Skip to content

Fix NPE in Site Settings GBKit toggle refresh with null site#22953

Merged
adalpari merged 2 commits into
release/26.8from
fix/site-settings-gutenberg-toggle-npe
Jun 10, 2026
Merged

Fix NPE in Site Settings GBKit toggle refresh with null site#22953
adalpari merged 2 commits into
release/26.8from
fix/site-settings-gutenberg-toggle-npe

Conversation

@adalpari

@adalpari adalpari commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

Description

Fixes a crash in Site Settings (Sentry issue, com.jetpack.android@26.8-rc-5+1493).

SiteSettingsProviderImpl.isBlockEditorDefault(site: SiteModel) declares a non-null Kotlin site parameter. The refresh of the GutenbergKit toggle is reached from the async onSettingsUpdated() callback (SiteSettingsInterfaceHandler), which only guards with isAdded(). When mSite is null at that point, Java passes null into the non-null param and the compiler-generated Intrinsics.checkNotNullParameter check throws an NPE ("Attempt to invoke … getClass() on a null object reference").

This adds an mSite == null early-return guard to refreshGutenbergKitToggleAvailability(), matching the mSite null-guard pattern already used elsewhere in the fragment.

-        if (mGutenbergKitPref == null) return;
+        if (mGutenbergKitPref == null || mSite == null) return;

Testing instructions

Open Site Settings:

  1. Open the app and navigate to My Site → Settings for a site.
  2. Toggle Use block editor as default for new posts on/off.
  • Verify the GutenbergKit toggle availability/summary refreshes without crashing.

The refresh runs from an async onSettingsUpdated callback that only guards
with isAdded(), so mSite can be null when isBlockEditorDefault — a non-null
Kotlin param — is invoked, crashing on the generated null check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@dangermattic

dangermattic commented Jun 8, 2026

Copy link
Copy Markdown
Collaborator
1 Warning
⚠️ PR is not assigned to a milestone.

Generated by 🚫 Danger

@wpmobilebot

wpmobilebot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

App Icon📲 You can test the changes from this Pull Request in Jetpack Android by scanning the QR code below to install the corresponding build.

App NameJetpack Android
Build TypeDebug
Versionpr22953-f3c5f66
Build Number1493
Application IDcom.jetpack.android.prealpha
Commitf3c5f66
Installation URL57k6qdctt0h7g
Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

@wpmobilebot

wpmobilebot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

App Icon📲 You can test the changes from this Pull Request in WordPress Android by scanning the QR code below to install the corresponding build.

App NameWordPress Android
Build TypeDebug
Versionpr22953-f3c5f66
Build Number1493
Application IDorg.wordpress.android.prealpha
Commitf3c5f66
Installation URL7stm2uch8p1tg
Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

@wpmobilebot

Copy link
Copy Markdown
Contributor

🤖 Build Failure Analysis

This build has failures. Claude has analyzed them - check the build annotations for details.

@adalpari adalpari marked this pull request as ready for review June 9, 2026 18:04
@adalpari adalpari requested a review from nbradbury June 9, 2026 18:04
@nbradbury

Copy link
Copy Markdown
Contributor

@adalpari Claude suggested this as a follow-up but mentioning it here in case you'd rather implement it now:

ApplicationPasswordsFetchResponse (used by the WPApi client's fetch and introspect paths, WPApiApplicationPasswordsRestClient.kt:81 and :146) still declares uuid and name non-null, so the same latent Gson NPE exists there — it.uuid at line 89/156 would throw if the server ever omits the field. Same for any other Gson-backed data classes in this package. Since this PR is a targeted RC crash fix, leaving that to a trunk follow-up is reasonable, but it's worth filing.

@nbradbury nbradbury left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@adalpari I'll approve this to unblock it, up to you whether to address my comment before merging :shipit:

@adalpari

Copy link
Copy Markdown
Contributor Author

@adalpari Claude suggested this as a follow-up but mentioning it here in case you'd rather implement it now:

ApplicationPasswordsFetchResponse (used by the WPApi client's fetch and introspect paths, WPApiApplicationPasswordsRestClient.kt:81 and :146) still declares uuid and name non-null, so the same latent Gson NPE exists there — it.uuid at line 89/156 would throw if the server ever omits the field. Same for any other Gson-backed data classes in this package. Since this PR is a targeted RC crash fix, leaving that to a trunk follow-up is reasonable, but it's worth filing.

