【AOSP BUG】Null object reference in Notification.java

最新推荐文章于 2026-06-03 20:57:34 发布

原创最新推荐文章于 2026-06-03 20:57:34 发布 · 309 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

android framework bug 专栏收录该内容

2 篇文章

订阅专栏

本文探讨了Android中Notification.Builder设置空Action导致的NullPointerException问题。通过分析错误代码位置及原因，发现是由于某些第三方应用在调用addAction(null)时传入空值引发。文中提供了三种解决方案，包括对Action进行非空检查，以避免system_server崩溃。

java.lang.NullPointerException: Attempt to invoke virtual method 'android.app.Notification$Action android.app.Notification$Action.clone()' on a null object reference
at android.app.Notification.cloneInto(Notification.java:1739)
at android.app.Notification.clone(Notification.java:1660)
at android.service.notification.StatusBarNotification.clone(StatusBarNotification.java:220)
at com.android.server.notification.NotificationManagerService$TrimCache.ForListener(NotificationManagerService.java:3818)
at com.android.server.notification.NotificationManagerService$NotificationListeners.notifyPosted(NotificationManagerService.java:4056)
at com.android.server.notification.NotificationManagerService$EnqueueNotificationRunnable.run(NotificationManagerService.java:2706)
at android.os.Handler.handleCallback(Handler.java:751)
at android.os.Handler.dispatchMessage(Handler.java:95)
at android.os.Looper.loop(Looper.java:154)
at com.android.server.SystemServer.run(SystemServer.java:352)
at com.android.server.SystemServer.main(SystemServer.java:220)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:874)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:764)

查看出错代码位置

if (this.actions != null) {
            that.actions = new Action[this.actions.length];
            for(int i=0; i<this.actions.length; i++) {
                that.actions[i] = this.actions[i].clone();
            }
        }

发现是由于this.action[i] 为空导致的.

notification 的 action[] 在赋值的时候可能为空导致,也有可能是多线程未同步导致.

但是后来发现这个不是由于多线程未同步导致的.

原因如下:

    Notification notification = new Notification.Builder(this)
            .setSmallIcon(R.drawable.status_bar_toggle_gps_on)
            .setContentTitle("title")
            .setContentText(s)
            .addAction(null)
            .build();
    NotificationManager notificationManager = (NotificationManager) this.getSystemService(Context.NOTIFICATION_SERVICE);
    notificationManager.notify(1, notification);

某些第三方app使用不规范导致,addAction(null),导致action数组某些值为空

        public Builder addAction(Action action) {
            mActions.add(action);
            return this;
        }

这样导致了system_server崩溃.复现概率为100%,最好的解决方法为将这个静默处理,虽然第三方app使用不规范,但也不给他throw exception.

修改地方有三处

        public Builder addAction(Action action) {
            // MIUI MOD: START
            // mActions.add(action);
            if (action != null) {
                mActions.add(action);
            }
            // MIUI MOD: END
            return this;
        }

        public Builder setActions(Action... actions) {
            mActions.clear();
            for (int i = 0; i < actions.length; i++) {
                // MIUI MOD: START
                // mActions.add(actions[i]);
                if (actions[i] != null) {
                    mActions.add(actions[i]);
                }
                // MIUI MOD: END
            }
            return this;
        }

        if (this.actions != null) {
            that.actions = new Action[this.actions.length];
            for(int i=0; i<this.actions.length; i++) {
                // MIUI MOD: START
                //that.actions[i] = this.actions[i].clone();
                if ( this.actions[i] != null) {
                    that.actions[i] = this.actions[i].clone();
                }
                // MUI MOD: END
            }
        }