#970
Issues/permissionlesstech/bitchat-android/#970

[Crash] NPE when opening Verify → Scan QR (v2.0.1, GrapheneOS / Android 17)

Opencervezaguaopened 22d ago

Summary

Opening the QR Scan tab in the Verify sheet crashes the app with a NullPointerException during Compose recomposition. Reproduced 5 times so far with an identical stack trace, including with camera permission already granted, so it is not the permission prompt.

Environment

  • App: com.bitchat.droid 2.0.1 (versionCode 38), release APK installed via Obtainium
  • Device: Pixel 9 Pro (caiman)
  • OS: GrapheneOS, beta channel, build 2026100601 (google/caiman/caiman:17/CP3A.261005.005/2026100601:user/release-keys), targetSdk 37

Steps

  1. Open bitchat.
  2. Tap the users icon at the top right.
  3. Tap the QR icon.
  4. Tap Scan.
  5. App crashes.

Stack trace (R8-obfuscated, release build)

java.lang.NullPointerException: Attempt to read from field 'jx5 ms5.a' on a null object reference in method 'void es3.<init>(m04)'
	at es3.<init>(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:25)
	at x26.e(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:376)
	at x26.d(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:268)
	at yj0.a(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:119)
	at vq0.c(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:42)
	at vq0.a(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:9)
	at ez0.invoke(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:335)
	at vq0.b(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:42)
	at vq0.invoke(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:9)
	at ct2.a(dex-id-54f21143ae6dc03b2ebf8ff99615623f61d15ac5:515)
	at ct2.b(dex-id-54f21143ae6dc03b2ebf8ff99615623f61d15ac5:151)
	at p25.a(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:276)
	at vq0.c(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:42)
	at o.invoke(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:380)
	at hs1.L(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:584)
	at hs1.T(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:152)
	at hs1.n(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:124)
	at ts0.w(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:109)
	at xt3.I(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:105)
	at b1.invoke(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:640)
	at ej.doFrame(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:7)
	at cj.doFrame(r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02:48)
	at android.view.Choreographer$CallbackRecord.run(Choreographer.java:1655)
	at android.view.Choreographer$CallbackRecord.run(Choreographer.java:1666)
	at android.view.Choreographer.doCallbacks(Choreographer.java:1252)
	at android.view.Choreographer.doFrame(Choreographer.java:1205)
	at android.view.Choreographer$FrameDisplayEventReceiver.run(Choreographer.java:1640)
	at android.os.Handler.handleCallback(Handler.java:1095)
	at android.os.Handler.dispatchMessageImpl(Handler.java:135)
	at android.os.Handler.dispatchMessage(Handler.java:125)
	at android.os.Looper.loopOnce(Looper.java:296)
	at android.os.Looper.loop(Looper.java:397)
	at android.app.ActivityThread.main(ActivityThread.java:9569)
	at java.lang.reflect.Method.invoke(Native Method)
	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:575)
	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:975)
	Suppressed: g61: [fj@589e64d, l13@c70b502, wd4{Cancelling}@4afde13, dj@a3d8850]

Notes

  • The exception is raised on the main thread inside a Choreographer frame callback (Compose recomposition), in the constructor es3.<init>(m04).
  • I can't deobfuscate it; the mapping file for r8-map-id-50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02 should resolve it. The Scan tab uses CameraXViewfinder in VerificationSheet.kt, which may be a place to start, but that is a guess.
  • Not tested on a build from main.

Activity

1
Edu-Designer20d ago

Same crash, on a different setup: Vivo V20, Funtouch OS 13 (Android 13). So it’s not specific to Android 17 or GrapheneOS. “My QR” opens fine, but opening Scan (to scan another person’s QR) crashes the app every time. Bitchat 2.0.1, bitchat-android-universal.apk Camera permission: granted Logcat crash buffer attached. Same NPE in es3.(m04), process com.bitchat.droid, R8 map id 50eb26bc6fce5561f293fdfb83b00faa5b321dac14db567f439ff189a13f5f02 bitchat-crash.txt