[LeakScope] 16 Android lifecycle/memory violations detected

[MuhammadTehamsibAliTashfeen]

LeakScope: Android Lifecycle & Memory Leak Violations

About this report: This issue was automatically generated by LeakScope, a static analysis tool for Android lifecycle violations and memory leaks built on the Soot framework. This is part of an ongoing academic research study targeting ICSE 2027. No immediate action is required — we would greatly appreciate your feedback on whether these findings are accurate.

Summary

LeakScope detected 16 potential issue(s) across 3 detector type(s):

Severity	Count
🔴 High	10
🟡 Medium	0
🟢 Low (improvement opportunity)	6

Detector	Count	Severity	Description
FragmentViewFieldRetentionLeak	1	🔴 High	Fragment stores View references in instance fields not cleared in onDestroyView()
ThreadedUIReference	9	🔴 High	Worker thread captures Activity/Fragment/View reference
ViewBindingOpportunity	6	🟢 Low	Manual findViewById() calls — ViewBinding migration opportunity

---

Detailed Findings

🔴 FragmentViewFieldRetentionLeak

Fragment stores View references in instance fields not cleared in onDestroyView()

Finding #1 — TrackersFragment

Fragment View Field Retention Leak Detected
Class: net.kollnig.missioncontrol.details.TrackersFragment

Issue:
- Fragment stores View references in instance fields
- These fields are not cleared when the view is destroyed

- onDestroyView() is missing

Leaked Fields:
  • swipeRefresh : androidx.swiperefreshlayout.widget.SwipeRefreshLayout (assigned in onCreateView)

Why this is dangerous:
- Fragment views are destroyed/recreated on config changes
- Retained View references prevent garbage collection
- Leaked Views hold references to Activity Context
- Can cause OutOfMemoryError with repeated Fragment transactions

Recommended Fix:
Override onDestroyView() and clear all View/Binding fields:
  @Override
  public void onDestroyView() {
    super.onDestroyView();
    swipeRefresh = null;
  }

🔴 ThreadedUIReference

Worker thread captures Activity/Fragment/View reference

Finding #2 — DetailsActivity

Scenario 1: Worker thread holds UI object reference
Class: net.kollnig.missioncontrol.DetailsActivity
Method: void onActivityResult(int,int,android.content.Intent)
Statement: $r6 = new net.kollnig.missioncontrol.DetailsActivity$ExportDatabaseCSVTask
Captured UI objects:
  - r0 : net.kollnig.missioncontrol.DetailsActivity
Risk: UI object will be kept in memory until thread completes
Fix: Use WeakReference or avoid passing UI objects to worker threads

Finding #3 — ActivityMain\n// (Full source code omitted for brevity)\n"

{
  "text_input": "package eu.faircode.netguard;\n\n// Class: eu.faircode.netguard.ActivityMain\n// (Full source code omitted for brevity)\n",
  "output": "Yes",
  "project": "netguard",
  "explanation": "Scenario 1: Worker thread holds UI object reference\nClass: eu.faircode.netguard.ActivityMain\nMethod: void handleExport(android.content.Intent)\nStatement: $r2 \u003d new eu.faircode.netguard.ActivityMain$8\nCaptured UI objects:\n  - r0 : eu.faircode.netguard.ActivityMain\nRisk: UI object will be kept in memory until thread completes\nFix: Use WeakReference or avoid passing UI objects to worker threads\n"
}
{
  "text_input": "package eu.faircode.netguard;\n\n// Class: eu.faircode.netguard.ActivityMain\n// (Full source code omitted for brevity)\n",
  "output": "Yes",
  "project": "netguard",
  "explanation": "Scenario 1: Worker thread holds UI object reference\nClass: eu.faircode.netguard.ActivityMain\nMethod: void initialiseStrictMode(boolean)\nStatement: $r3 \u003d new java.lang.Thr
… (truncated for brevity)

Finding #4 — ActivityDns\n// (Full source code omitted for brevity)\n"

