Clone extras Bundle when operating on it in onExtrasChanged

Currently, we do not make a copy of the extras Bundle when calling
Connection.setConnectionExtras. In rare cases, when multiple
setConnectionExtras events come in at the same time, they are posted
onto a concurrent Handler and the extras Bundle is cleared while being
copied in TelephonyConnection.updateExtras. This causes an
ArrayOutOfBoundsException and causes the Phone process to crash.

We now create a copy of the Bundle when we post it onto the concurrent
Handler to ensure that there is no simultaneous copy/clear operations
happening on the same extras Bundle.

Bug: 28957661
Change-Id: Icc8200b9a73c261acc6f2b94ace6284437e32e6e
diff --git a/src/java/com/android/internal/telephony/ b/src/java/com/android/internal/telephony/
index 5e02ca3..3f813b1 100644
--- a/src/java/com/android/internal/telephony/
+++ b/src/java/com/android/internal/telephony/
@@ -751,12 +751,14 @@
      * Notifies listeners that connection extras has changed.
-     * @param extras New connection extras.
+     * @param extras New connection extras. This Bundle will be cloned to ensure that any concurrent
+     * modifications to the extras Bundle do not affect Bundle operations in the onExtrasChanged
+     * listeners.
     public void setConnectionExtras(Bundle extras) {
         mExtras = extras;
         for (Listener l : mListeners) {
-            l.onExtrasChanged(extras);
+            l.onExtrasChanged(new Bundle(extras));