NPE inside CustomTabIntentBuilder

[hrafnthor]

Hi,

I've had a fatal exception reported during usage of CustomTabIntentBuilder:

Fatal Exception: java.lang.NullPointerException: Attempt to invoke virtual method 'boolean o.ᴸ.ˊ(android.net.Uri, android.os.Bundle, java.util.List)' on a null object reference
       at net.openid.appauth.browser.CustomTabManager.createSession(CustomTabManager.java:151)
       at net.openid.appauth.browser.CustomTabManager.createTabBuilder(CustomTabManager.java:114)
       at net.openid.appauth.AuthorizationService.createCustomTabsIntentBuilder(AuthorizationService.java:127)
       at <my-package>.auth.AuthRepository$1.createAuthenticationIntent(AuthRepository.java:100)

According to the stacktrace, the session created in the AppAuth's CustomTabManager.createSession() is null, when being accessed inside the later if statement:

  /**
     * Creates a {@link android.support.customtabs.CustomTabsSession custom tab session} for
     * use with a custom tab intent, with optional callbacks and optional list of URIs that may
     * be requested. The URI list should be ordered such that the most likely URI to be requested
     * is first. If no custom tab supporting browser is available, this will return {@code null}.
     */
    @WorkerThread
    @Nullable
    public CustomTabsSession createSession(
            @Nullable CustomTabsCallback callbacks,
            @Nullable Uri... possibleUris) {
        CustomTabsClient client = getClient();
        if (client == null) {
            return null;
        }

        CustomTabsSession session = client.newSession(callbacks);

        if (possibleUris != null && possibleUris.length > 0) {
            List<Bundle> additionalUris = UriUtil.toCustomTabUriBundle(possibleUris, 1);
            session.mayLaunchUrl(possibleUris[0], null, additionalUris);
        }

        return session;
    }

Here a null pointer check might be required before accessing the session object?

Or is this normal behaviour during some edge case I have simply overlooked?

Thanks!

[iainmcgin]

The documentation for CustomTabsClient.newSession is annoyingly vague about why it returns null, but it does say "null on error" so you're correct that we should be handling this appropriately. Marked as bug.

[hrafnthor]

Any idea what might be causing the session to not get created, with a valid client?

Since it's been a few days since our first report of the issue I'll add that out of a few thousand active users, we have only have 5 reported incidents. So this seems to be a very rare occurance.

Also only seems to have occurred for users running Samsung devices with OS versions 6 and 7. Possibly related then to the Samsung Internet Browser.

[iainmcgin]

Samsung's browser is a fork of Chromium and tends to lag behind on its implementation of custom tabs, so there very well could be a bug specific to Samsung's browser, or a bug that was in Chromium that they have just not yet carried over a patch for. Old Samsung phones don't necessarily get new versions of the browser either, which means that sometimes we're stuck with bugs that we have to work around.