{
  "text_input": "package eu.faircode.netguard;\n\n// Class: eu.faircode.netguard.ActivityDns\n// (Full source code omitted for brevity)\n",
  "output": "Yes",
  "project": "netguard",
  "explanation": "Scenario 1: Worker thread holds UI object reference\nClass: eu.faircode.netguard.ActivityDns\nMethod: void cleanup()\nStatement: $r1 \u003d new eu.faircode.netguard.ActivityDns$2\nCaptured UI objects:\n  - r0 : eu.faircode.netguard.ActivityDns\nRisk: UI object will be kept in memory until thread completes\nFix: Use WeakReference or avoid passing UI objects to worker threads\n"
}
{
  "text_input": "package eu.faircode.netguard;\n\n// Class: eu.faircode.netguard.ActivityDns\n// (Full source code omitted for brevity)\n",
  "output": "Yes",
  "project": "netguard",
  "explanation": "Scenario 1: Worker thread holds UI object reference\nClass: eu.faircode.netguard.ActivityDns\nMethod: void clear()\nStatement: $r1 \u003d new eu.faircode.netguard.ActivityDns$3\nCaptured UI objects:\n  - r0 : e
… (truncated for brevity)

Finding #5 — ActivityForwarding

Scenario 1: Worker thread holds UI object reference
Class: eu.faircode.netguard.ActivityForwarding
Method: boolean onOptionsItemSelected(android.view.MenuItem)
Statement: $r11 = new eu.faircode.netguard.ActivityForwarding$3
Captured UI objects:
  - r10 : android.widget.Spinner
  - r0 : eu.faircode.netguard.ActivityForwarding
  - r9 : android.widget.ProgressBar
Risk: UI object will be kept in memory until thread completes
Fix: Use WeakReference or avoid passing UI objects to worker threads

Finding #6 — ActivitySettings\n// (Full source code omitted for brevity)\n"

{
  "text_input": "package eu.faircode.netguard;\n\n// Class: eu.faircode.netguard.ActivitySettings\n// (Full source code omitted for brevity)\n",
  "output": "Yes",
  "project": "netguard",
  "explanation": "Scenario 1: Worker thread holds UI object reference\nClass: eu.faircode.netguard.ActivitySettings\nMethod: void handleExport(android.content.Intent)\nStatement: $r2 \u003d new eu.faircode.netguard.ActivitySettings$11\nCaptured UI objects:\n  - r0 : eu.faircode.netguard.ActivitySettings\nRisk: UI object will be kept in memory until thread completes\nFix: Use WeakReference or avoid passing UI objects to worker threads\n"
}
{
  "text_input": "package eu.faircode.netguard;\n\n// Class: eu.faircode.netguard.ActivitySettings\n// (Full source code omitted for brevity)\n",
  "output": "Yes",
  "project": "netguard",
  "explanation": "Scenario 1: Worker thread holds UI object reference\nClass: eu.faircode.netguard.ActivitySettings\nMethod: void handleHosts(android.content.Intent,boolean)\n
… (truncated for brevity)

Finding #7 — ActivityLog\n// (Full source code omitted for brevity)\n"

{
  "text_input": "package eu.faircode.netguard;\n\n// Class: eu.faircode.netguard.ActivityLog\n// (Full source code omitted for brevity)\n",
  "output": "Yes",
  "project": "netguard",
  "explanation": "Scenario 1: Worker thread holds UI object reference\nClass: eu.faircode.netguard.ActivityLog\nMethod: void handleExportPCAP(android.content.Intent)\nStatement: $r2 \u003d new eu.faircode.netguard.ActivityLog$3\nCaptured UI objects:\n  - r0 : eu.faircode.netguard.ActivityLog\nRisk: UI object will be kept in memory until thread completes\nFix: Use WeakReference or avoid passing UI objects to worker threads\n"
}
{
  "text_input": "package eu.faircode.netguard;\n\n// Class: eu.faircode.netguard.ActivityLog\n// (Full source code omitted for brevity)\n",
  "output": "Yes",
  "project": "netguard",
  "explanation": "Scenario 1: Worker thread holds UI object reference\nClass: eu.faircode.netguard.ActivityLog\nMethod: boolean onOptionsItemSelected(android.view.MenuItem)\nStatement: r14 \u003d n
… (truncated for brevity)

