1.10.1 PackageValidator crash with UID -1

Version

Media3 1.10.1

More version details

No response

Devices that reproduce the issue

Devices that do not reproduce the issue

No response

Reproducible in the demo app?

Not tested

Reproduction steps

We don't know how to reproduce it ourselves, but it's likely related to bluetooth devices and tapping play while the app has been killed or garbage collected?

Background context:

We're using our own implementation of the PackageValidator from the UAMP project, with our onGetSession being overridden like this:

override fun onGetSession(controllerInfo: ControllerInfo): MediaLibrarySession? {
    return if ("android.media.session.MediaController" == controllerInfo.packageName
        || packageValidator.isKnownCaller(controllerInfo.packageName, controllerInfo.uid)
    ) {
        mediaSession
    } else null
}

Expected result

No crash

Actual result

Crash 1:

We're getting the following crashes after updating from 1.9.3 to 1.10.1:

Fatal Exception: java.lang.RuntimeException: Unable to start service com.app.media.AudioService@27c9a28 with Intent { act=android.intent.action.MEDIA_BUTTON dat=androidx://media3.session/... cmp=com.app/.media.AudioService (has extras) }: java.lang.IllegalStateException: Caller's package UID doesn't match caller's actual UID?
       at android.app.ActivityThread.handleServiceArgs(ActivityThread.java:4710)
       at android.app.ActivityThread.-$$Nest$mhandleServiceArgs()
       at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2182)
       at android.os.Handler.dispatchMessage(Handler.java:106)
       at android.os.Looper.loopOnce(Looper.java:346)
       at android.os.Looper.loop(Looper.java:475)
       at android.app.ActivityThread.main(ActivityThread.java:7950)
       at java.lang.reflect.Method.invoke(Method.java)
       at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
       at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:942)

We haven't changed anything in the PackageValidator or the onGetSession override function in the new release, so that's why I'm suspecting the Media3 update being the culprit.

We added logging, and we can see that in this piece of code:

        // Verify that things aren't ... broken. (This test should always pass.)
        if (callerPackageInfo.uid != callingUid) {
            throw IllegalStateException("Caller's package UID doesn't match caller's actual UID?")
        }

the callingUid is now -1 whereas callerPackageInfo.uid is something like 10399 and varies for each crash. I guess this didn't happen before 1.10.

Crash 2:

We then tried to return false in isKnownCaller instead of throwing an exception, but after releasing this, we get a new crash we hadn't gotten before:

Fatal Exception: java.lang.RuntimeException: Unable to start service com.app.media.AudioService@5d09ebb with Intent { act=android.intent.action.MEDIA_BUTTON dat=androidx://media3.session/... xflg=0x4 cmp=com.app/.media.AudioService (has extras) }
       at android.app.ActivityThread.handleServiceArgs(ActivityThread.java:6469)
       at android.app.ActivityThread.-$$Nest$mhandleServiceArgs()
       at android.app.ActivityThread$H.handleMessage(ActivityThread.java:3111)
       at android.os.Handler.dispatchMessage(Handler.java:132)
       at android.os.Looper.dispatchMessage(Looper.java:358)
       at android.os.Looper.loopOnce(Looper.java:288)
       at android.os.Looper.loop(Looper.java:392)
       at android.app.ActivityThread.main(ActivityThread.java:10346)
       at java.lang.reflect.Method.invoke(Method.java)
       at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:638)
       at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:972)
Caused by android.app.ForegroundServiceStartNotAllowedException: Service.startForeground() not allowed due to mAllowStartForeground false: service com.app/.media.AudioService
       at android.app.ForegroundServiceStartNotAllowedException$1.createFromParcel(ForegroundServiceStartNotAllowedException.java:54)
       at android.app.ForegroundServiceStartNotAllowedException$1.createFromParcel(ForegroundServiceStartNotAllowedException.java:50)
       at android.os.Parcel.readParcelableInternal(Parcel.java:5277)
       at android.os.Parcel.readParcelable(Parcel.java:5258)
       at android.os.Parcel.createExceptionOrNull(Parcel.java:3383)
       at android.os.Parcel.createException(Parcel.java:3372)
       at android.os.Parcel.readException(Parcel.java:3355)
       at android.os.Parcel.readException(Parcel.java:3297)
       at android.app.IActivityManager$Stub$Proxy.setServiceForeground(IActivityManager.java:7682)
       at android.app.Service.startForeground(Service.java:862)
       at androidx.media3.common.util.Util$Api29.startForeground(Util.java:4408)
       at androidx.media3.common.util.Util.setForegroundServiceNotification(Util.java:321)
       at androidx.media3.session.MediaSessionService.stopSelfSafely(MediaSessionService.java:589)
       at androidx.media3.session.MediaSessionService.onStartCommand(MediaSessionService.java:533)
       at android.app.ActivityThread.handleServiceArgs(ActivityThread.java:6453)
       at android.app.ActivityThread.-$$Nest$mhandleServiceArgs()
       at android.app.ActivityThread$H.handleMessage(ActivityThread.java:3111)
       at android.os.Handler.dispatchMessage(Handler.java:132)
       at android.os.Looper.dispatchMessage(Looper.java:358)
       at android.os.Looper.loopOnce(Looper.java:288)
       at android.os.Looper.loop(Looper.java:392)
       at android.app.ActivityThread.main(ActivityThread.java:10346)
       at java.lang.reflect.Method.invoke(Method.java)
       at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:638)
       at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:972)

My question is, is this not the way to go anymore? The UAMP project has been archived, so maybe this approach is deprecated? In Google's own docs they just return the mediaSession every time: https://developer.android.com/media/media3/session/background-playback#service-lifecycle

Or is this all caused by an unintentional change in 1.10?

Thank you in advance, I hope you can help us with how to proceed!

Media

Not applicable

Bug Report

• You will email the zip file produced by adb bugreport to android-media-github@google.com after filing this issue.