4.4.1 Detecting Activity Bugs
Activities are window containers derived from an Activity
superclass; their implementations consist of responding
to events generated by users and the system. Activity bugs
stem from incorrect implementation of the Activity class,
e.g., one activity might be created or destroyed in the wrong
way so that it will make the application crash. In general,
activity bugs occur either because developers are not sufficiently
familiar with the activity- and event-based application
model in Android, or because the implementation fails
to obey the activity state machine. In practice, almost every
application we analyzed has activity bugs because it is hard
to check whether each base function of the base class has
been properly implemented.
An activity has a life cycle described by a state machine,
hence violations of this state machine lead to activity bugs.
A simplified version of the state machine is shown in Figure
3; the full state machine can be found on the Android
developer website [12]. Each activity can be in one of five
states: Active, Pause, Stop, Restore or Destroy. If an activity
occupies the screen’s foreground, it is running, hence in
the Active state. If another non-full screen or transparent
activity overlaps the current activity, the current activity
will be moved into the Pause state. An activity is in state
Stop once it is fully covered by another activity. Activities
in states Stop or Pause can be killed by system if memory
is needed elsewhere. If the activity is killed and the user has
restarted it again after some time, that activity will be in state Restore and then Active. Once an activity needs to be
killed, it will be in the Destroy state.
To ensure a correct state sequence, e.g., Start! Active! Pause! Restore! Active! Destroy, the corresponding userdefined
activity methods should be called in a valid order as
specified by the state machine, in this case: onCreate()! onPause()! onResume()! onDestroy(). We use the state
machine as a specification and match method calls from log
file entries against it. Violations of the state machine are
then flagged as potential bugs.
For example, in ConnectBot release 256 we found a new activity
bug, indicated by the log file entries shown in Figure 5
(a). The bug in Figure 5(a) manifests itself as an onCreate()
on line 1 without a subsequent onPause() preceding line 3,
which is a violation of the state machine specification. The
bug corresponds to a situation where the user sets up a default
shell host beforehand and then starts the application,
which crashes the application. Figure 4 is a screen shot of
the application crash when the scenario described above unfolds.