Backing up keys makes Element crash

[witchent]

Describe the bug
If I restore my backup (doesn't matter if via QR code or recovery key) the app just keeps crashing all the time. After starting it up again it crashes to fast to send a rageshake, but logcat gives me the following:

10-15 23:01:27.440  4404  4404 V DefaultKeysBackupService: backupKeys: 1 - 64 sessions to back up
10-15 23:01:27.440  4404  4404 V KeysBackupStateManager: KeysBackup: setState: WillBackUp -> BackingUp
10-15 23:01:27.444  4404  4440 V DefaultKeysBackupService$backupKeys: backupKeys: 2 - Encrypting keys
10-15 23:01:27.536  4404  4404 V VectorUncaughtExceptionHandler: Uncaught exception: java.lang.NullPointerException
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler: FATAL EXCEPTION Element Build : 206415360
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler: Element Version : 1.0.9-dev [206415360] (G-b455)
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler: SDK Version : 0.0.1 (7158f49f)
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler: Phone : ONEPLUS A6000 (23 10 REL)
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler: Memory statuses 
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler: usedSize   15 MB
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler: freeSize   3 MB
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler: totalSize   18 MB
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler: Thread: main, Exception: java.lang.NullPointerException
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler:        at org.matrix.android.sdk.internal.crypto.keysbackup.DefaultKeysBackupService.encryptGroupSession(DefaultKeysBackupService.kt:1329)
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler:        at org.matrix.android.sdk.internal.crypto.keysbackup.DefaultKeysBackupService$backupKeys$1$1.invokeSuspend(DefaultKeysBackupService.kt:1230)
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler:        at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler:        at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:56)
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler:        at android.os.Handler.handleCallback(Handler.java:883)
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler:        at android.os.Handler.dispatchMessage(Handler.java:100)
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler:        at android.os.Looper.loop(Looper.java:214)
10-15 23:01:27.539  4404  4404 E VectorUncaughtExceptionHandler:        at android.os.HandlerThread.run(HandlerThread.java:67)
10-15 23:01:27.541  4404  4404 E AndroidRuntime: FATAL EXCEPTION: main
10-15 23:01:27.541  4404  4404 E AndroidRuntime: Process: im.vector.app.debug, PID: 4404
10-15 23:01:27.541  4404  4404 E AndroidRuntime: java.lang.NullPointerException
10-15 23:01:27.541  4404  4404 E AndroidRuntime:        at org.matrix.android.sdk.internal.crypto.keysbackup.DefaultKeysBackupService.encryptGroupSession(DefaultKeysBackupService.kt:1329)
10-15 23:01:27.541  4404  4404 E AndroidRuntime:        at org.matrix.android.sdk.internal.crypto.keysbackup.DefaultKeysBackupService$backupKeys$1$1.invokeSuspend(DefaultKeysBackupService.kt:1230)
10-15 23:01:27.541  4404  4404 E AndroidRuntime:        at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
10-15 23:01:27.541  4404  4404 E AndroidRuntime:        at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:56)
10-15 23:01:27.541  4404  4404 E AndroidRuntime:        at android.os.Handler.handleCallback(Handler.java:883)
10-15 23:01:27.541  4404  4404 E AndroidRuntime:        at android.os.Handler.dispatchMessage(Handler.java:100)
10-15 23:01:27.541  4404  4404 E AndroidRuntime:        at android.os.Looper.loop(Looper.java:214)
10-15 23:01:27.541  4404  4404 E AndroidRuntime:        at android.os.HandlerThread.run(HandlerThread.java:67)
10-15 23:01:27.543   984  4611 I DropBoxManagerService: add tag=data_app_crash isTagEnabled=true flags=0x2
10-15 23:01:27.543   984 12013 W ActivityTaskManager:   Force finishing activity im.vector.app.debug/im.vector.app.features.home.HomeActivity
10-15 23:01:27.561   984 12013 D ActivityTrigger: ActivityTrigger activityPauseTrigger 
10-15 23:01:27.572   984  1093 I ActivityManager: Showing crash dialog for package im.vector.app.debug u0

To Reproduce
Steps to reproduce the behavior:

1. Log into Element Android
2. Restore key backup via either QR code or recovery phrase
3. Wait for it to crash

Expected behavior
No crash

Smartphone (please complete the following information):

• Device: Oneplus 6
• OS: Android 10

Additional context

• App version and store 1.0.9-dev [206415360] GPlay
• Homeserver: Synapse 1.21.1

It might also have something to do with element-hq/element-web#15388

[witchent]

Deleting key backup from Element-Desktop stopped the crash, so I was able to send a rageshake this way. Let me know if there's anything else I can do to help figure this out.
Setting up key backup from Element-Android made the exact same crash happen again though.