Thank you for flagging it. Since it's a broader change and this PR is targeting a specific crash, I'm openign a new PR with the extra fix: #22968

@adalpari adalpari merged commit d956811 into release/26.8 Jun 10, 2026
25 checks passed
@adalpari adalpari deleted the fix/site-settings-gutenberg-toggle-npe branch June 10, 2026 07:36
@adalpari

Copy link
Copy Markdown
Contributor Author

@adalpari Claude suggested this as a follow-up but mentioning it here in case you'd rather implement it now:

ApplicationPasswordsFetchResponse (used by the WPApi client's fetch and introspect paths, WPApiApplicationPasswordsRestClient.kt:81 and :146) still declares uuid and name non-null, so the same latent Gson NPE exists there — it.uuid at line 89/156 would throw if the server ever omits the field. Same for any other Gson-backed data classes in this package. Since this PR is a targeted RC crash fix, leaving that to a trunk follow-up is reasonable, but it's worth filing.

Wait, I'm confused. Does this comment belong to this other PR? Otherwise, the other opened PR is already fixing the problem 😅

crazytonyli pushed a commit that referenced this pull request Jun 12, 2026
…22953)

The refresh runs from an async onSettingsUpdated callback that only guards
with isAdded(), so mSite can be null when isBlockEditorDefault — a non-null
Kotlin param — is invoked, crashing on the generated null check.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
crazytonyli added a commit that referenced this pull request Jun 15, 2026
* Fix NPE in Site Settings when refreshing GBKit toggle with null site (#22953)

The refresh runs from an async onSettingsUpdated callback that only guards
with isAdded(), so mSite can be null when isBlockEditorDefault — a non-null
Kotlin param — is invoked, crashing on the generated null check.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Fix Sentry 3GCQ/3GDH: keep Gson-deserialized models from R8 full mode (#22954)

* Fix Sentry WORDPRESS-ANDROID-3GCQ, WORDPRESS-ANDROID-3GDH: keep recommend models from R8

AGP 9's R8 full mode (introduced in 26.8) was transforming
RecommendApiCallsProvider$RecommendTemplateData, causing
InstantiationException and ClassCastException when Gson tried
to deserialize the /mobile/share-app-link response.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Keep additional Gson-deserialized models from R8

Audit of fromJson<T> call sites surfaced more Kotlin data classes
that AGP 9's R8 full mode could class-merge or strip the same way
it did to RecommendTemplateData. Adds -keep rules for:

- InviteLinksApiCallsProvider.InviteLinksItem
- ReaderReadingPreferences (incl. Theme/FontFamily/FontSize enums)
- SubfilterListItemMapper.MappedSubfilterListItem
- StatsCardsConfiguration + StatsCardType
- SubscribersCardsConfiguration + SubscribersCardType
- InsightsCardsConfigurationRepository.PersistedConfig + InsightsCardType

These have not yet appeared in Sentry for 26.8-rc-5, but the rc-5
user base is small and the affected paths (Reader startup, new
stats screens, invite links) are high-traffic enough that they
would likely surface in Beta/GA.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Fix NPE when application password response is missing password or UUID (#22952)

The Gson-deserialized ApplicationPasswordCreationResponse declared its
fields as non-null, but Gson populates objects via reflection and bypasses
Kotlin's null checks. When the API returns a 200 response missing the
`password` or `uuid` field, those nulls flowed into the non-null
ApplicationPasswordCreationPayload constructor, crashing the app (in the
minified release build the parameter null-check compiles to a bare
getClass() call, producing the reported NPE).

Make the response fields nullable and validate them, returning the existing
error payload instead of crashing. Applied to both the Jetpack and WP-API
clients, which share the response type.

Crash report: https://a8c.sentry.io/issues/7522022287/

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Update translations

* Update WordPress metadata translations for 26.8

* Update Jetpack metadata translations for 26.8

* Bump version number

* Update translations

* Bump version number

---------

Co-authored-by: Adalberto Plaza <adalpari@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Nick Bradbury <nbradbury@users.noreply.github.com>
Co-authored-by: Automattic Release Bot <mobile+wpmobilebot@automattic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants