amillez
diff --git a/‎android/src/main/java/com/margelo/nitro/cover/HybridCover.kt‎
Lines changed: 232 additions & 27 deletions b/‎android/src/main/java/com/margelo/nitro/cover/HybridCover.kt‎
Lines changed: 232 additions & 27 deletions
@@ -47,6 +47,58 @@ private data class ImageConfig(
   var bitmap: Bitmap? = null,
 )
 
+/// Cover-content container used as the root of every cover view tree.
+/// Carries a `frozen` flag that, while set, no-ops `requestLayout` and
+/// `invalidate` calls — breaking the layout-request chain before it
+/// reaches the surrounding `ViewRootImpl` and triggers a Choreographer
+/// `scheduleTraversals`.
+///
+/// Why this exists (regression guard for "Invalid window token" crashes
+/// reported from the SCVH teardown race — see `detachCoverView`):
+///
+/// `safeReleaseScvh` already cancels in-flight TraversalRunnables on
+/// the SCVH's internal `ViewRootImpl` via reflection. But that helper
+/// can be defeated two ways:
+///
+///   1. Reflection blocked on this device → `scvhReflectionDisabled`
+///      latches true and no cancel ever lands. (We now also latch
+///      `scvhDisabled` in that case to avoid the SCVH path entirely,
+///      but the legacy non-SCVH path is the cure for *future*
+///      attaches — it doesn't undo damage already in flight.)
+///   2. Even when reflection succeeds, the gap between our cancel and
+///      the WWM token removal inside `host.release() → die() → doDie()`
+///      (which posts MSG_DIE to run later) is wide enough for fresh
+///      `requestLayout` calls — fired by `dispatchDetachedFromWindow`
+///      propagating from the activity-side `removeView`, by animation
+///      cleanup, or by focus changes — to schedule a brand-new
+///      Choreographer callback. If MSG_DIE then runs first, the queued
+///      callback fires on a dead window, calls `WWM.relayout`, and
+///      throws `IllegalArgumentException: Invalid window token`.
+///
+/// Overriding `requestLayout()` to be a no-op while frozen breaks the
+/// chain: child views can still call `requestLayout`, but the call stops
+/// at this container and never reaches `ViewRootImpl.scheduleTraversals`.
+/// Frozen views also skip `invalidate()` for parity; `invalidate` alone
+/// doesn't schedule a traversal, but suppressing it during teardown
+/// avoids spurious redraw work on a surface we're about to release.
+///
+/// The freeze is one-way per view instance: once a cover content view
+/// is being torn down, it's discarded. `attachCover` always builds a
+/// fresh container, so a future show() starts from `frozen = false`.
+private class FreezableFrameLayout(context: Context) : FrameLayout(context) {
+  @Volatile var frozen: Boolean = false
+
+  override fun requestLayout() {
+    if (frozen) return
+    super.requestLayout()
+  }
+
+  override fun invalidate() {
+    if (frozen) return
+    super.invalidate()
+  }
+}
+
 /// Default blur intensity when the JS caller passes `undefined` to
 /// `setBlur(style)`. Mirrors the iOS default.
 private const val DEFAULT_BLUR_INTENSITY: Float = 0.4f
@@ -185,6 +237,18 @@ class HybridCover : HybridCoverSpec() {
   /// toggle can cancel a still-running fade before starting its own.
   private var scvhAnimator: android.animation.ValueAnimator? = null
 
+  /// Re-entrance guard for `detachCoverView`. Teardown calls
+  /// `WindowManager.removeViewImmediate` and `safeReleaseScvh`, both of
+  /// which can dispatch detach callbacks / animation cancellations on
+  /// the main thread synchronously. If any of those handlers calls back
+  /// into a path that triggers another `detachCoverView` (e.g. a
+  /// listener firing `disable()`), the second call would double-remove
+  /// the same view (logged-but-harmless IAE) and double-release the
+  /// same SCVH host (may double-`die()` the internal ViewRootImpl,
+  /// which is precisely the kind of post-removal-relayout we're trying
+  /// to prevent). Flag is checked at entry and cleared in `finally`.
+  private var coverDetaching: Boolean = false
+
   /// API 30+ fast-path. The cover content (FrameLayout with color /
   /// image / blur) is hosted inside a `SurfaceControlViewHost`, which
   /// renders it into a `SurfaceControl` WE own. The cover Window's
@@ -969,12 +1033,22 @@ class HybridCover : HybridCoverSpec() {
         }
       }
       if (!found) {
-        Log.w(TAG, "unscheduleScvhTraversals: no ViewRootImpl field found on SurfaceControlViewHost; disabling reflection")
+        Log.w(TAG, "unscheduleScvhTraversals: no ViewRootImpl field found on SurfaceControlViewHost; disabling reflection AND SCVH")
         scvhReflectionDisabled = true
+        // Without a working unschedule, every SCVH teardown on this
+        // device is exposed to the WWM-relayout-after-token-removed
+        // crash. The legacy non-SCVH attach path uses a regular
+        // activity-WM window (no WindowlessWindowManager involved),
+        // so falling back to it on every subsequent attach eliminates
+        // the race entirely — at the cost of the SF-direct alpha
+        // toggle the snapshot race fix relies on. We accept that
+        // trade-off rather than risk recurring process crashes.
+        scvhDisabled = true
       }
     } catch (e: Throwable) {
-      Log.w(TAG, "unscheduleScvhTraversals: reflection failed (${e.javaClass.simpleName}): ${e.message}")
+      Log.w(TAG, "unscheduleScvhTraversals: reflection failed (${e.javaClass.simpleName}): ${e.message}; disabling reflection AND SCVH")
       scvhReflectionDisabled = true
+      scvhDisabled = true
     }
   }
 