[PhieF]

I'm having the same error with galaxy s9+

[v411e]

I am having the exactly same issue

10-25 08:01:07.259 31889 31889 E AndroidRuntime: FATAL EXCEPTION: main
10-25 08:01:07.259 31889 31889 E AndroidRuntime: Process: im.vector.app, PID: 31889
10-25 08:01:07.259 31889 31889 E AndroidRuntime: java.lang.NullPointerException
10-25 08:01:07.259 31889 31889 E AndroidRuntime: 	at org.matrix.android.sdk.internal.crypto.keysbackup.DefaultKeysBackupService$backupKeys$1$1.invokeSuspend(DefaultKeysBackupService.kt:11)
10-25 08:01:07.259 31889 31889 E AndroidRuntime: 	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:3)
10-25 08:01:07.259 31889 31889 E AndroidRuntime: 	at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:15)
10-25 08:01:07.259 31889 31889 E AndroidRuntime: 	at android.os.Handler.handleCallback(Handler.java:873)
10-25 08:01:07.259 31889 31889 E AndroidRuntime: 	at android.os.Handler.dispatchMessage(Handler.java:99)
10-25 08:01:07.259 31889 31889 E AndroidRuntime: 	at android.os.Looper.loop(Looper.java:193)
10-25 08:01:07.259 31889 31889 E AndroidRuntime: 	at android.os.HandlerThread.run(HandlerThread.java:65)
10-25 08:01:14.557 32041 32041 E AndroidRuntime: FATAL EXCEPTION: main
10-25 08:01:14.557 32041 32041 E AndroidRuntime: Process: im.vector.app, PID: 32041
10-25 08:01:14.557 32041 32041 E AndroidRuntime: java.lang.NullPointerException
10-25 08:01:14.557 32041 32041 E AndroidRuntime: 	at org.matrix.android.sdk.internal.crypto.keysbackup.DefaultKeysBackupService$backupKeys$1$1.invokeSuspend(DefaultKeysBackupService.kt:11)
10-25 08:01:14.557 32041 32041 E AndroidRuntime: 	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:3)
10-25 08:01:14.557 32041 32041 E AndroidRuntime: 	at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:15)
10-25 08:01:14.557 32041 32041 E AndroidRuntime: 	at android.os.Handler.handleCallback(Handler.java:873)
10-25 08:01:14.557 32041 32041 E AndroidRuntime: 	at android.os.Handler.dispatchMessage(Handler.java:99)
10-25 08:01:14.557 32041 32041 E AndroidRuntime: 	at android.os.Looper.loop(Looper.java:193)
10-25 08:01:14.557 32041 32041 E AndroidRuntime: 	at android.os.HandlerThread.run(HandlerThread.java:65)
10-25 08:01:14.561 32041 32051 I im.vector.app: Background concurrent copying GC freed 64433(3MB) AllocSpace objects, 8(544KB) LOS objects, 50% free, 8MB/17MB, paused 108us total 134.468ms

Device

• Oneplus A3003 (Android 9.0.4)

App version

• GPlay 1.0.9

[v411e]

Somehow the sessionData.algorithm was null in line 1328 in DefaultKeysBackupService.kt. This caused the app to crash. I changed the code to

        val sessionBackupData = mapOf(
                "algorithm" to sessionData?.algorithm,
                "sender_key" to sessionData?.senderKey,
                "sender_claimed_keys" to sessionData?.senderClaimedKeys,
                "forwarding_curve25519_key_chain" to (sessionData?.forwardingCurve25519KeyChain
                        ?: ArrayList<Any>()),
                "session_key" to sessionData?.sessionKey)

The removal of the null-safety "!!" makes the app not crash anymore, but it is obviously no solution for the problem that this was null one time. So how is it possible that sessionData.algorithm could become null?

[witchent]

The pull request says that it fixes the crash but not the root cause. What is the root cause and is this something we can get rid of ourselves?