Finding #8 — ActionsFragment\n// (Full source code omitted for brevity)\n"

{
  "text_input": "package net.kollnig.missioncontrol.details;\n\n// Class: net.kollnig.missioncontrol.details.ActionsFragment\n// (Full source code omitted for brevity)\n",
  "output": "Yes",
  "project": "missioncontrol",
  "explanation": "Scenario 1: Worker thread holds UI object reference\nClass: net.kollnig.missioncontrol.details.ActionsFragment\nMethod: void lambda$onClick$2$net-kollnig-missioncontrol-details-ActionsFragment(android.view.View,android.content.DialogInterface,int)\nStatement: $r3 \u003d new java.lang.Thread\nCaptured UI objects:\n  - $r1 : android.view.View\n  - r0 : net.kollnig.missioncontrol.details.ActionsFragment\nRisk: UI object will be kept in memory until thread completes\nFix: Use WeakReference or avoid passing UI objects to worker threads\n"
}
{
  "text_input": "package net.kollnig.missioncontrol.details;\n\n// Class: net.kollnig.missioncontrol.details.ActionsFragment\n// (Full source code omitted for brevity)\n",
  "output": "Yes",
  "project": "missionco
… (truncated for brevity)

Finding #9 — CountriesFragment\n// (Full source code omitted for brevity)\n"

{
  "text_input": "package net.kollnig.missioncontrol.details;\n\n// Class: net.kollnig.missioncontrol.details.CountriesFragment\n// (Full source code omitted for brevity)\n",
  "output": "Yes",
  "project": "missioncontrol",
  "explanation": "Scenario 1: Worker thread holds UI object reference\nClass: net.kollnig.missioncontrol.details.CountriesFragment\nMethod: void onViewCreated(android.view.View,android.os.Bundle)\nStatement: $r3 \u003d new java.lang.Thread\nCaptured UI objects:\n  - r7 : android.widget.ImageView\n  - r0 : net.kollnig.missioncontrol.details.CountriesFragment\n  - r6 : android.widget.ProgressBar\n  - r8 : android.widget.TextView\nRisk: UI object will be kept in memory until thread completes\nFix: Use WeakReference or avoid passing UI objects to worker threads\n"
}
{
  "text_input": "package net.kollnig.missioncontrol.details;\n\n// Class: net.kollnig.missioncontrol.details.CountriesFragment\n// (Full source code omitted for brevity)\n",
  "output": "Yes",
  "project
… (truncated for brevity)

Finding #10 — TrackersFragment

Scenario 1: Worker thread holds UI object reference
Class: net.kollnig.missioncontrol.details.TrackersFragment
Method: void updateTrackerList()
Statement: $r1 = new net.kollnig.missioncontrol.details.TrackersFragment$1
Captured UI objects:
  - r0 : net.kollnig.missioncontrol.details.TrackersFragment
Risk: UI object will be kept in memory until thread completes
Fix: Use WeakReference or avoid passing UI objects to worker threads

🟢 ViewBindingOpportunity

Manual findViewById() calls — ViewBinding migration opportunity

Finding #11 — DetailsActivity

View Binding Migration Opportunity
Class: net.kollnig.missioncontrol.DetailsActivity
Type: Activity
Current Pattern: Manual view lookup
findViewById() Calls:
  • findViewById in onCreate
  • findViewById in onCreate
  • findViewById in onCreate
Benefits of View Binding:
- Eliminates boilerplate findViewById() calls
- Compile-time type safety for view references
- Reduced null pointer exceptions
- Cleaner, more maintainable code
Note: This is a code modernization suggestion, not a memory leak