@@ -1143,10 +1217,20 @@ class HybridCover : HybridCoverSpec() {
                    else params.flags or invisibleFlags
     if (newFlags != params.flags) {
       params.flags = newFlags
-      try {
-        activity.windowManager.updateViewLayout(view, params)
-      } catch (e: Throwable) {
-        Log.w(TAG, "setCoverVisibility: updateViewLayout failed: $e")
+      // Skip the WindowManager update if the view has been detached
+      // out from under us mid-flip — `updateViewLayout` would route
+      // through WindowManagerGlobal to the same WMS/WWM path that
+      // throws "Invalid window token" once the token is gone. The
+      // cover state we set above (alpha) is moot at this point since
+      // detach is imminent or already done.
+      if (view.windowToken == null) {
+        Log.w(TAG, "setCoverVisibility: skipping updateViewLayout — windowToken is null")
+      } else {
+        try {
+          activity.windowManager.updateViewLayout(view, params)
+        } catch (e: Throwable) {
+          Log.w(TAG, "setCoverVisibility: updateViewLayout failed: $e")
+        }
       }
     }
 
@@ -1255,30 +1339,151 @@ class HybridCover : HybridCoverSpec() {
   /// Pure detach helper — no state-machine logic. Used by both
   /// removeCoverImmediately (full teardown) and attachCover (re-mount
   /// on a new parent token).
+  ///
+  /// Ordering matters here. The teardown sequence has to defend against
+  /// a multi-layer race that surfaces as
+  ///
+  ///   IllegalArgumentException: Invalid window token (never added or
+  ///   removed already)
+  ///     at WindowlessWindowManager.relayout
+  ///     at ViewRootImpl.relayoutWindow → performTraversals
+  ///     at Choreographer.doFrame
+  ///
+  /// on production devices (most often during rapid mount/unmount,
+  /// backgrounding, and activity recreation). The race:
+  ///
+  ///   1. `host.release()` ultimately removes our window from the
+  ///      SCVH's `WindowlessWindowManager`, but the removal happens
+  ///      inside an asynchronously-dispatched `doDie()` (via
+  ///      `ViewRootImpl.die(false)` → `MSG_DIE`), not synchronously.
+  ///   2. Between the call to `release()` and `doDie()` actually
+  ///      running, the SCVH's content tree is still attached and
+  ///      anything that calls `requestLayout()` on it schedules a
+  ///      fresh Choreographer traversal.
+  ///   3. `dispatchDetachedFromWindow` (fired by removeView on the
+  ///      enclosing SurfaceView), animation cancellations, and
+  ///      focus changes all CAN call `requestLayout` during teardown.
+  ///   4. If `doDie()` runs first and removes the WWM token, then the
+  ///      queued traversal fires, calls `WWM.relayout`, finds the
+  ///      token absent, and throws — outside any try/catch of ours
+  ///      because it's dispatched from `Looper.loop`.
+  ///
+  /// Mitigation, in order:
+  ///
+  ///   - Mark the SCVH content `FreezableFrameLayout` as `frozen` BEFORE
+  ///     touching anything else; from this point on, no `requestLayout`
+  ///     reaches the SCVH's `ViewRootImpl.scheduleTraversals`.
+  ///   - Null out the shared state fields BEFORE running teardown, so
+  ///     any synchronous re-entrant call (animation cancel listener,
+  ///     detached-from-window handler) sees a clean state and bails.
+  ///   - Cancel SCVH traversals BEFORE removeView. The detach dispatch
+  ///     itself can run framework cleanup that schedules a traversal;
+  ///     starting from an empty queue narrows the post-cancel window.
+  ///   - Use `removeViewImmediate` where possible so detach dispatch
+  ///     runs inline and any layout requests it makes are short-circuited
+  ///     by the freeze flag while we still own the SC.
+  ///   - `safeReleaseScvh` runs `unscheduleScvhTraversals` again before
+  ///     `host.release()` — defence in depth against any traversal that
+  ///     slipped past the freeze (e.g. framework internals that don't
+  ///     route through our `requestLayout` override).
+  ///
+  /// The `coverDetaching` flag protects against re-entrance from any of
+  /// the synchronous dispatch points above.
   private fun detachCoverView() {
+    if (coverDetaching) return
     val view = coverView ?: return
-    scvhAnimator?.cancel()
-    scvhAnimator = null
-    view.animate().cancel()
-    view.animate().setListener(null)
-    val activity = coverHostActivityRef?.get()
+    coverDetaching = true
     try {
-      activity?.windowManager?.removeView(view)
-    } catch (_: IllegalArgumentException) {
-      // Panel was already detached (e.g. host activity finished).
+      // Snapshot to locals BEFORE clearing shared state. A re-entrant
+      // call that arrives mid-teardown will see the cleared fields,
+      // hit the early return at the top, and won't try to double-remove
