Fix manager crash (AbstractMethodError) on HyperOS3(Android 17) due to IServiceConnection signature change#784
Open
Leaf-lsgtky wants to merge 2 commits into
Conversation
Android 17 (API 36) replaced the old 3-argument IServiceConnection.connected(ComponentName, IBinder, boolean) with a new 4-argument overload that adds an IBinderSession parameter, and removed the old overload entirely from the framework interface. Vector's IServiceConnection stub and the ManagerService connection implementation only declared/overrode the old 3-argument signature. When system_server dispatched the new 4-argument connected() to the parasitic manager process on Android 17, the Stub lacked the new abstract method and threw AbstractMethodError, killing the manager process. system_server then hit DeadObjectException while dispatching a broadcast to the dead process, triggering a framework restart (SYSTEM_RESTART) every time the manager was opened. Fix: - Add an IBinderSession stub (android.app.IBinderSession extends IInterface) with binderTransactionCompleted(long) and binderTransactionStarting(String):long, matching the Android 17 framework interface. - Declare both connected() overloads in the IServiceConnection stub so it compiles against Android 8.1~17 (the old overload is simply never invoked on Android 17+). - Override the new 4-argument connected() in ManagerService's connection Stub (no-op, same as the existing 3-argument override).
The build system passed string macros to the C/C++ compiler wrapped in single quotes, e.g. -DVERSION_NAME='2.0' and -DINJECTED_PACKAGE_NAME='com.android.shell'. On Linux/macOS the shell strips the single quotes and the compiler sees a quoted string literal, but on Windows single quotes are not shell quoting characters, so the compiler receives -DVERSION_NAME='2.0' (a multi-character constant) or -DINJECTED_PACKAGE_NAME='com.android.shell', causing compilation failures: - narrowing conversion from 'int' to 'const char*' - expected unqualified-id / multi-character constant Fix by passing the values as bare tokens (-DVERSION_NAME=2.0, -DINJECTED_PACKAGE_NAME=com.android.shell) and stringizing them at the C++ side via a STRINGIZE macro, which is robust across Windows and Unix toolchains. Also move the stringize helper macros out of a namespace (macros are not namespace members and cannot be invoked with a qualified name).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On Android 17 (API 36), opening the manager triggers an
AbstractMethodErrorthat kills the parasitic manager process, followed by aDeadObjectExceptioninsystem_server(dispatching a broadcast to the dead process), which causes a framework restart (SYSTEM_RESTART) every time the manager is launched.The debug crash log shows:
java.lang.AbstractMethodError: abstract method "void android.app.IServiceConnection.connected(android.content.ComponentName, android.os.IBinder, android.app.IBinderSession, boolean)" on receiver org.matrix.vector.daemon.ipc.ManagerServiceManagerGuardconnection$1
Root cause
Android 17 replaced the old
IServiceConnection.connected(ComponentName, IBinder, boolean)overload with a new 4-argument signature that adds anIBinderSessionparameter, and removed the old overload entirely from the framework interface.Vector's
IServiceConnectionstub and theManagerServiceconnection implementation only declared/overrode the old 3-argument signature. Whensystem_serverdispatched the new 4-argumentconnected()to the parasitic manager process, theStublacked the new abstract method →AbstractMethodError→ process death →DeadObjectException→ framework restart.Fix
Commit 1 — Android 17 compatibility (core fix)
IBinderSessionstub (android.app.IBinderSession extends IInterface) withbinderTransactionCompleted(long)andbinderTransactionStarting(String):long, matching the Android 17 framework interface.connected()overloads in theIServiceConnectionstub so it compiles against Android 8.1–17. The old overload is simply never invoked on Android 17+.connected()inManagerService's connectionStub(no-op, same as the existing 3-argument override).Commit 2 — Windows build fix (prerequisite for local testing)
Passing string macros wrapped in single quotes (
-DVERSION_NAME='"2.0"') breaks on Windows because single quotes are not shell quoting characters there. The compiler receives-DVERSION_NAME='2.0'(a multi-character constant) and fails. Fixed by passing bare tokens and stringizing them at the C++ side via aSTRINGIZEmacro, which is robust across Windows and Unix toolchains.Testing
AbstractMethodError→ framework restart).VectorDaemon/VectorSystemServerlogs normal).The change is backward-compatible: on Android 8.1–16 the new overload exists only in the stub (never invoked at runtime), and the old overload is preserved unchanged.