Finding #12 — ActivityMain

View Binding Migration Opportunity
Class: eu.faircode.netguard.ActivityMain
Type: Activity
Current Pattern: Manual view lookup
findViewById() Calls:
  • findViewById in checkDataSaving
  • findViewById in checkDoze
  • findViewById in menu_about
  • findViewById in menu_about
  • findViewById in menu_about
  • findViewById in menu_about
  • findViewById in menu_about
  • findViewById in menu_legend
  • findViewById in menu_legend
  • findViewById in menu_legend
  • findViewById in menu_legend
  • findViewById in menu_legend
  • findViewById in menu_legend
  • findViewById in menu_legend
  • findViewById in menu_legend
  • findViewById in showHints
  • findViewById in showHints
  • findViewById in showHints
  • findViewById in showHints
  • findViewById in showHints
  • findViewById in showHints
  • findViewById in onCreate
  • findViewById in onCreate
  • findViewById in onCreate
  • findViewById in onCreate
  • findViewById in onCrea
… (truncated for brevity)

Finding #13 — ActivityForwardApproval

View Binding Migration Opportunity
Class: eu.faircode.netguard.ActivityForwardApproval
Type: Activity
Current Pattern: Manual view lookup
findViewById() Calls:
  • findViewById in onCreate
  • findViewById in onCreate
  • findViewById in onCreate
Benefits of View Binding:
- Eliminates boilerplate findViewById() calls
- Compile-time type safety for view references
- Reduced null pointer exceptions
- Cleaner, more maintainable code
Note: This is a code modernization suggestion, not a memory leak

Finding #14 — ActivityDns

View Binding Migration Opportunity
Class: eu.faircode.netguard.ActivityDns
Type: Activity
Current Pattern: Manual view lookup
findViewById() Calls:
  • findViewById in onCreate
Benefits of View Binding:
- Eliminates boilerplate findViewById() calls
- Compile-time type safety for view references
- Reduced null pointer exceptions
- Cleaner, more maintainable code
Note: This is a code modernization suggestion, not a memory leak

Finding #15 — ActivityForwarding

View Binding Migration Opportunity
Class: eu.faircode.netguard.ActivityForwarding
Type: Activity
Current Pattern: Manual view lookup
findViewById() Calls:
  • findViewById in onCreate
  • findViewById in onOptionsItemSelected
  • findViewById in onOptionsItemSelected
  • findViewById in onOptionsItemSelected
  • findViewById in onOptionsItemSelected
  • findViewById in onOptionsItemSelected
  • findViewById in onOptionsItemSelected
Benefits of View Binding:
- Eliminates boilerplate findViewById() calls
- Compile-time type safety for view references
- Reduced null pointer exceptions
- Cleaner, more maintainable code
Note: This is a code modernization suggestion, not a memory leak

Finding #16 — ActivityLog

View Binding Migration Opportunity
Class: eu.faircode.netguard.ActivityLog
Type: Activity
Current Pattern: Manual view lookup
findViewById() Calls:
  • findViewById in lambda$onCreate$4$eu-faircode-netguard-ActivityLog
  • findViewById in onCreate
  • findViewById in onCreate
  • findViewById in onCreate
  • findViewById in onSharedPreferenceChanged
  • findViewById in onSharedPreferenceChanged
Benefits of View Binding:
- Eliminates boilerplate findViewById() calls
- Compile-time type safety for view references
- Reduced null pointer exceptions
- Cleaner, more maintainable code
Note: This is a code modernization suggestion, not a memory leak

---

How to respond to this issue:

• If a finding is a true positive: consider applying the recommended fix and closing this issue.
• If a finding is a false positive: please leave a comment explaining why — your feedback directly improves our research.
• If you have questions: reply here or open a discussion.

This report was generated by LeakScope as part of the ICSE 2027 research artifact. Tool analyzes compiled APKs using Soot static analysis on tracker-control-android.