+      // or double-release the same view / host.
+      val host = scvhHost
+      val activity = coverHostActivityRef?.get()
+      val content = coverContent
+
+      // Freeze the content view first so any `requestLayout` fired
+      // during the rest of teardown (detach dispatch, animation
+      // cancellation, focus changes) is a no-op and can't schedule a
+      // new Choreographer traversal on the SCVH's WindowlessViewRoot.
+      // Only meaningful on the SCVH path; on the legacy path the
+      // content view IS the cover window root and there's no WWM
+      // relayout race to defend against, but freezing is harmless
+      // (the view is being discarded anyway).
+      (content as? FreezableFrameLayout)?.frozen = true
+
+      scvhAnimator?.cancel()
+      scvhAnimator = null
+      view.animate().cancel()
+      view.animate().setListener(null)
+
+      // Clear shared state now — re-entrant detach calls return at the
+      // top, listeners that reach into `coverView`/`scvhHost` see null.
+      coverView = null
+      coverContent = null
+      coverHostActivityRef = null
+      coverAttachedToken = null
+      coverSurfaceControl = null
+      scvhHost = null
+      scvhSurfaceControl = null
+      scvhAlphaState = 0f
+
+      // Cancel pending traversals on the SCVH's internal ViewRootImpl
+      // BEFORE removing the enclosing SurfaceView. Removing the parent
+      // dispatches detached-from-window up the cover content tree
+      // (focus loss, hover exit, accessibility events), each of which
+      // can `requestLayout` despite the freeze on some Android builds
+      // (e.g. framework-internal `forceLayout` paths that bypass our
+      // override). Starting from a clear Choreographer queue narrows
+      // the post-removal blast radius. The reflective probe latches
+      // off on permanent failure, so the second call below is cheap.
+      if (host != null) unscheduleScvhTraversals(host)
+
+      // Prefer `removeViewImmediate` so dispatchDetachedFromWindow runs
+      // inline. With the freeze in place, any layout requests it makes
+      // are short-circuited; with async `removeView`, the dispatch
+      // happens at a later vsync and the freeze must still hold then.
+      // Fall back to async `removeView` on OEM WindowManager impls
+      // where immediate removal throws (some Samsung / MIUI builds
+      // reject removeViewImmediate when the view is in a transitional
+      // state).
+      if (view.windowToken != null) {
+        val removed = try {
+          activity?.windowManager?.removeViewImmediate(view)
+          true
+        } catch (e: Throwable) {
+          Log.w(TAG, "detachCoverView: removeViewImmediate failed (${e.javaClass.simpleName}): ${e.message}; falling back to removeView")
+          false
+        }
+        if (!removed) {
+          try {
+            activity?.windowManager?.removeView(view)
+          } catch (_: IllegalArgumentException) {
+            // Panel already detached (host activity finished, etc.).
+          } catch (e: Throwable) {
+            Log.w(TAG, "detachCoverView: removeView failed: $e")
+          }
+        }
+      }
+
+      // Release the SCVH AFTER the SurfaceView is detached. The
+      // SurfacePackage was reparented into the SurfaceView; with the
+      // SurfaceView gone, releasing the host lets SurfaceFlinger
+      // reclaim the SC cleanly. `safeReleaseScvh` re-runs the
+      // unschedule helper internally — that's deliberate, it catches
+      // any traversal queued by the detach dispatch we just ran.
+      if (host != null) {
+        try {
+          safeReleaseScvh(host)
+        } catch (e: Throwable) {
+          // `safeReleaseScvh` already swallows; double-guard in case
+          // a future refactor lets something escape.
+          Log.w(TAG, "detachCoverView: safeReleaseScvh threw: $e")
+        }
+      }
+    } finally {
+      coverDetaching = false
     }
-    // Release the SCVH host AFTER removeView. SCVH's SurfacePackage
-    // was reparented into the SurfaceView, which is now detached, so
-    // it's safe to tear down the host and let SF reclaim the SC.
-    scvhHost?.let { host -> safeReleaseScvh(host) }
-    scvhHost = null
-    scvhSurfaceControl = null
-    scvhAlphaState = 0f
-    coverView = null
-    coverContent = null
-    coverHostActivityRef = null
-    coverAttachedToken = null
-    coverSurfaceControl = null
   }
 
   /// Apply alpha to the cover's `SurfaceControl` directly via a
@@ -1318,7 +1523,7 @@ class HybridCover : HybridCoverSpec() {
   }
 
   private fun buildCoverView(activity: Activity): View {
-    val container = FrameLayout(activity).apply {
+    val container = FreezableFrameLayout(activity).apply {
       isClickable = true
       isFocusable = true
       contentDescription = COVER_LABEL