will all be added to the menu regardless. I think the best solution is probably to get the package and class from the query and create menu items similar to all other menu items (with an intent set on the menu item).

Happy to take this on if we want to fix it.

Comment 4

[Chris Peterson [:cpeterson]]

Zac said he'll work on this bug soon.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 AArch64 and ARM crashes on beta

For more information, please visit auto_nag documentation.

Comment 6

[Zac McKenney [:zmckenney]]

Attachment: Bug 1781780: Only add exported activities to handle intent ACTION_PROCESS_TEXT in floating toolbar menu. r=#geckoview-reviewers

Comment 7

[Zac McKenney [:zmckenney]]

Attachment: Bug 1781780: Only add exported activities to handle intent ACTION_PROCESS_TEXT in floating toolbar menu. r=#geckoview-reviewers

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6f8398bf4692
Only add exported activities to handle intent ACTION_PROCESS_TEXT in floating toolbar menu. r=geckoview-reviewers,owlish

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Bug are resolved by the code sheriffs when they're merged to mozilla-central from autoland. Please don't manually close them.

Comment 10

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/6f8398bf4692

Comment 11

[Zac McKenney [:zmckenney]]

Comment on attachment 9311140 [details]
Bug 1781780: Only add exported activities to handle intent ACTION_PROCESS_TEXT in floating toolbar menu. r=#geckoview-reviewers

Beta/Release Uplift Approval Request

• User impact if declined: Users will crash at a 100% reproducible rate when they have an app installed without an exported activity that accepts intent actions for processing text. This occurs for apps such as Microsoft Launcher.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is not a large change and it still utilizes the same Android system level query for exported activities. Also, aside from fixing the crash that occurs a user will not see any changes.
• String changes made/needed:
• Is Android affected?: Yes

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9311140 [details]
Bug 1781780: Only add exported activities to handle intent ACTION_PROCESS_TEXT in floating toolbar menu. r=#geckoview-reviewers

No crashes on Nightly since this landed. Approved for 109.0rc2, thanks!

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/4995b6450769

Comment 14

[Lorand Janos]

Managed to reproduce the crash and the double "Search" buttons with an older version of Nightly (107.0a1).

Verified as fixed on:

• The latest Nightly 110.0a1 (2023-01-13).
• The latest RC 109.1.1.

Device used: Oppo Find X5 (Android 12).

Marking the issue as fixed on 109 and 110.

Comment 15

[Lorand Janos]

Re-verified on the latest Beta 110.0b1.
Device used: Oppo Find X5 (Android 12).