Crash logs.
12-19 03:52:30.914 641 3002 D ConnectivityService: notifyType LOST for NetworkAgentInfo [WIFI () - 108]
12-19 03:52:30.915 641 3002 D CSLegacyTypeTracker: Sending disconnected broadcast for type 1 NetworkAgentInfo [WIFI () - 108] isDefaultNetwork=true
12-19 03:52:30.915 641 3002 D ConnectivityService: sendStickyBroadcast: action=android.net.conn.CONNECTIVITY_CHANGE_IMMEDIATE
12-19 03:52:30.915 641 3002 D ConnectivityService: sendStickyBroadcast: action=android.net.conn.CONNECTIVITY_CHANGE
12-19 03:52:30.917 641 3002 D ConnectivityService: sendStickyBroadcast: action=android.net.conn.CONNECTIVITY_CHANGE_IMMEDIATE
12-19 03:52:30.917 641 3002 D ConnectivityService: sendStickyBroadcast: action=android.net.conn.CONNECTIVITY_CHANGE
12-19 03:52:30.918 641 3002 D ConnectivityService: Checking for replacement network to handle request NetworkRequest [ id=1, legacyType=-1, [ Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED&NOT_VPN] ]
12-19 03:52:30.918 641 3002 E ConnectivityService: handleAsyncChannelDisconnected() mActiveDefaultNetwork= TYPE_NONE
12-19 03:52:30.921 641 3002 E ConnectivityService: EVENT_NETWORK_INFO_CHANGED from unknown NetworkAgent
12-19 03:52:30.923 641 641 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
12-19 03:52:30.923 641 641 E AndroidRuntime: java.lang.RuntimeException: Error receiving broadcast Intent { act=android.net.conn.CONNECTIVITY_CHANGE flg=0x4000010 (has extras) } in com.android.server.content.SyncManager$4@139df0cb
12-19 03:52:30.923 641 641 E AndroidRuntime: at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:912)
12-19 03:52:30.923 641 641 E AndroidRuntime: at android.os.Handler.handleCallback(Handler.java:739)
12-19 03:52:30.923 641 641 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:95)
12-19 03:52:30.923 641 641 E AndroidRuntime: at android.os.Looper.loop(Looper.java:135)
12-19 03:52:30.923 641 641 E AndroidRuntime: at com.android.server.SystemServer.run(SystemServer.java:290)
12-19 03:52:30.923 641 641 E AndroidRuntime: at com.android.server.SystemServer.main(SystemServer.java:190)
12-19 03:52:30.923 641 641 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
12-19 03:52:30.923 641 641 E AndroidRuntime: at java.lang.reflect.Method.invoke(Method.java:372)
12-19 03:52:30.923 641 641 E AndroidRuntime: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:984)
12-19 03:52:30.923 641 641 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779)
12-19 03:52:30.923 641 641 E AndroidRuntime: Caused by: java.lang.ClassCastException: java.lang.Object cannot be cast to com.android.server.connectivity.NetworkAgentInfo
12-19 03:52:30.923 641 641 E AndroidRuntime: at com.android.server.ConnectivityService.getUnfilteredActiveNetworkState(ConnectivityService.java:931)
12-19 03:52:30.923 641 641 E AndroidRuntime: at com.android.server.ConnectivityService.getActiveNetworkInfo(ConnectivityService.java:1014)
12-19 03:52:30.923 641 641 E AndroidRuntime: at android.net.ConnectivityManager.getActiveNetworkInfo(ConnectivityManager.java:616)
12-19 03:52:30.923 641 641 E AndroidRuntime: at com.android.server.content.SyncManager.readDataConnectionState(SyncManager.java:343)
12-19 03:52:30.923 641 641 E AndroidRuntime: at com.android.server.content.SyncManager.access$400(SyncManager.java:123)
12-19 03:52:30.923 641 641 E AndroidRuntime: at com.android.server.content.SyncManager$4.onReceive(SyncManager.java:327)
12-19 03:52:30.923 641 641 E AndroidRuntime: at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:902)
12-19 03:52:30.923 641 641 E AndroidRuntime: ... 9 more
12-19 03:52:30.923 641 641 I AndroidRuntime: To Report FATAL to activityManagerService
12-19 03:52:30.948 641 3198 D WifiService: releaseWifiLockLocked: WifiLock{AndroidRouter type=3 binder=android.os.BinderProxy@3b2bdcb5}
12-19 03:52:30.950 641 641 I ActivityManager: addErrorToDropBox inserted hashcode=44497a8b9c09a26d1cfd89e2a1b25d114ac35ddb for eventType crash.
Analysis.
From the logs, we can see that the problem happened when system tried to get network info by calling getActiveNetworkInfo method.
And before this, system is calling handleAsyncChannelDisconnected method to process channel disconnected message.
These two operations are executed in two different thread.
1. getActiveNetworkInfo method is called in mConnectivityIntentReceiver.onReceive. The method is executed in system server's main thread. It is used to handle "com.amazon.speech.CONNECTIVITY_ACTION" broadcast.
In getActiveNetworkInfo method, it is going to get network info.
924 private NetworkState getUnfilteredActiveNetworkState(int uid) { 925 NetworkInfo info = null; 926 LinkProperties lp = null; 927 NetworkCapabilities nc = null; 928 Network network = null; 929 String subscriberId = null; 930 931 NetworkAgentInfo nai = mNetworkForRequestId.get(mDefaultRequest.requestId);
2. handleAsyncChannelDisconnected is called in ConnectivityServiceThread.
2019 public void handleMessage(Message msg) { 2020 NetworkInfo info; 2021 switch (msg.what) { 2031 case AsyncChannel.CMD_CHANNEL_DISCONNECTED: { 2032 handleAsyncChannelDisconnected(msg); 2033 break; 2034 }
In handleAsyncChannelDisconnected, it is going to remove network info from mNetworkForRequestId array.
2295 private void handleAsyncChannelDisconnected(Message msg) { 2296 NetworkAgentInfo nai = mNetworkAgentInfos.get(msg.replyTo); 2297 if (nai != null) { 2335 for (int i = 0; i < nai.networkRequests.size(); i++) { 2336 NetworkRequest request = nai.networkRequests.valueAt(i); 2337 NetworkAgentInfo currentNetwork = mNetworkForRequestId.get(request.requestId); 2338 if (currentNetwork != null && currentNetwork.network.netId == nai.network.netId) { 2342 mNetworkForRequestId.remove(request.requestId); 2359 } 2371 } 2372 }
As these 2 operations are executed in 2 different thread, and not protected by lock, it may run into some race condition. If the remove operation is executed before get operation, the get operation will return null.
ClassCastException will be thrown if we try to convert null object to NetworkAgentInfo object as below.
931 NetworkAgentInfo nai = mNetworkForRequestId.get(mDefaultRequest.requestId);