Objectbox-java: [Crash] AndroidObjectBrowserReceiver called in release build resulting crash

[rafakob]

Issue Basics

• ObjectBox version (are using the latest version?): 1.4.0
• Reproducibility: occurred once only

Reproducing the bug

Description

I have just released the app to the store, so far 2 crashes on Motorola Defy Mini, Android 5.0.2

Code

This is my Gradle:

implementation "io.objectbox:objectbox-android:$OBJECTBOX"
implementation "io.objectbox:objectbox-kotlin:$OBJECTBOX"
kapt "io.objectbox:objectbox-processor:$OBJECTBOX"

Those are dependencies:

+--- io.objectbox:objectbox-android:1.4.0
|    \--- io.objectbox:objectbox-java:1.4.0
|         +--- io.objectbox:objectbox-java-api:1.4.0
|         +--- org.greenrobot:essentials:3.0.0-RC1
|         +--- com.google.flatbuffers:flatbuffers-java:1.7.2
|         \--- com.google.code.findbugs:jsr305:3.0.2
+--- io.objectbox:objectbox-kotlin:1.4.0
|    +--- org.jetbrains.kotlin:kotlin-stdlib:1.2.0 -> 1.2.20 (*)
|    \--- io.objectbox:objectbox-java:1.4.0 (*)

Logs & stackstraces

Crash: java.lang.RuntimeException
Unable to start receiver io.objectbox.android.AndroidObjectBrowserReceiver: java.lang.NullPointerException: uriString

android.app.ActivityThread.handleReceiver (ActivityThread.java:2586)
android.app.ActivityThread.access$1700 (ActivityThread.java:144)
android.app.ActivityThread$H.handleMessage (ActivityThread.java:1355)
android.os.Handler.dispatchMessage (Handler.java:102)
android.os.Looper.loop (Looper.java:135)
android.app.ActivityThread.main (ActivityThread.java:5221)
java.lang.reflect.Method.invoke (Method.java)
java.lang.reflect.Method.invoke (Method.java:372)
com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run (ZygoteInit.java:899)
com.android.internal.os.ZygoteInit.main (ZygoteInit.java:694)

android.net.Uri$StringUri.<init> (Uri.java:470)
android.net.Uri$StringUri.<init> (Uri.java:460)
android.net.Uri.parse (Uri.java:432)

io.objectbox.android.AndroidObjectBrowser.viewIntent (AndroidObjectBrowser.java:124)
io.objectbox.android.AndroidObjectBrowserReceiver.onReceive (AndroidObjectBrowserReceiver.java:45)
android.app.ActivityThread.handleReceiver (ActivityThread.java:2579)
android.app.ActivityThread.access$1700 (ActivityThread.java:144)
android.app.ActivityThread$H.handleMessage (ActivityThread.java:1355)
android.os.Handler.dispatchMessage (Handler.java:102)
android.os.Looper.loop (Looper.java:135)
android.app.ActivityThread.main (ActivityThread.java:5221)
java.lang.reflect.Method.invoke (Method.java)
java.lang.reflect.Method.invoke (Method.java:372)
com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run (ZygoteInit.java:899)
com.android.internal.os.ZygoteInit.main (ZygoteInit.java:694)

Misc

Why this receiver is included in the release app even I do not have Browser in dependencies? It shouldn't be even included in merged manifest! This is critical.

[greenrobot]

I'd guess this only happens in the rare case when the user also has another app with active object browser that is sending those broadcasts. Nevertheless, we'll fix it of course.

[greenrobot-team]

The receiver is set to exported="false", you can check the merged manifest of your APK to make sure. Meaning no other app can send broadcasts to it. When building the pending intent in AndroidObjectBrowser#start it is also ensured that the URL is not null. The receiver also checks that the intent action matches before doing anything.

Looking at this stack trace, an intent was sent from your app or one with the same user ID with the correct intent action but no extras. I wonder how this is possible or what we can possibly do against that?
-ut

[greenrobot-team]

Update: added check for intent extras to prevent the crash. Still might think of not including the receiver and service in the non-object-browser artifact. -ut

[greenrobot]

1.4.1 released